4 ms·
Cursed Chrome
- guiambros 5y agoScary. Browser extensions are my biggest worry. Most popular extensions come from small indie developers with no track record, and without the oversight of the open source community. It's also time consuming to inspect the source for each extension (particularly if it's minified, no comments, etc). And pointless, given they will auto-update. And depending on permissions, they may access your cookies, localStorage, browser URLs, intercept clipboard, etc. Of course you should still be careful, only give specific permissions, read reviews, check if the code was published, etc, but it's still a massive surface area, like demonstrated by OP's proof-of-concept.
- deleted 5y ago[deleted]
- cute_boi 5y agoI would count this as a feature. Maybe chrome should prompt user for the first time if there are multiple connections made via extensions. That being said, I do acknowledge companies like Lumniati (Sketchy Company) tries to find gullible extension developer to plant proxy related malwares.
- _8j50 5y agoVery cool. I have been meaning to look into something like this for a slightly different purpose but I wanted to look at background chrome apps instead. Extensions have a lot of eyes on them but apps and PWA's not so much.
- u2077 5y agoI once had an extension installed that was later declared malicious. I thought I did my research because not only did it have good reviews, it was also recommend in countless articles which were all clueless about the possibility. Now I only use open-source extensions.