5 ms·

> The chain of humans who've been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole tim

> The chain of humans who've been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years. As the first in this chain of humans, I can tell you that (a) we obviously considered this in the first version of extensions and did not allow permissions "below" the fold, (b) Chrome's extension model dramatically improved on the previous state of the art which was Firefox's "every extension can do everything, extensions can't be uninstalled completely, and there's no review" [1], and (c) the install dialog is just one part in a bigger system which includes the review process. I encourage the author to try and get this onto the store and get meaningful usage, then we can complain about how well the entire system works end to end. Examining just the install dialog alone is missing the point. I'm not even certain that an extension that requests more than 5 permissions would be approved in the first place. I also encourage readers to remember that generally speaking, you all _want_ extensions. When Chrome didn't have them, they were the top feature request in the bug tracker. Real security is hard. If you don't solve user needs, users solve them themselves with solutions that are even worse (ie native code). Managing the browser extension system is a thankless painful job of delicately balancing incentives. Extensions need to work well enough that developers don't reach for more powerful and dangerous tools, but have enough controls that the majority of malware can be controlled. It sucks. Trust me you really don't want this job. Please spare a bit of empathy for the "chain of humans" that have had it. [1] https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/38394.pdf https://static.googleusercontent.com/media/research.google.c...

1vuio0pswjnm7 4y ago
"I also encourage readers to remember that generally speaking, you all _want_ extensions." Exception here. Never asked for them. Never wanted them. Do not and cannot use them.^1 Seems moot anyway as I doubt anyone ever asked for Chrome itself. When an extension collects data under the radar it's "malware" but when Google does this, it isn't malware. Funny. There's really no greater "danger" to www users than Google because it's nearly impossible to stop Google from doing what it wants. The company is embedded in every aspect of using the web. Malware authors might be a threat but they hold no such omnipotent control. Google is the largest threat. 1. Occasional Chrome user via Guest mode that does not permit Extensions.
- vore 4y ago
  If you’re not using Chrome, then obviously you’re not the target demographic for Chrome extensions.
- KyeRussell 4y ago
  How do you feel that this contributes to the discussion?
Eisenstein 4y ago
> (a) we obviously considered this in the first version of extensions and did not allow permissions "below" the fold Irrelevant. > (b) Chrome's extension model dramatically improved on the previous state of the art which was Firefox's "every extension can do everything, extensions can't be uninstalled completely, and there's no review" Irrelevant. > (c) the install dialog is just one part in a bigger system which includes the review process. "Our MFA system is broken and will accept wrong input, but that doesn't matter because you without the correct password you won't get in." Would that fly? > I also encourage readers to remember that generally speaking, you all _want_ extensions. When Chrome didn't have them, they were the top feature request in the bug tracker. What are you trying to say? That because users want it then overlooking security issues is excusable? > If you don't solve user needs, users solve them themselves with solutions that are even worse (ie native code). That falls under the realm of 'their fault.' This problem does not. > Please spare a bit of empathy for the "chain of humans" that have had it. OK, I feel bad for the poor Google worker with the thankless job and a six figure salary. Now fix it.
- deleted 4y ago
  [deleted]
- MichaelZuo 4y ago
  This is a needlessly combative reply. Your interlocutor is not sitting at the interrogation table.
  - Eisenstein 4y ago
    I admit it is a bit combative, but his response took absolutely zero responsibility and expressed zero concern for what is in my mind a huge and inexcusable security oversight. Countering an acting apologist for a de facto monopolist corporation is also needed, or else we end up with complacency and rot.
    - dcow 4y ago
      Because there’s nothing to be concerned about. Author irresponsibly incited a bunch of FUD. End of story.
DigiDigiorno 4y ago
OP could have worded the criticism as an organizational attack and not aimed at the individuals that make up the organization... But anyhow, you work on the system and can't point out if this is an issue or not in the end-to-end sense? Like, why say OP is "missing the point" if you are not sure if they are missing the point? TBF you do say "I'm not even certain that an extension that requests more than 5 permissions would be approved in the first place." Which if true, would make this pretty low priority. (On the Empathy note, I just want to add: stating "Trust me you really don't want this job." In this context to random members of a forum is a bit of an empathy-lacking thing to do)
- aboodman 4y ago
  I have not worked on the system for something like 8 years, so I cannot say what the current situation is.
xlii 4y ago
I’m really curious what were the arguments against screaming “…and 58 other permission - see full list here” seems like an easy fix. As for the review process, I don’t think it’s good enough. I don’t use Chrome as a daily driver but I’m often seeing out-of-store extensions. Is there external process that would capture and mark/flag such 3rd party extensions?
- aboodman 4y ago
  Chrome makes it pretty difficult to sideload extensions, so I'm not sure what you're seeing.
  - xlii 4y ago
