10 ms·

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure things look and operate as expected. Especially for a security sensitive UI element. The chain of humans who've been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years. There are so many risk-reduction controls in place; tons of red tape and umpteen security and privacy reviews required to ship even minor features or updates, yet here we are. How many hands have been in the pot and not noticed/raised/resolved what amounts to a pretty obvious security vulnerability? And if this kind of issue can fly undetected for so long, what can organizations with drastically less resources than $GOOG do to ensure adequate velocity while not leaving the proverbial barn doors open? The author deserves the highest tier of bug bounty reward for bringing this to light. What's that? It wasn't submitted through the proper channels to be eligible? Right. <insert relevant Dildbort cartoon>

s4i 4y ago
But isn't the scrolling problematic here only because macOS by default hides the scrollbars when there is no traditional mouse connected?
- eimrine 4y ago
  I've experienced this problem once on Windows when I've installed a free VPN and noticed that the list of permissions lacks some obvious points.
eyelidlessness 4y ago
This introduces an especially silly attack vector: if you expect that asking for a specific permission might alarm users, and if you can push it below the fold, just ask for more innocuous or plausible permissions than you need! Besides the oversight of hiding some permission requests, this highlights that the order they’re presented matters too. Even if it weren’t scrollable with ~invisible indication of that, people stop reading at some point. If N lines (I’m gonna guess ~5 for most people) seem totally innocuous, the rest are probably effectively invisible.
- ameliaquining 4y ago
  In general, for the most part, it looks like the permissions shown higher in the list are the more dangerous ones. In particular, "read and change all your data on websites" is by far the most dangerous permission, and it always appears first or second. ("Access the page debugger backend", which is above it, sounds technical and opaque to most users, but the permission that it gates also triggers the "read and change all your data" warning.) I vaguely suspect that this is by design.
  - eyelidlessness 4y ago
    There are several below the fold that I’d consider more dangerous than “show notifications”, but I suppose that one is enough of a nuisance to most people that it gets sorted up. Either way, having this kind of design is an opportunity for it to be gamed. Probably a better design would be more annoying over time (prompting for permissions as needed), but I’m the oddball who’d prefer that annoyance over this kind of approve-and-forget scheme.
  - pflenker 4y ago
    Every ad blocker asks for "read and change all your data on websites" permission, same as page scrapers/readability tools - so depending on the disguise I think it won't be hard to get this permission.
- jefftk 4y ago
  > just ask for more innocuous or plausible permissions than you need! Looking at the list I think they're sorting by ~alarmingness, so it seems hard to push an alarming one below the fold with innocuous ones?
ClumsyPilot 4y ago
> The chain of humans who've been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years. There should be liability for negligence. If you were told about a security hole and you have not fixed it, and you have not informed your users, in months, you should pay statutory damages. And if you lied about your app (claiming encryption where there is none) you should be liable too, even if the app is free
- Sebb767 4y ago
  Well, you can get a full refund. I see where you are coming from, but increasing liability for free software does not feel like a good idea to me at all. There's basically no way you could extract money protected by Googles lawyers army, but any small open-source project or even medium sized company will be extremely vary of releasing anything. I'm not saying you should never go there - GDPR does and it's a net improvement -, but it's extremely easy to massively overshoot.
  - jszymborski 4y ago
    It may be free software but it's also a commercial enterprise. Furthermore, Chromium is free software, Chrome isn't. Perhaps Google should be liable for distributing Chrome in such a sorry state, but not for what lands in Chromium.
  - A4ET8a8uTh0 4y ago
    I don't really disagree, but to play devil's advocate a little, if I was giving away free knives and someone cut themselves, would I be to blame in any way?
    - paulryanrogers 4y ago
      Are you marketing it as a safer alternative? Do you have a near monopoly on knives?
      - 4y ago
Gigachad 4y ago
Extensions in general are a massive security issue and it’s impossible to fix without crippling them beyond uselessness. Or maybe having approved extensions only.
- latchkey 4y ago
