4 ms·

I think the only way is to treat access like we do web apps, then enable/disable features accordingly. That's kinda lame because now you have to have a backend

by 6DM 3y ago

I think the only way is to treat access like we do web apps, then enable/disable features accordingly. That's kinda lame because now you have to have a backend setup, just so you can charge for some features.

Chabsff 3y ago
The issue with that is that "Gets to read and/or write the DOM" happens to be the only permissions a nefarious extension needs while also being those that a vast number of useful extensions require.
- 6DM 3y ago
  I think you're thinking from the browser level. I was thinking from the standpoint of what I could do as an extension developer. If we approach it from that angle, then your extension can only restrict access to it's features via a round trip to your own servers to validate access and/or show a checkout view to purchase access.
- jcparkyn 3y ago
  That's why it'd be nice to have a general "access the internet" permission, since DOM reads are usually harmless if they can't get any data back.
  - danShumway 3y ago
    I suspect it would be a very hard permission to implement. There are a lot of ways to exfiltrate data from a website if you have DOM access. But yeah, agreed. Some of the difficulty around securing extensions boils down to the fact that Javascript permissions could be better. Websites do a decent job of sandboxing the website, but sandboxing within websites (without relying on iframes) is much more difficult. Per-site permissions and click-to-activate are also really useful features here. It's easy to forget how recent they are. But it would be good to go further if possible and having barriers in front of exfiltration would be a big part of that -- there are many browser permissions that would become less dangerous if you could know for sure that the data they generate can't get off your device. I just think it would be really difficult to try and build browser permissions around that in a user-legible way.

by 6DM 3y ago

Chabsff 3y ago

The issue with that is that "Gets to read and/or write the DOM" happens to be the only permissions a nefarious extension needs while also being those that a vast number of useful extensions require.

6DM 3y ago
I think you're thinking from the browser level. I was thinking from the standpoint of what I could do as an extension developer. If we approach it from that angle, then your extension can only restrict access to it's features via a round trip to your own servers to validate access and/or show a checkout view to purchase access.
jcparkyn 3y ago
That's why it'd be nice to have a general "access the internet" permission, since DOM reads are usually harmless if they can't get any data back.
- danShumway 3y ago
  I suspect it would be a very hard permission to implement. There are a lot of ways to exfiltrate data from a website if you have DOM access. But yeah, agreed. Some of the difficulty around securing extensions boils down to the fact that Javascript permissions could be better. Websites do a decent job of sandboxing the website, but sandboxing within websites (without relying on iframes) is much more difficult. Per-site permissions and click-to-activate are also really useful features here. It's easy to forget how recent they are. But it would be good to go further if possible and having barriers in front of exfiltration would be a big part of that -- there are many browser permissions that would become less dangerous if you could know for sure that the data they generate can't get off your device. I just think it would be really difficult to try and build browser permissions around that in a user-legible way.