3 ms·

> Wait until you see what’s possible with executables! The most important thing is whay you tell the user - Windows says "We don't know where Trojan.exe came

> Wait until you see what’s possible with executables! The most important thing is whay you tell the user - Windows says "We don't know where Trojan.exe came from, it could be a virus, are you sure you want to run it?" Chrome says: "You downloaded Trojan.exe from our store, we manage it and check it for viruses. It only asks for harmless permission, install it!" One is warning you, the other is entrapment.

dcow 4y ago
Windows has an app store now too. > It only asks for harmless permission, install it! Not true. It lists all the permissions being requested. Sure the scrollbar issue is real and should be an easy fix. I don't understand why people are so confused about permissions. If the user grants your extension permission to read your browsing history so it can provide value to them, why is that a problem? It's not. The problem is if the user grants a malicious extension the same permission because the extension is fraudulent. The author said this extension would never pass chrome store review, so it seems that the user would never be in this position in the first place and your example doesn't really match reality.
- Dalewyn 4y ago
  >I don't understand why people are so confused about permissions. I don't understand why people (read: devs) still assume permissions are read and understood. The vast majority of people simply do not read nor understand permissions and just instantly hit the OK button. Even Linus from LinusTechTips doesn't read permissions, and he's even a tech guru unlike most people.
  - dcow 4y ago
    So hopefully the Chrome store review process is the nanny they need. The only thing that has permission to read and modify website data on my browsers is my password manager. I trust it. Without that permission it could not operate and provide me immense value. Yes, I would be hosed if it got pwned. It's a calculated risk on my part. One cannot live in a world where we have the benefits of browser extensions and also disallow all behavior that could ever possibly be used for bad. It's an inconsistent worldview.
    - ClumsyPilot 4y ago
      > hopefully the Chrome store review process is the nanny they need. This is very disrespectrull. When you supply exhaustive documentation of your software, how it works, what it does, to users, then you can mock them.
      - dcow 4y ago
        What are you talking about? I'm not mocking anybody. We have app store reviews because it's a known fact that not all users read or care about permissions. My point is simply that those safeguards exist for those users and they seem to be working rather well.
        sp332 4y ago
        A nanny is for kids. Saying someone needs a nanny can be pejorative.
- kube-system 4y ago
  People (usually) understand the words that pop up when an extension/app asks for permissions. But they don't necessarily understand the implications of allowing those permissions. And most have little grasp on how to judge an authors trustworthiness, other than the star rating on the store listing... which is driven by other users who mostly also don't have a clue. It is not unusual to see stories of malicious applications or extensions with hundreds of thousands of happy users and good reviews.
- cryptonector 4y ago
  > I don't understand why people are so confused about permissions. Ask the not-tech-savvy.
jsnell 4y ago
This article is not an example of a Chrome extension being downloaded from the store. Nor is it a case of the extension appearing to only ask for harmless permissions ("read and change data on all websites" is above the fold).
jefftk 4y ago
> It only asks for harmless permission, install it! I see it asking for two very scary permissions, two somewhat scary permissions, and one annoying one?
- nirimda 4y ago
  I think the problem is that you don't actually know what the permission is for. It isn't in relation to anything. It's a blanket permission. But almost everything asks for some kind of blanket permission when you install it. Your only option is to say yes. For mobile apps, things have got better and a lot of things ask for their blanket permission later on in the piece. In many cases, it's still not in relation to anything. When they are in relation to something, you're usually not granting permission to do the thing you want to do, you're granting permission to do anything like what you want to do. The user isn't giving informed consent, because even if, like you, they are informed about what the worst case is for granting this permission, they have no reasonable knowledge about whether the worst case is likely, even knowing that they've been asked to give permission. The questions are simply too generic for informed consent to be possible. (Mobile apps are getting better here as well, but there's still a long way to go.) So the permissions aren't actually about managing your risks; they're about managing Google's risks.
  - jefftk 4y ago
    How would you like this to work?
IshKebab 4y ago
I'm not sure how you somehow drew the conclusion that Windows' warning is better than Chrome's. Windows says "Now I know I say this for literally every program you download, but I'll say it again. It might be harmful because all programs can do anything at all. Good luck!". Chrome says: "This might be harmful and it can do these things: X, Y, Z." Apart from the stupid scrollbar issue that's clearly better. The only problem is they have done the permission model that we've known for like a decade is broken: ask for permissions up front, you can grant all or deny all. Could they not have spoken to the Android team who spent like a decade fixing that mistake and moving to fine grained on demand permission prompts?