  Sounds like the Apple app store.
  - Gigachad 4y ago
    Apps are a different thing since even if you sideload apps, one app can’t insert itself in to another app to scrape your data. While extensions are almost like kernel extensions that can do just about anything.
    - dcow 4y ago
      The naivety of innocence is rather blissful, isn't it?
      - nine_k 4y ago
        But the idea of the app isolation is just that — apps should not be able to touch each other. There are of course escape hatches, because sometimes you want apps to interact.
        dcow 4y ago
        Extensions cannot touch each other. They also can't touch other websites without an escape hatch, because sometimes you want your password manager to modify the DOM and fill in your password for you.
        dimensi0nal 4y ago
        extensions have to touch other websites to be useful
2OEH8eoCRo0 4y ago
> if this kind of issue can fly undetected for so long, what can organizations with drastically less resources than $GOOG do to ensure adequate velocity while not leaving the proverbial barn doors open? If $GOOG can't do it with practically infinite resources then I'm of the opinion that nobody can. Computing is broken.
- danielheath 4y ago
  It's not a question of having enough resources. $GOOG can't do it because anyone who isn't building a promo packet by launching new services is on the way out.
- jszymborski 4y ago
  Are we certain that they are motivated to do so? Google doesn't strike me as a company committed to user privacy.
  - deleted 4y ago
    [deleted]
  - metadat 4y ago
    There is no company on earth with a larger privacy organization than Google. Edit: @dogecoinbase: What you propose is a shallow and dismissive analysis of the oversimplicative variety. Please put in a little more effort before derailing an otherwise thoughtful conversation.
    - dogecoinbase 4y ago
      The lesson, then, appears to be that size of privacy organization does not have a correlated effect on effectiveness.
    - mikeho1999 4y ago
      @metadat -- can you provide the source for that? I'm genuinely curious how much Google spends on their privacy org, and esp. how that compares with the other big tech companies.
crazygringo 4y ago
> An egregious and nearly unbelievable oversight on Google's part. :-\ I agree it's egregious, but it's quite easy to believe. It's surely just using a standard modal and passing a string. The thing is, this is on a Mac that has scroll bars that are invisible until you scroll. It's easy to imagine testing was done other OS's where the scroll bars are obvious and the bottom line might be only partially hidden which makes it even clearer. And/or that testers never caught it on a Mac because they themselves never realized there were more. I would hope somebody sees this now and prioritzes a Chromium bug for it. Because on a Mac at least, this is pretty serious. (And I'm well aware this is a good example of a negative side effect of Apple's choice to make scroll bars visible by default only while scrolling.)
- Dalewyn 4y ago
  >this is on a Mac that has scroll bars that are invisible until you scroll. What modern UI even has visible scroll bars by default? And assuming it's even visible (either by default or user-configured after the fact if that's even possible), what modern UI even has scroll bars wider than 1px?
  - nightpool 4y ago
    74% of all users? https://en.wikipedia.org/wiki/Usage_share_of_operating_systems https://en.wikipedia.org/wiki/Usage_share_of_operating_syste...
  - Shared404 4y ago
    > What modern UI even has visible scroll bars by default? Pretty much all of them except Mac. Can speak personally for KDE, Sway, GNOME, and Windows 10. And when they are invisible, they usually show up on mouse motion/window interaction, so it's still not as egregious.
    - djbusby 4y ago
      Xfce4.18 (GTK) has them. Has for 15+ years. Shout out to Xfce for being so boring/consistent for more than a decade.
ocdtrekkie 4y ago
> An egregious and nearly unbelievable oversight on Google's part. This describes Google's entire approach to browser extensions. It's so cosmically and hilariously bad, and because extensions grant post-decryption access, renders basically every other security and privacy effort they've ever done with web standards completely pointless. All that garbage about encrypting everything in transit is entirely irrelevant when the endpoint is a masterpiece of bad security design.
interpol_p 4y ago
Even if they were to somehow show everything up-front, it would be user hostile design. No one wants to read and consider every possible permission prior to granting it to the thing they want to use Even if there were 20 items in the list, people would hit "OK," it's like accepting terms and conditions. Most people won't read them, they're trained to hit "Agree" The whole model needs an overhaul. Extensions should be required to ask whenever they need the specific resource, rather than asking up-front. And each gated resource should get its own prompt with its own informative design. Similar to permissions on mobile
