5 ms·

All chrome did was prevent extensions from blocking requests. They can still see all requests and do with them what they want, just read-only. How does that so

All chrome did was prevent extensions from blocking requests. They can still see all requests and do with them what they want, just read-only. How does that solve the security issue you mentioned?

charcircuit 4y ago
[flagged]
- blibble 4y ago
  indeed, with Google being a well known champion of privacy
  - taneq 4y ago
    Google takes your privacy very seriously. Where ‘privacy’ is defined as ‘giving you control over who Google shared your data with’, of course.
    - charcircuit 4y ago
      [flagged]
      - hgsgm 4y ago
        Except that Google exempts itself from those privacy controls, if you use a Google product. Users "understand" that Google records most everything they do on the web, for advertising purposes.
        charcircuit 4y ago
        >Except that Google exempts itself from those privacy controls, if you use a Google product. No it doesn't. Google takes privacy issues very seriously just like security issues. You can disable Google storing your web activity in your account's privacy settings here. https://myactivity.google.com/myactivity https://myactivity.google.com/myactivity
        Operative0198 4y ago
        Nope. Google "reads" all your data and saves it to push ads & suggested content to you. I know this because Google read my emails (AFAIK there's no toggle to disable tracking on this product) and suggested me a video based on the contents of one of my emails. Mind you, I wasn't even logged in on YouTube at the time.
        charcircuit 4y ago
        YouTube recommendations are only based off your activity on YouTube. Google doesn't even read your emails for ad targeting. Your anecdote was just confirmation bias.
        Operative0198 4y ago
        The suggested video was too specific to be just an anecdote. YouTube doesn't need an account nor cookies to show you videos. They know you if your browser is fingerprintable enough. I did the test on a fresh new profile.
        shadowgovt 4y ago
        Almost every time, that sort of phenomenon occurs because people's consumption patterns aren't nearly as unique as they think they are.
- cxr 4y ago
  To understand what's wrong with this, consider what happens when you change a word: Giving a browser access to see any request you ever make is not good for privacy. Sounds silly, right? That's why people take issue with what you're saying. People who use content blockers often don't (and shouldn't) see things as "my browser" plus "the extensions I use—which my browser should protect me from, not unlike the way it protects me from random pages out on the Web". We're talking about user agents. Where content blockers like uBlock Origin are concerned, the combination of Firefox + uBlock Origin _is_ the user agent. Firefox alone is not. Think of it like hiring an actual live (i.e. human) agent who should act on your behalf and take care of things. Consider that if you put it this way, when asked if Firefox is sufficient/adequate/reliable enough to perform that role on its own, the majority of relevant* users would respond in a way that reveals that the answer is decidedly a "no". Related: <https://www.w3.org/TR/html-design-principles/#priority-of-constituencies https://www.w3.org/TR/html-design-principles/#priority-of-co...> * I'm overconstraining to emphasize the types of discriminating users who install content blockers. In fact, though, the qualifier is unnecessary because in a literal sense the majority of users agree, since they aren't choosing Firefox to begin with.
  - charcircuit 4y ago