dcow 4y ago

Windows has an app store now too. > It only asks for harmless permission, install it! Not true. It lists all the permissions being requested. Sure the scrollbar issue is real and should be an easy fix. I don't understand why people are so confused about permissions. If the user grants your extension permission to read your browsing history so it can provide value to them, why is that a problem? It's not. The problem is if the user grants a malicious extension the same permission because the extension is fraudulent. The author said this extension would never pass chrome store review, so it seems that the user would never be in this position in the first place and your example doesn't really match reality.

Dalewyn 4y ago
>I don't understand why people are so confused about permissions. I don't understand why people (read: devs) still assume permissions are read and understood. The vast majority of people simply do not read nor understand permissions and just instantly hit the OK button. Even Linus from LinusTechTips doesn't read permissions, and he's even a tech guru unlike most people.
- dcow 4y ago
  So hopefully the Chrome store review process is the nanny they need. The only thing that has permission to read and modify website data on my browsers is my password manager. I trust it. Without that permission it could not operate and provide me immense value. Yes, I would be hosed if it got pwned. It's a calculated risk on my part. One cannot live in a world where we have the benefits of browser extensions and also disallow all behavior that could ever possibly be used for bad. It's an inconsistent worldview.
  - ClumsyPilot 4y ago
    > hopefully the Chrome store review process is the nanny they need. This is very disrespectrull. When you supply exhaustive documentation of your software, how it works, what it does, to users, then you can mock them.
    - dcow 4y ago
      What are you talking about? I'm not mocking anybody. We have app store reviews because it's a known fact that not all users read or care about permissions. My point is simply that those safeguards exist for those users and they seem to be working rather well.
      - sp332 4y ago
        A nanny is for kids. Saying someone needs a nanny can be pejorative.
kube-system 4y ago
People (usually) understand the words that pop up when an extension/app asks for permissions. But they don't necessarily understand the implications of allowing those permissions. And most have little grasp on how to judge an authors trustworthiness, other than the star rating on the store listing... which is driven by other users who mostly also don't have a clue. It is not unusual to see stories of malicious applications or extensions with hundreds of thousands of happy users and good reviews.
cryptonector 4y ago
> I don't understand why people are so confused about permissions. Ask the not-tech-savvy.

jsnell 4y ago

This article is not an example of a Chrome extension being downloaded from the store. Nor is it a case of the extension appearing to only ask for harmless permissions ("read and change data on all websites" is above the fold).

jefftk 4y ago

> It only asks for harmless permission, install it! I see it asking for two very scary permissions, two somewhat scary permissions, and one annoying one?

nirimda 4y ago
I think the problem is that you don't actually know what the permission is for. It isn't in relation to anything. It's a blanket permission. But almost everything asks for some kind of blanket permission when you install it. Your only option is to say yes. For mobile apps, things have got better and a lot of things ask for their blanket permission later on in the piece. In many cases, it's still not in relation to anything. When they are in relation to something, you're usually not granting permission to do the thing you want to do, you're granting permission to do anything like what you want to do. The user isn't giving informed consent, because even if, like you, they are informed about what the worst case is for granting this permission, they have no reasonable knowledge about whether the worst case is likely, even knowing that they've been asked to give permission. The questions are simply too generic for informed consent to be possible. (Mobile apps are getting better here as well, but there's still a long way to go.) So the permissions aren't actually about managing your risks; they're about managing Google's risks.
- jefftk 4y ago
  How would you like this to work?

IshKebab 4y ago

I'm not sure how you somehow drew the conclusion that Windows' warning is better than Chrome's. Windows says "Now I know I say this for literally every program you download, but I'll say it again. It might be harmful because all programs can do anything at all. Good luck!". Chrome says: "This might be harmful and it can do these things: X, Y, Z." Apart from the stupid scrollbar issue that's clearly better. The only problem is they have done the permission model that we've known for like a decade is broken: ask for permissions up front, you can grant all or deny all. Could they not have spoken to the Android team who spent like a decade fixing that mistake and moving to fine grained on demand permission prompts?