- wartijn_ 4y ago
  That would make the password manager plugin I use extremely annoying to use. I want that plugin to read every page I visit so it can detect username and password fields. The same goes for many other extensions, like ad blockers. They should block all ads they can find, without constantly needing to annoy users with permission prompts.
eviks 4y ago
But it's not the issue of the quantity of resources, it's about their quality, and it's a bit puzzling you find these pervasive issues hard to imagine
aboodman 4y ago
> The chain of humans who've been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years. As the first in this chain of humans, I can tell you that (a) we obviously considered this in the first version of extensions and did not allow permissions "below" the fold, (b) Chrome's extension model dramatically improved on the previous state of the art which was Firefox's "every extension can do everything, extensions can't be uninstalled completely, and there's no review" [1], and (c) the install dialog is just one part in a bigger system which includes the review process. I encourage the author to try and get this onto the store and get meaningful usage, then we can complain about how well the entire system works end to end. Examining just the install dialog alone is missing the point. I'm not even certain that an extension that requests more than 5 permissions would be approved in the first place. I also encourage readers to remember that generally speaking, you all _want_ extensions. When Chrome didn't have them, they were the top feature request in the bug tracker. Real security is hard. If you don't solve user needs, users solve them themselves with solutions that are even worse (ie native code). Managing the browser extension system is a thankless painful job of delicately balancing incentives. Extensions need to work well enough that developers don't reach for more powerful and dangerous tools, but have enough controls that the majority of malware can be controlled. It sucks. Trust me you really don't want this job. Please spare a bit of empathy for the "chain of humans" that have had it. [1] https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/38394.pdf https://static.googleusercontent.com/media/research.google.c...
- 1vuio0pswjnm7 4y ago
  "I also encourage readers to remember that generally speaking, you all _want_ extensions." Exception here. Never asked for them. Never wanted them. Do not and cannot use them.^1 Seems moot anyway as I doubt anyone ever asked for Chrome itself. When an extension collects data under the radar it's "malware" but when Google does this, it isn't malware. Funny. There's really no greater "danger" to www users than Google because it's nearly impossible to stop Google from doing what it wants. The company is embedded in every aspect of using the web. Malware authors might be a threat but they hold no such omnipotent control. Google is the largest threat. 1. Occasional Chrome user via Guest mode that does not permit Extensions.
deafpolygon 4y ago
> nearly unbelievable oversight on Google's part You're giving Google way too much credit here. Do you not think they use some of these techniques here? Or that they're an endpoint for other people's usage of these techniques? > security has been asleep at the wheel this whole time, for something like 15 years All is as intended.
HlessClaudesman 4y ago
A completely foreseeable negative externality of the ubiquitous GDPR cookie permission popup, is training users to just click on any old shit.
- dmitriid 4y ago
  GDPR does not mandate the popup (which in most cases is even illegal under GDPR).
ano88888 4y ago
there is always a balance or tradeoff between convienence and security. If you maximize security, you will have a piece of software nobody wants to use unless there is a gun pointing at their head. Not that security is unimportant but please also keep user experience in mind when you design security.
- kazinator 4y ago
  What's that saying? Ah, found it: "Security at the expense of usability comes at the expense of security." If you maximize security, so that there is poor convenience/usability, people will find usability workarounds which compromise security.
msm_ 4y ago
> The author deserves the highest tier of bug bounty reward for bringing this to light. What's that? It wasn't submitted through the proper channels to be eligible? Right. Almost entire point of bug bounty programs is to encourage researchers to submit vulnerabilities using a proper channel and adhering to a proper procedure.
OkGoDoIt 4y ago
And what’s even worse, in that screenshot there’s no visible scrollbar to show there is even any additional data below the fold, or any indication that it’s a scrollable control in the first place. I can’t tell looking at it that there’s any possibility of further permissions anywhere.