    Well I’m usually browsing for development tools & such and some of them are advertised as an out of store downloads (which would be preferable as I prefer Chromium). You did prompt be to check how hard it is though, so allow me to get back to you in a few ;) Edit: I didn’t go through manual process but based on this (rather recent) Adblock guide [1] it’s not very hard. Of course one could argue that “developer mode” is deterrent enough but - as for contrast - in order to get state mandated esignature to work I had to install some sketchy 3rd party system extensions on MacOS. On Windows it almost felt like malware (as some of the security settings had to be disabled in order for Java installers to run). My point is - sure Chrome might have secure golden path but people are lured into skipping a lot for freebies/weird requirements and thus permission dialogue should be more informative. [1]: https://helpcenter.getadblock.com/hc/en-us/articles/9738538846867-How-to-install-AdBlock-in-Chrome-when-you-can-t-do-it-the-normal-way https://helpcenter.getadblock.com/hc/en-us/articles/97385388...
    - aboodman 4y ago
      I guess it depends on what you mean by "difficult". Chrome is unfortunately limited here by the security of the OS. No popular desktop OSes have application isolation: all apps have the same permissions. Any app can write to any other apps' storage. This means that if Chrome makes sideloading too difficult, developers will just tell users to run their native code which will hack into Chrome, making even understanding what extensions users have or uninstalling them impossible. Sideloading on desktop OSes has to be hard enough to discourage most users but easy enough that developers like adblock don't start looking for an even bigger hammer. This is what I meant by delicate balance of incentives. More info here: https://news.ycombinator.com/item?id=4954915 https://news.ycombinator.com/item?id=4954915
pcthrowaway 4y ago
Perhaps I'm missing something, or things have changed in the last couple of years, but when I last took a look there were a few main issues with the extension security model that would have been dead-simple to implement. My understanding at the time (I realize I could be mistaken about any of these): * Users have no idea what code they're installing. Extensions aren't required to be open source, where the community can audit them for malicious behaviour. Even if an extension claimed to be open source, there's no verification system to ensure the code actually being executed is the code displayed on their github. * Automatic updates. Maybe this isn't the case now, but at one point I remember extensions were updating themselves automatically. Users of popular extensions are frequently contacted to add an "analytics" dependency from some shady company, in return for a nice payout. Users don't have the ability to opt out of these kinds of updates when some of their extension devs inevitably cave into the pressure. In my mind, these kinds of updates should only be shipped with user's full consent and understanding that they are being asked to install updates which have no practical utility to them * Code obfuscation. I don't see why every extension shouldn't be shipped fully unobfuscated, at least as an option. Perhaps minified bundles could also be shipped as a way of supporting users on low-spec devices which really need those extensions, but then again, if disk space is so short for those users maybe they shouldn't be installing extensions in the first place * Better observability of interactions between user-requested websites and extension background pages. If I look in my network panel I want to see communication with installed extensions happening
- aboodman 4y ago
  > Users have no idea what code they're installing. Extensions aren't required to be open source, where the community can audit them for malicious behaviour. Even if an extension claimed to be open source, there's no verification system to ensure the code actually being executed is the code displayed on their github. I love this idea fwiw. Browser vendors should totally do this. Requiring OSS seems like a fair tradeoff for the power that extensions wield. > Automatic updates. In my day, extensions could auto-update but not change permissions. Also all updates had to be reviewed. The bribery issue is serious and sad, but killing updates seems like the wrong tradeoff. Ability to fix and deploy bugs is important for extensions just like any other software. > Code obfuscation. Obfuscated code is already disallowed: https://blog.chromium.org/2018/10/trustworthy-chrome-extensions-by-default.html https://blog.chromium.org/2018/10/trustworthy-chrome-extensi... > Better observability of interactions It is already possible to know which extensions are active on a page: https://i.imgur.com/73lmozH.png https://i.imgur.com/73lmozH.png. This is a better level of observability than what you describe because once an extension has access to a page, there is no way to prevent it from exfiltrating data from that page. The communication with background page is not relevant. There are myriad ways to exfiltrate just given access to normal DOM, unfortunately.
thrown1212 4y ago
Your response explains SO much about why this is a dumpster fire. Rather than a professional "these are some valid concerns, we may have made some serious mistakes and this deserves a credible response", here's how your defensive commentary was received by at least one person: "Public criticism (however valid) of something I worked on hurts my feelings. Just so you know, we already thought through ALL these possible "problems" (and more) and we chose the "one true way". So your criticisms are just, waves hands, whatever. Plus, these "issues" could never happen anyway (just try it lol!), so your criticisms are basically imaginary. Also and anyway this is YOUR fault (not mine, no!) because YOU wanted extensions. Also, also: the other guys were worse. Your fault, shame on you, other guys worse, I'm a good person. And finally, this is hard work, no-one ever said thank you to me."