    The browser and extensions are made by different people. It makes sense to want to give different people different amounts of permission. If we could choose between a reality where both the ad blocker and ad blocker extention creator had access to your browsing history or a reality where only the browser did don't you see how it would be better to live in the second reality if the adblocker worked just as well? Similarly for seeing requests we can make it even more granular than just the browser. For example if someone exploits the V8 JIT and gains code execution in a tab it shouldn't be able to see the requests being made in another tab.
    - cxr 4y ago
      Consisting of multiple parts "made by different people" describes virtually every piece of desktop software. > If we could choose between a reality where both the ad blocker and ad blocker extention creator had access to your browsing history or a reality where only the browser did don't you see how it would be better to live in the second reality if the adblocker worked just as well? No. My agent is uBlock Origin with a very large dependency attached (Firefox). The value of your proposition is null. Your response amounts to a form of begging the question, anyway.
- kuschku 4y ago
  But that's not the case! declarativeNetRequest still allows adblockers to modify arbitrary content or send requests to their own servers, and the webRequest API still allows extensions to track every request and analyze it. There's no security gained whatsoever. If it was about security, the webRequest API would have been removed entirely, but they didn't do that, they just changed it enough to prevent it being used by adblockers while continuing to allow tracking.
  - charcircuit 4y ago
    >declarativeNetRequest still allows adblockers to modify arbitrary content or send requests to their own servers That requires a separate permission and a host permission to do that compared to just blocking requests. >and the webRequest API The webrequest API needs separate permissions. This is a matter of principle of least privilege than changing what's possible. Can we give extentions the minimum amount of permission in order for them to still be useful
shadowgovt 4y ago
The security hole is in the guarantees the app store is able to make. webRequest API, because it runs arbitrary JS, could do anything including something malicious by modifying external JS after the extension was submitted to the store. It's an API that makes it impossible for a store to make security guarantees at all. This is, unfortunately, the behavior ad blockers rely upon to keep their databases of malicious actors fresh.
- hgsgm 4y ago
  That's not really true. Block lists can be updated via the store. The security hole is that the app might maliciously modify the content of the pages you are viewing. It doesn't need to make requests if can tell your page to send your requests to a different server. The declarative API solves that by not allowing page modification outside of safety boundaries like deleting elements.
  - tadfisher 4y ago
    Another way to solve it would have been to define a "blocking" webRequestFilter function of the form "Request -> Bool", because ad blockers only care about preventing requests, not actually executing requests or modifying results.
  - amluto 4y ago
    Come again? Here’s an example with declarativeNetRequest that modifies requests: https://stackoverflow.com/questions/3274144/can-i-modify-outgoing-request-headers-with-a-chrome-extension https://stackoverflow.com/questions/3274144/can-i-modify-out... Saying that manifest v3 is about security is really not credible. Maybe the changes look like security, but the details are simply not consistent with security being the primary goal.