s4i 4y ago

But isn't the scrolling problematic here only because macOS by default hides the scrollbars when there is no traditional mouse connected?

eimrine 4y ago
I've experienced this problem once on Windows when I've installed a free VPN and noticed that the list of permissions lacks some obvious points.

eyelidlessness 4y ago

This introduces an especially silly attack vector: if you expect that asking for a specific permission might alarm users, and if you can push it below the fold, just ask for more innocuous or plausible permissions than you need! Besides the oversight of hiding some permission requests, this highlights that the order they’re presented matters too. Even if it weren’t scrollable with ~invisible indication of that, people stop reading at some point. If N lines (I’m gonna guess ~5 for most people) seem totally innocuous, the rest are probably effectively invisible.

ameliaquining 4y ago
In general, for the most part, it looks like the permissions shown higher in the list are the more dangerous ones. In particular, "read and change all your data on websites" is by far the most dangerous permission, and it always appears first or second. ("Access the page debugger backend", which is above it, sounds technical and opaque to most users, but the permission that it gates also triggers the "read and change all your data" warning.) I vaguely suspect that this is by design.
- eyelidlessness 4y ago
  There are several below the fold that I’d consider more dangerous than “show notifications”, but I suppose that one is enough of a nuisance to most people that it gets sorted up. Either way, having this kind of design is an opportunity for it to be gamed. Probably a better design would be more annoying over time (prompting for permissions as needed), but I’m the oddball who’d prefer that annoyance over this kind of approve-and-forget scheme.
- pflenker 4y ago
  Every ad blocker asks for "read and change all your data on websites" permission, same as page scrapers/readability tools - so depending on the disguise I think it won't be hard to get this permission.
jefftk 4y ago
> just ask for more innocuous or plausible permissions than you need! Looking at the list I think they're sorting by ~alarmingness, so it seems hard to push an alarming one below the fold with innocuous ones?

ClumsyPilot 4y ago

> The chain of humans who've been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years. There should be liability for negligence. If you were told about a security hole and you have not fixed it, and you have not informed your users, in months, you should pay statutory damages. And if you lied about your app (claiming encryption where there is none) you should be liable too, even if the app is free

Sebb767 4y ago
Well, you can get a full refund. I see where you are coming from, but increasing liability for free software does not feel like a good idea to me at all. There's basically no way you could extract money protected by Googles lawyers army, but any small open-source project or even medium sized company will be extremely vary of releasing anything. I'm not saying you should never go there - GDPR does and it's a net improvement -, but it's extremely easy to massively overshoot.
- jszymborski 4y ago
  It may be free software but it's also a commercial enterprise. Furthermore, Chromium is free software, Chrome isn't. Perhaps Google should be liable for distributing Chrome in such a sorry state, but not for what lands in Chromium.
- A4ET8a8uTh0 4y ago
  I don't really disagree, but to play devil's advocate a little, if I was giving away free knives and someone cut themselves, would I be to blame in any way?
  - paulryanrogers 4y ago
    Are you marketing it as a safer alternative? Do you have a near monopoly on knives?
    - 4y ago

Gigachad 4y ago

Extensions in general are a massive security issue and it’s impossible to fix without crippling them beyond uselessness. Or maybe having approved extensions only.