1vuio0pswjnm7 4y ago

"I also encourage readers to remember that generally speaking, you all _want_ extensions." Exception here. Never asked for them. Never wanted them. Do not and cannot use them.^1 Seems moot anyway as I doubt anyone ever asked for Chrome itself. When an extension collects data under the radar it's "malware" but when Google does this, it isn't malware. Funny. There's really no greater "danger" to www users than Google because it's nearly impossible to stop Google from doing what it wants. The company is embedded in every aspect of using the web. Malware authors might be a threat but they hold no such omnipotent control. Google is the largest threat. 1. Occasional Chrome user via Guest mode that does not permit Extensions.

vore 4y ago
If you’re not using Chrome, then obviously you’re not the target demographic for Chrome extensions.
KyeRussell 4y ago
How do you feel that this contributes to the discussion?

Eisenstein 4y ago

> (a) we obviously considered this in the first version of extensions and did not allow permissions "below" the fold Irrelevant. > (b) Chrome's extension model dramatically improved on the previous state of the art which was Firefox's "every extension can do everything, extensions can't be uninstalled completely, and there's no review" Irrelevant. > (c) the install dialog is just one part in a bigger system which includes the review process. "Our MFA system is broken and will accept wrong input, but that doesn't matter because you without the correct password you won't get in." Would that fly? > I also encourage readers to remember that generally speaking, you all _want_ extensions. When Chrome didn't have them, they were the top feature request in the bug tracker. What are you trying to say? That because users want it then overlooking security issues is excusable? > If you don't solve user needs, users solve them themselves with solutions that are even worse (ie native code). That falls under the realm of 'their fault.' This problem does not. > Please spare a bit of empathy for the "chain of humans" that have had it. OK, I feel bad for the poor Google worker with the thankless job and a six figure salary. Now fix it.

deleted 4y ago
[deleted]
MichaelZuo 4y ago
This is a needlessly combative reply. Your interlocutor is not sitting at the interrogation table.
- Eisenstein 4y ago
  I admit it is a bit combative, but his response took absolutely zero responsibility and expressed zero concern for what is in my mind a huge and inexcusable security oversight. Countering an acting apologist for a de facto monopolist corporation is also needed, or else we end up with complacency and rot.
  - dcow 4y ago
    Because there’s nothing to be concerned about. Author irresponsibly incited a bunch of FUD. End of story.

DigiDigiorno 4y ago

OP could have worded the criticism as an organizational attack and not aimed at the individuals that make up the organization... But anyhow, you work on the system and can't point out if this is an issue or not in the end-to-end sense? Like, why say OP is "missing the point" if you are not sure if they are missing the point? TBF you do say "I'm not even certain that an extension that requests more than 5 permissions would be approved in the first place." Which if true, would make this pretty low priority. (On the Empathy note, I just want to add: stating "Trust me you really don't want this job." In this context to random members of a forum is a bit of an empathy-lacking thing to do)

aboodman 4y ago
I have not worked on the system for something like 8 years, so I cannot say what the current situation is.

xlii 4y ago

I’m really curious what were the arguments against screaming “…and 58 other permission - see full list here” seems like an easy fix. As for the review process, I don’t think it’s good enough. I don’t use Chrome as a daily driver but I’m often seeing out-of-store extensions. Is there external process that would capture and mark/flag such 3rd party extensions?

