3 ms·

Isn't this a huge vulnerability that rises to the level of "Chrome team should police this"? I mean, just thinking potential threats (which now I'm removing th

Isn't this a huge vulnerability that rises to the level of "Chrome team should police this"? I mean, just thinking potential threats (which now I'm removing the extension because of them): -- corporate web pages potentially sniffable if installed on work computer -- personal passwords, password manager traffic The potentially malicious actor is able to just scoop up any domain's encrypted traffic, isn't it? Or is there any practical assurance that they're only gathering domain names, high level traffic stats, etc?

tonymet 6y ago
In a word, yes. When you install and the extension says “has access to all the data on all web sites you visit” – this means all of your passwords, cookies can be recorded and sent to any other domain.
- supernova87a 6y ago
  Would some agent be recording and transmitting the content of webpages in full, broadly? Or just capturing user-entered information?
  - tonymet 6y ago
    Yes, and definitely. Here's an example from the NanoBlock vs uBlock Origin controversy where cookies and private data were being harvested https://github.com/NanoAdblocker/NanoCore/issues/362#issuecomment-709428210 https://github.com/NanoAdblocker/NanoCore/issues/362#issueco... Assume that any time an app has privilege to access your data, they are going to do it either deliberately or accidentally.
derwiki 6y ago
At my company, our Macs are all managed with policies and we have a strict subset of Chrome extensions allowed for install. All of which have been vetted by our security team. Most* allowed are owned by large companies. As my company is not FAANG I would imagine this is common at many companies.
- JimDabell 6y ago
  > we have a strict subset of Chrome extensions allowed for install. All of which have been vetted by our security team. How do you handle a situation like this, where an extension was previously trusted (and would therefore have passed your vetting procedure), then acquired by somebody else who is apparently malicious? Do you review every new version?
  - jannes 6y ago
    I think that’s what he was getting at when he said: > Most allowed are owned by large companies. He was implying that big companies are not in the business of selling their extensions. Smaller actors are more susceptible to this.

tonymet 6y ago

In a word, yes. When you install and the extension says “has access to all the data on all web sites you visit” – this means all of your passwords, cookies can be recorded and sent to any other domain.

supernova87a 6y ago
Would some agent be recording and transmitting the content of webpages in full, broadly? Or just capturing user-entered information?
- tonymet 6y ago
  Yes, and definitely. Here's an example from the NanoBlock vs uBlock Origin controversy where cookies and private data were being harvested https://github.com/NanoAdblocker/NanoCore/issues/362#issuecomment-709428210 https://github.com/NanoAdblocker/NanoCore/issues/362#issueco... Assume that any time an app has privilege to access your data, they are going to do it either deliberately or accidentally.

derwiki 6y ago

At my company, our Macs are all managed with policies and we have a strict subset of Chrome extensions allowed for install. All of which have been vetted by our security team. Most* allowed are owned by large companies. As my company is not FAANG I would imagine this is common at many companies.

JimDabell 6y ago
> we have a strict subset of Chrome extensions allowed for install. All of which have been vetted by our security team. How do you handle a situation like this, where an extension was previously trusted (and would therefore have passed your vetting procedure), then acquired by somebody else who is apparently malicious? Do you review every new version?
- jannes 6y ago
  I think that’s what he was getting at when he said: > Most allowed are owned by large companies. He was implying that big companies are not in the business of selling their extensions. Smaller actors are more susceptible to this.