3 ms·

It's shockingly easy to baffle automated security with a bit of obfuscation. I saw a phishing page a few weeks ago which evaded detection by base64encode(htmlen

It's shockingly easy to baffle automated security with a bit of obfuscation. I saw a phishing page a few weeks ago which evaded detection by base64encode(htmlencode(maliciouscontent)) and having the browser decode it on load with JavaScript. The security software identified it immediately out of my Notepad++ draft decoding it... Unfortunately Google believes their scale means having a human involved in anything is unacceptable, which is why the Chrome Web Store will eternally be the leading source of malware for computers.

smallerfish 3y ago
> Unfortunately Google believes their scale means having a human involved in anything is unacceptable Yeah, I mean they've had a solid 14 years to give it a fair shot, and have evidently failed. Browser authors are unhappy, moderately technical users are suspicious, and unaware users can get taken advantage of. Even a moderate pay-per-review fee would be a cut above the current situatioin.
- Avamander 3y ago
  Which would kill small indie extensions that are harmless but keeps the profitable affiliate malware ones. The boring truth is that automation or not, it's difficult. Manifest v3 in some aspects improves the situation (but it's not that great). It would certainly be more trustworthy if they'd add identity verification. eIDAS makes it low-cost to implement in the EU. At least it'd require a new malicious company or person willing to taint their name to continue operations.
  - smallerfish 3y ago
    > Which would kill small indie extensions that are harmless but keeps the profitable affiliate malware ones. Any indie extension that has an audience could get a donor base, but yeah - smaller first-time extensions that only underwent automated review could either fly unlisted / or with a non-"blue-star", or even with an "unverified" banner. The small fee could make looping humans into the loop relatively revenue neutral, and increase the chance of detection of stuff like this. The more misses by the automated system, the more the platform suffers, and the less chance any of us have of getting users.
Maliome 3y ago
The 'phishing page' you mentioned is not a chrome extension I guess? It probably didn't go through the same detection of the Chromestore? Maybe the Chromestore is better than that? I'm curious if any security software could detect malicious chrome extensions on the Chromestore. That'd be helpful.

smallerfish 3y ago

> Unfortunately Google believes their scale means having a human involved in anything is unacceptable Yeah, I mean they've had a solid 14 years to give it a fair shot, and have evidently failed. Browser authors are unhappy, moderately technical users are suspicious, and unaware users can get taken advantage of. Even a moderate pay-per-review fee would be a cut above the current situatioin.

Avamander 3y ago
Which would kill small indie extensions that are harmless but keeps the profitable affiliate malware ones. The boring truth is that automation or not, it's difficult. Manifest v3 in some aspects improves the situation (but it's not that great). It would certainly be more trustworthy if they'd add identity verification. eIDAS makes it low-cost to implement in the EU. At least it'd require a new malicious company or person willing to taint their name to continue operations.
- smallerfish 3y ago
  > Which would kill small indie extensions that are harmless but keeps the profitable affiliate malware ones. Any indie extension that has an audience could get a donor base, but yeah - smaller first-time extensions that only underwent automated review could either fly unlisted / or with a non-"blue-star", or even with an "unverified" banner. The small fee could make looping humans into the loop relatively revenue neutral, and increase the chance of detection of stuff like this. The more misses by the automated system, the more the platform suffers, and the less chance any of us have of getting users.

Maliome 3y ago

The 'phishing page' you mentioned is not a chrome extension I guess? It probably didn't go through the same detection of the Chromestore? Maybe the Chromestore is better than that? I'm curious if any security software could detect malicious chrome extensions on the Chromestore. That'd be helpful.