aboodman 4y ago
Chrome makes it pretty difficult to sideload extensions, so I'm not sure what you're seeing.
- xlii 4y ago
  Well I’m usually browsing for development tools & such and some of them are advertised as an out of store downloads (which would be preferable as I prefer Chromium). You did prompt be to check how hard it is though, so allow me to get back to you in a few ;) Edit: I didn’t go through manual process but based on this (rather recent) Adblock guide [1] it’s not very hard. Of course one could argue that “developer mode” is deterrent enough but - as for contrast - in order to get state mandated esignature to work I had to install some sketchy 3rd party system extensions on MacOS. On Windows it almost felt like malware (as some of the security settings had to be disabled in order for Java installers to run). My point is - sure Chrome might have secure golden path but people are lured into skipping a lot for freebies/weird requirements and thus permission dialogue should be more informative. [1]: https://helpcenter.getadblock.com/hc/en-us/articles/9738538846867-How-to-install-AdBlock-in-Chrome-when-you-can-t-do-it-the-normal-way https://helpcenter.getadblock.com/hc/en-us/articles/97385388...
  - aboodman 4y ago
    I guess it depends on what you mean by "difficult". Chrome is unfortunately limited here by the security of the OS. No popular desktop OSes have application isolation: all apps have the same permissions. Any app can write to any other apps' storage. This means that if Chrome makes sideloading too difficult, developers will just tell users to run their native code which will hack into Chrome, making even understanding what extensions users have or uninstalling them impossible. Sideloading on desktop OSes has to be hard enough to discourage most users but easy enough that developers like adblock don't start looking for an even bigger hammer. This is what I meant by delicate balance of incentives. More info here: https://news.ycombinator.com/item?id=4954915 https://news.ycombinator.com/item?id=4954915

pcthrowaway 4y ago

Perhaps I'm missing something, or things have changed in the last couple of years, but when I last took a look there were a few main issues with the extension security model that would have been dead-simple to implement. My understanding at the time (I realize I could be mistaken about any of these): * Users have no idea what code they're installing. Extensions aren't required to be open source, where the community can audit them for malicious behaviour. Even if an extension claimed to be open source, there's no verification system to ensure the code actually being executed is the code displayed on their github. * Automatic updates. Maybe this isn't the case now, but at one point I remember extensions were updating themselves automatically. Users of popular extensions are frequently contacted to add an "analytics" dependency from some shady company, in return for a nice payout. Users don't have the ability to opt out of these kinds of updates when some of their extension devs inevitably cave into the pressure. In my mind, these kinds of updates should only be shipped with user's full consent and understanding that they are being asked to install updates which have no practical utility to them * Code obfuscation. I don't see why every extension shouldn't be shipped fully unobfuscated, at least as an option. Perhaps minified bundles could also be shipped as a way of supporting users on low-spec devices which really need those extensions, but then again, if disk space is so short for those users maybe they shouldn't be installing extensions in the first place * Better observability of interactions between user-requested websites and extension background pages. If I look in my network panel I want to see communication with installed extensions happening

aboodman 4y ago
> Users have no idea what code they're installing. Extensions aren't required to be open source, where the community can audit them for malicious behaviour. Even if an extension claimed to be open source, there's no verification system to ensure the code actually being executed is the code displayed on their github. I love this idea fwiw. Browser vendors should totally do this. Requiring OSS seems like a fair tradeoff for the power that extensions wield. > Automatic updates. In my day, extensions could auto-update but not change permissions. Also all updates had to be reviewed. The bribery issue is serious and sad, but killing updates seems like the wrong tradeoff. Ability to fix and deploy bugs is important for extensions just like any other software. > Code obfuscation. Obfuscated code is already disallowed: https://blog.chromium.org/2018/10/trustworthy-chrome-extensions-by-default.html https://blog.chromium.org/2018/10/trustworthy-chrome-extensi... > Better observability of interactions It is already possible to know which extensions are active on a page: https://i.imgur.com/73lmozH.png https://i.imgur.com/73lmozH.png. This is a better level of observability than what you describe because once an extension has access to a page, there is no way to prevent it from exfiltrating data from that page. The communication with background page is not relevant. There are myriad ways to exfiltrate just given access to normal DOM, unfortunately.

thrown1212 4y ago

Your response explains SO much about why this is a dumpster fire. Rather than a professional "these are some valid concerns, we may have made some serious mistakes and this deserves a credible response", here's how your defensive commentary was received by at least one person: "Public criticism (however valid) of something I worked on hurts my feelings. Just so you know, we already thought through ALL these possible "problems" (and more) and we chose the "one true way". So your criticisms are just, waves hands, whatever. Plus, these "issues" could never happen anyway (just try it lol!), so your criticisms are basically imaginary. Also and anyway this is YOUR fault (not mine, no!) because YOU wanted extensions. Also, also: the other guys were worse. Your fault, shame on you, other guys worse, I'm a good person. And finally, this is hard work, no-one ever said thank you to me."