latchkey 4y ago
Sounds like the Apple app store.
- Gigachad 4y ago
  Apps are a different thing since even if you sideload apps, one app can’t insert itself in to another app to scrape your data. While extensions are almost like kernel extensions that can do just about anything.
  - dcow 4y ago
    The naivety of innocence is rather blissful, isn't it?
    - nine_k 4y ago
      But the idea of the app isolation is just that — apps should not be able to touch each other. There are of course escape hatches, because sometimes you want apps to interact.
      - dcow 4y ago
        Extensions cannot touch each other. They also can't touch other websites without an escape hatch, because sometimes you want your password manager to modify the DOM and fill in your password for you.
        dimensi0nal 4y ago
        extensions have to touch other websites to be useful

2OEH8eoCRo0 4y ago

> if this kind of issue can fly undetected for so long, what can organizations with drastically less resources than $GOOG do to ensure adequate velocity while not leaving the proverbial barn doors open? If $GOOG can't do it with practically infinite resources then I'm of the opinion that nobody can. Computing is broken.

danielheath 4y ago
It's not a question of having enough resources. $GOOG can't do it because anyone who isn't building a promo packet by launching new services is on the way out.
jszymborski 4y ago
Are we certain that they are motivated to do so? Google doesn't strike me as a company committed to user privacy.
- deleted 4y ago
  [deleted]
- metadat 4y ago
  There is no company on earth with a larger privacy organization than Google. Edit: @dogecoinbase: What you propose is a shallow and dismissive analysis of the oversimplicative variety. Please put in a little more effort before derailing an otherwise thoughtful conversation.
  - dogecoinbase 4y ago
    The lesson, then, appears to be that size of privacy organization does not have a correlated effect on effectiveness.
  - mikeho1999 4y ago
    @metadat -- can you provide the source for that? I'm genuinely curious how much Google spends on their privacy org, and esp. how that compares with the other big tech companies.

crazygringo 4y ago

> An egregious and nearly unbelievable oversight on Google's part. :-\ I agree it's egregious, but it's quite easy to believe. It's surely just using a standard modal and passing a string. The thing is, this is on a Mac that has scroll bars that are invisible until you scroll. It's easy to imagine testing was done other OS's where the scroll bars are obvious and the bottom line might be only partially hidden which makes it even clearer. And/or that testers never caught it on a Mac because they themselves never realized there were more. I would hope somebody sees this now and prioritzes a Chromium bug for it. Because on a Mac at least, this is pretty serious. (And I'm well aware this is a good example of a negative side effect of Apple's choice to make scroll bars visible by default only while scrolling.)

Dalewyn 4y ago
>this is on a Mac that has scroll bars that are invisible until you scroll. What modern UI even has visible scroll bars by default? And assuming it's even visible (either by default or user-configured after the fact if that's even possible), what modern UI even has scroll bars wider than 1px?
- nightpool 4y ago
  74% of all users? https://en.wikipedia.org/wiki/Usage_share_of_operating_systems https://en.wikipedia.org/wiki/Usage_share_of_operating_syste...
- Shared404 4y ago
  > What modern UI even has visible scroll bars by default? Pretty much all of them except Mac. Can speak personally for KDE, Sway, GNOME, and Windows 10. And when they are invisible, they usually show up on mouse motion/window interaction, so it's still not as egregious.
  - djbusby 4y ago
    Xfce4.18 (GTK) has them. Has for 15+ years. Shout out to Xfce for being so boring/consistent for more than a decade.

ocdtrekkie 4y ago

> An egregious and nearly unbelievable oversight on Google's part. This describes Google's entire approach to browser extensions. It's so cosmically and hilariously bad, and because extensions grant post-decryption access, renders basically every other security and privacy effort they've ever done with web standards completely pointless. All that garbage about encrypting everything in transit is entirely irrelevant when the endpoint is a masterpiece of bad security design.

