5 ms·

Browser extensions are the most vulnerable every day apps people use. They're given so much power so quickly. Users agree to 'view and modify website data' not

Browser extensions are the most vulnerable every day apps people use. They're given so much power so quickly. Users agree to 'view and modify website data' not realizing that the app can now run arbitrary code on their gmail/banking/whatever accounts to report all information including passwords. For all the concern over application security, little is talked about here. Browser extensions are also super important. They stand as the only tool for users to take back control over their experience from companies that are in the interest of manipulating them for profit whenever they can. They are uniquely our agents here. Still, each extension is a potential huge vulnerability. It's tough to find a balance here.

rakoo 6y ago
Browser extensions have exactly as much power as the browser itself; that's why browser vendors controlling the distribution of extensions is not a bad idea in itself. Maybe there's a greater discussion to be had about the power that browsers themselves have over what has now become the life of their users.
- evilpie 6y ago
  > Browser extensions have exactly as much power as the browser itself I would say this is false. Browsers can run arbitrary code on your machine. Extensions can't even access local files. If we are just talking about site information like cookies I would agree.
  - edoceo 6y ago
    Local File Browser extension for Chrome https://chrome.google.com/webstore/detail/local-explorer-file-manag/eokekhgpaakbkfkmjjcbffibkencdfkl?hl=en https://chrome.google.com/webstore/detail/local-explorer-fil...
    - evilpie 6y ago
      Okay, but that requires installing a native code module.
    - Groxx 6y ago
      No, browser extension's can't. From their overview: >HOW TO SET UP >For security reason, Google has made a policy to not allow webpages to read-write local resource on hard drives. So we need an integration between the Chrome Extension and File System (Windows Explorer, Mac OS Finder) using an external software. To install both, just follow the simple steps described in http://www.vnprodev.com/browser-extensions/local-explorer-install.php http://www.vnprodev.com/browser-extensions/local-explorer-in... On a different note, Chrome "apps" historically have had higher access that allowed some file access (I forget the details), but as far as I can remember extensions have not had any ever. Though since you can communicate between apps and extensions, it was possible to install both and work around it a bit. I'm not sure if that has changed since I last toyed around with this though (it has been a couple years at least).
  - paulryanrogers 6y ago
    I'm making extensions that talk to native apps. When that kind of communication is authorized then any vulnerability in the target apps does allow arbitrary execution.
stefan_ 6y ago
It's laziness on the browser makers side. We used to have real extension frameworks, then it turned out just having extensions load arbitrary JS in the context of every webpage is a super easy way to have "rich extensions" so they did that and went shopping. Now the result is that to implement "backspace for back", your extension needs to be able to load arbitrary JS on every domain.
- duskwuff 6y ago
  You're viewing the past with rose-colored glasses. If by "real extension frameworks" you mean XUL, that gave significantly more power to extensions than is even possible under Chrome extensions / WebExtensions.
- JoshTriplett 6y ago
  > We used to have real extension frameworks Those "real extension frameworks" had even more permissions, often to run arbitrary local code as the user.
  - craig131 6y ago
    Browser extensions can still run local code as the user. Example of a Chrome extension loading an arbitrary .dll: https://twitter.com/evilsocket/status/1339566046265696256 https://twitter.com/evilsocket/status/1339566046265696256
avereveard 6y ago
> little is talked about here the problem is that the hive mind has no clue, and downvotes like maniacs facts it doesn't like. here's a previously discussion of what means the read all extension permission https://news.ycombinator.com/item?id=21336246 https://news.ycombinator.com/item?id=21336246 with all the factual, sourced post downvoted and a chain of people with finger in their hears singing lalalala _of course_ I rarely bring up the topic anymore; once enough people get burned they'll learn on their own anyway, I guess.

rakoo 6y ago

Browser extensions have exactly as much power as the browser itself; that's why browser vendors controlling the distribution of extensions is not a bad idea in itself. Maybe there's a greater discussion to be had about the power that browsers themselves have over what has now become the life of their users.

evilpie 6y ago
> Browser extensions have exactly as much power as the browser itself I would say this is false. Browsers can run arbitrary code on your machine. Extensions can't even access local files. If we are just talking about site information like cookies I would agree.
- edoceo 6y ago
  Local File Browser extension for Chrome https://chrome.google.com/webstore/detail/local-explorer-file-manag/eokekhgpaakbkfkmjjcbffibkencdfkl?hl=en https://chrome.google.com/webstore/detail/local-explorer-fil...
  - evilpie 6y ago
    Okay, but that requires installing a native code module.
  - Groxx 6y ago
    No, browser extension's can't. From their overview: >HOW TO SET UP >For security reason, Google has made a policy to not allow webpages to read-write local resource on hard drives. So we need an integration between the Chrome Extension and File System (Windows Explorer, Mac OS Finder) using an external software. To install both, just follow the simple steps described in http://www.vnprodev.com/browser-extensions/local-explorer-install.php http://www.vnprodev.com/browser-extensions/local-explorer-in... On a different note, Chrome "apps" historically have had higher access that allowed some file access (I forget the details), but as far as I can remember extensions have not had any ever. Though since you can communicate between apps and extensions, it was possible to install both and work around it a bit. I'm not sure if that has changed since I last toyed around with this though (it has been a couple years at least).
- paulryanrogers 6y ago
  I'm making extensions that talk to native apps. When that kind of communication is authorized then any vulnerability in the target apps does allow arbitrary execution.

stefan_ 6y ago

It's laziness on the browser makers side. We used to have real extension frameworks, then it turned out just having extensions load arbitrary JS in the context of every webpage is a super easy way to have "rich extensions" so they did that and went shopping. Now the result is that to implement "backspace for back", your extension needs to be able to load arbitrary JS on every domain.

duskwuff 6y ago
You're viewing the past with rose-colored glasses. If by "real extension frameworks" you mean XUL, that gave significantly more power to extensions than is even possible under Chrome extensions / WebExtensions.
JoshTriplett 6y ago
> We used to have real extension frameworks Those "real extension frameworks" had even more permissions, often to run arbitrary local code as the user.
- craig131 6y ago
  Browser extensions can still run local code as the user. Example of a Chrome extension loading an arbitrary .dll: https://twitter.com/evilsocket/status/1339566046265696256 https://twitter.com/evilsocket/status/1339566046265696256

avereveard 6y ago

> little is talked about here the problem is that the hive mind has no clue, and downvotes like maniacs facts it doesn't like. here's a previously discussion of what means the read all extension permission https://news.ycombinator.com/item?id=21336246 https://news.ycombinator.com/item?id=21336246 with all the factual, sourced post downvoted and a chain of people with finger in their hears singing lalalala _of course_ I rarely bring up the topic anymore; once enough people get burned they'll learn on their own anyway, I guess.