All chrome did was prevent extensions from blocking requests. They can still see all requests and do with them what they want, just read-only. How does that solve the security issue you mentioned?

charcircuit 4y ago

[flagged]

blibble 4y ago
indeed, with Google being a well known champion of privacy
- taneq 4y ago
  Google takes your privacy very seriously. Where ‘privacy’ is defined as ‘giving you control over who Google shared your data with’, of course.
  - charcircuit 4y ago
    [flagged]
    - hgsgm 4y ago
      Except that Google exempts itself from those privacy controls, if you use a Google product. Users "understand" that Google records most everything they do on the web, for advertising purposes.
      - charcircuit 4y ago
        >Except that Google exempts itself from those privacy controls, if you use a Google product. No it doesn't. Google takes privacy issues very seriously just like security issues. You can disable Google storing your web activity in your account's privacy settings here. https://myactivity.google.com/myactivity https://myactivity.google.com/myactivity
        Operative0198 4y ago
        Nope. Google "reads" all your data and saves it to push ads & suggested content to you. I know this because Google read my emails (AFAIK there's no toggle to disable tracking on this product) and suggested me a video based on the contents of one of my emails. Mind you, I wasn't even logged in on YouTube at the time.
        charcircuit 4y ago
        YouTube recommendations are only based off your activity on YouTube. Google doesn't even read your emails for ad targeting. Your anecdote was just confirmation bias.
        Operative0198 4y ago
        The suggested video was too specific to be just an anecdote. YouTube doesn't need an account nor cookies to show you videos. They know you if your browser is fingerprintable enough. I did the test on a fresh new profile.
        shadowgovt 4y ago
        Almost every time, that sort of phenomenon occurs because people's consumption patterns aren't nearly as unique as they think they are.
cxr 4y ago
To understand what's wrong with this, consider what happens when you change a word: Giving a browser access to see any request you ever make is not good for privacy. Sounds silly, right? That's why people take issue with what you're saying. People who use content blockers often don't (and shouldn't) see things as "my browser" plus "the extensions I use—which my browser should protect me from, not unlike the way it protects me from random pages out on the Web". We're talking about user agents. Where content blockers like uBlock Origin are concerned, the combination of Firefox + uBlock Origin _is_ the user agent. Firefox alone is not. Think of it like hiring an actual live (i.e. human) agent who should act on your behalf and take care of things. Consider that if you put it this way, when asked if Firefox is sufficient/adequate/reliable enough to perform that role on its own, the majority of relevant* users would respond in a way that reveals that the answer is decidedly a "no". Related: <https://www.w3.org/TR/html-design-principles/#priority-of-constituencies https://www.w3.org/TR/html-design-principles/#priority-of-co...> * I'm overconstraining to emphasize the types of discriminating users who install content blockers. In fact, though, the qualifier is unnecessary because in a literal sense the majority of users agree, since they aren't choosing Firefox to begin with.
- charcircuit 4y ago
  The browser and extensions are made by different people. It makes sense to want to give different people different amounts of permission. If we could choose between a reality where both the ad blocker and ad blocker extention creator had access to your browsing history or a reality where only the browser did don't you see how it would be better to live in the second reality if the adblocker worked just as well? Similarly for seeing requests we can make it even more granular than just the browser. For example if someone exploits the V8 JIT and gains code execution in a tab it shouldn't be able to see the requests being made in another tab.
  - cxr 4y ago
    Consisting of multiple parts "made by different people" describes virtually every piece of desktop software. > If we could choose between a reality where both the ad blocker and ad blocker extention creator had access to your browsing history or a reality where only the browser did don't you see how it would be better to live in the second reality if the adblocker worked just as well? No. My agent is uBlock Origin with a very large dependency attached (Firefox). The value of your proposition is null. Your response amounts to a form of begging the question, anyway.
kuschku 4y ago
But that's not the case! declarativeNetRequest still allows adblockers to modify arbitrary content or send requests to their own servers, and the webRequest API still allows extensions to track every request and analyze it. There's no security gained whatsoever. If it was about security, the webRequest API would have been removed entirely, but they didn't do that, they just changed it enough to prevent it being used by adblockers while continuing to allow tracking.
- charcircuit 4y ago
  >declarativeNetRequest still allows adblockers to modify arbitrary content or send requests to their own servers That requires a separate permission and a host permission to do that compared to just blocking requests. >and the webRequest API The webrequest API needs separate permissions. This is a matter of principle of least privilege than changing what's possible. Can we give extentions the minimum amount of permission in order for them to still be useful

shadowgovt 4y ago

The security hole is in the guarantees the app store is able to make. webRequest API, because it runs arbitrary JS, could do anything including something malicious by modifying external JS after the extension was submitted to the store. It's an API that makes it impossible for a store to make security guarantees at all. This is, unfortunately, the behavior ad blockers rely upon to keep their databases of malicious actors fresh.

hgsgm 4y ago
That's not really true. Block lists can be updated via the store. The security hole is that the app might maliciously modify the content of the pages you are viewing. It doesn't need to make requests if can tell your page to send your requests to a different server. The declarative API solves that by not allowing page modification outside of safety boundaries like deleting elements.
- tadfisher 4y ago
  Another way to solve it would have been to define a "blocking" webRequestFilter function of the form "Request -> Bool", because ad blockers only care about preventing requests, not actually executing requests or modifying results.
- amluto 4y ago
  Come again? Here’s an example with declarativeNetRequest that modifies requests: https://stackoverflow.com/questions/3274144/can-i-modify-outgoing-request-headers-with-a-chrome-extension https://stackoverflow.com/questions/3274144/can-i-modify-out... Saying that manifest v3 is about security is really not credible. Maybe the changes look like security, but the details are simply not consistent with security being the primary goal.