interpol_p 4y ago

Even if they were to somehow show everything up-front, it would be user hostile design. No one wants to read and consider every possible permission prior to granting it to the thing they want to use Even if there were 20 items in the list, people would hit "OK," it's like accepting terms and conditions. Most people won't read them, they're trained to hit "Agree" The whole model needs an overhaul. Extensions should be required to ask whenever they need the specific resource, rather than asking up-front. And each gated resource should get its own prompt with its own informative design. Similar to permissions on mobile

wartijn_ 4y ago
That would make the password manager plugin I use extremely annoying to use. I want that plugin to read every page I visit so it can detect username and password fields. The same goes for many other extensions, like ad blockers. They should block all ads they can find, without constantly needing to annoy users with permission prompts.

eviks 4y ago

But it's not the issue of the quantity of resources, it's about their quality, and it's a bit puzzling you find these pervasive issues hard to imagine

aboodman 4y ago

> The chain of humans who've been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years. As the first in this chain of humans, I can tell you that (a) we obviously considered this in the first version of extensions and did not allow permissions "below" the fold, (b) Chrome's extension model dramatically improved on the previous state of the art which was Firefox's "every extension can do everything, extensions can't be uninstalled completely, and there's no review" [1], and (c) the install dialog is just one part in a bigger system which includes the review process. I encourage the author to try and get this onto the store and get meaningful usage, then we can complain about how well the entire system works end to end. Examining just the install dialog alone is missing the point. I'm not even certain that an extension that requests more than 5 permissions would be approved in the first place. I also encourage readers to remember that generally speaking, you all _want_ extensions. When Chrome didn't have them, they were the top feature request in the bug tracker. Real security is hard. If you don't solve user needs, users solve them themselves with solutions that are even worse (ie native code). Managing the browser extension system is a thankless painful job of delicately balancing incentives. Extensions need to work well enough that developers don't reach for more powerful and dangerous tools, but have enough controls that the majority of malware can be controlled. It sucks. Trust me you really don't want this job. Please spare a bit of empathy for the "chain of humans" that have had it. [1] https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/38394.pdf https://static.googleusercontent.com/media/research.google.c...

1vuio0pswjnm7 4y ago
"I also encourage readers to remember that generally speaking, you all _want_ extensions." Exception here. Never asked for them. Never wanted them. Do not and cannot use them.^1 Seems moot anyway as I doubt anyone ever asked for Chrome itself. When an extension collects data under the radar it's "malware" but when Google does this, it isn't malware. Funny. There's really no greater "danger" to www users than Google because it's nearly impossible to stop Google from doing what it wants. The company is embedded in every aspect of using the web. Malware authors might be a threat but they hold no such omnipotent control. Google is the largest threat. 1. Occasional Chrome user via Guest mode that does not permit Extensions.

deafpolygon 4y ago

> nearly unbelievable oversight on Google's part You're giving Google way too much credit here. Do you not think they use some of these techniques here? Or that they're an endpoint for other people's usage of these techniques? > security has been asleep at the wheel this whole time, for something like 15 years All is as intended.

HlessClaudesman 4y ago

A completely foreseeable negative externality of the ubiquitous GDPR cookie permission popup, is training users to just click on any old shit.

dmitriid 4y ago
GDPR does not mandate the popup (which in most cases is even illegal under GDPR).

ano88888 4y ago

there is always a balance or tradeoff between convienence and security. If you maximize security, you will have a piece of software nobody wants to use unless there is a gun pointing at their head. Not that security is unimportant but please also keep user experience in mind when you design security.

kazinator 4y ago
What's that saying? Ah, found it: "Security at the expense of usability comes at the expense of security." If you maximize security, so that there is poor convenience/usability, people will find usability workarounds which compromise security.

msm_ 4y ago

> The author deserves the highest tier of bug bounty reward for bringing this to light. What's that? It wasn't submitted through the proper channels to be eligible? Right. Almost entire point of bug bounty programs is to encourage researchers to submit vulnerabilities using a proper channel and adhering to a proper procedure.

OkGoDoIt 4y ago

And what’s even worse, in that screenshot there’s no visible scrollbar to show there is even any additional data below the fold, or any indication that it’s a scrollable control in the first place. I can’t tell looking at it that there’s any possibility of further permissions anywhere.