6 ms·

I recently installed Chrome and, all of a sudden, got really spooked that the AdBlock extension can see and edit everything I can see. Obvious as it is, for som

I recently installed Chrome and, all of a sudden, got really spooked that the AdBlock extension can see and edit everything I can see. Obvious as it is, for some reason this never occurred to me before! I'm now routing my traffic through a PiHole via a VPN to cut down the worst ads and will probably never install another extension.

xnx 3y ago
This is what Manifest v3 is trying to protect against.
- josephcsible 3y ago
  That's what Google claims Manifest v3 is trying to protect against, but it's actually trying to protect against ad blockers being effective.
  - NoZebra120vClip 3y ago
    Tell me, is it a sound security architecture that allows extensions like that to read and write to every web page I will ever see? Or perhaps that is a desperate hack to get'er done and there may be a safer way to implement that kind of thing? Sure, Google wants to architect things so that ad blockers as we know them now aren't really feasible. But I think that we can conceded that Google has a good point in saying these world-read-write-anything extensions are not good for us.
    - plorkyeran 3y ago
      Manifest v3 does not remove the ability for an extension to spy on all of your network traffic; only the part where it can block the network requests it's observing.
    - autoexec 3y ago
      Besides the fact that Google doesn't stop extensions from seeing everything, there's nothing wrong with allowing extensions to do that. You should have the ability to selectively block/allow/modify content however you want before it's displayed in your browser. The biggest issues with extensions are things like silent updates (perhaps after the developer sold their extension to a bad actor) and extensions that depend on online resources. An extension that you've verified does what it claims to and nothing else, can read/write everything, doesn't update automatically, and never sends data to random servers isn't a problem at all.
      - NoZebra120vClip 3y ago
        > You should have the ability to selectively block/allow/modify content however you want before it's displayed in your browser. Conceivably, this could mostly be accomplished without the extension being able to see all content. Such as manipulation by regexp.
        autoexec 3y ago
        I can't have an extension remove every line that contains the string "google" if it can't see every line. It'd still have to be able to access all the content to be able to parse through it for a match.
        NoZebra120vClip 3y ago
        Sure you could. The browser could have an API that says "give me a list of regexps and substitutions" and then the extension supplies that list, and the browser itself does the parsing and processing. This is flexible because the extension can specify the modifications. It's like a pipeline in Bash. You could work with an end-user to build some patterns to match, then pass them to "grep" or "perl" for processing, and neither the user nor shell need to be privy to a file's contents.
- kccqzy 3y ago
  And also Apple's 2015-era content blocker extensions.
- jeffbee 3y ago
  This is why I am convinced that the entire online privacy discourse is a psy-op by global intelligence agencies.
- GeekyBear 3y ago
  Of course, Google doesn't want to do what Mozilla and Apple do and pay human beings to vet extension code looking for malware. They'll just claim that making ad blockers less effective is the only possible action they can take.
  - xnx 3y ago
    If an extension can load and interpret new code on the fly, that code cannot be vetted by human beings.
    - franga2000 3y ago
      Just don't allow extensions that do that. An automated search for eval(), remote imports and script tags would probably catch most of these and if someone manages to hide it from the auditors, since source code needs to be available, a security researcher would find and report it eventually.
    - GeekyBear 3y ago
      This is one of the major differences between Apple's App Store rules and Google's Play Store rules. Apple has traditionally not allowed third party apps to download and execute code. Apple doesn't trust you to write your own JavaScript engine, for instance. You have to use Apple's. On the Play Store side, the ability to download executable code has proven to be an issue, as you mention. > Known as Joker, this family of malicious apps has been attacking Android users since late 2016 and more recently has become one of the most common Android threats. One of the keys to Joker’s success is its roundabout way of attack. The apps are knockoffs of legitimate apps and, when downloaded from Play or a different market, contain no malicious code other than a “dropper.” After a delay of hours or even days, the dropper, which is heavily obfuscated and contains just a few lines of code, downloads a malicious component and drops it into the app. https://arstechnica.com/information-technology/2020/09/joker-the-malware-that-signs-you-up-for-pricey-services-floods-android-markets/ https://arstechnica.com/information-technology/2020/09/joker...
  - tredre3 3y ago
    Mozilla claims that they review all the code, but in practice they don't. They have an automated tool that looks for certain things. If nothing is found, this is the end of the code review. If things are flagged, then a human will look at the code a little. If you have an established extension and push an update, odds are there will be no human review of the code changes. That is how most malicious extensions happen. Sure, Mozilla historically had less malicious extensions than Chrome. But that's for the same reason that Linux has less viruses than Windows: hackers will target the 90% of users and not waste time on the rest. I say all this as a staunch Firefox user and maintainer of a handful of extensions.
syntaxing 3y ago
Ublock origin is the way to go for Adblock extensions. Also, NextDNS is way more flexible than pihole since you don’t need to host anything. AdGuard DNS provides the same service. Both are priced at $20/year and its money well spent IMO. NextDNS provides 300K queries per montb for free. With cache, that should last one person for one month.
- hedora 3y ago
  Of course, NextDNS and AdGuard are indistinguishable from a watering hole attack. (I've never heard of them; this is a fundamental problem with using centralized "privacy preserving" services.) https://en.wikipedia.org/wiki/Watering_hole_attack https://en.wikipedia.org/wiki/Watering_hole_attack I think ublock origin is a bit better, in that it is open source. Does it support reproducible builds though?
  - akyuu 3y ago
    NextDNS and AdGuard DNS are just DNS providers that return filtered results for ad-related DNS queries. Their filter lists are public: https://github.com/orgs/nextdns/repositories?type=all https://github.com/orgs/nextdns/repositories?type=all https://github.com/AdguardTeam/AdGuardSDNSFilter https://github.com/AdguardTeam/AdGuardSDNSFilter If you don't trust their DNS servers for whatever reason, you can simply add these entries to your hosts file to replicate their functionality locally.
  - ameshkov 3y ago
    Sorry for jumping in but since AG is mentioned. If you want to have all the data under you control, there's this: https://github.com/AdguardTeam/AdGuardHome https://github.com/AdguardTeam/AdGuardHome Regarding open source, AdGuard DNS actually is: https://github.com/AdguardTeam/AdGuardDNS https://github.com/AdguardTeam/AdGuardDNS In the case of AdGuard DNS being open source does not change the fact that it is a centralized service and using such a service is a matter of trust.
    - syntaxing 3y ago
      AdGuard home or pihole does not prevent “watering hole attacks” (honestly feels like paranoia more than safety but whatever). At the end of the day, you need a DNS for non filtered sites which AdGuard home and pihole uses cloudflare by default.
andai 3y ago
Even worse, even if you know an extension is OK (you can audit the code: iirc the rules say the source has to be readable), it can auto-update after being acquired by a malicious actor (e.g. The Great Suspender). For TGS I use the last known good version, as an "unpacked" extension. I think this approach of taking ownership of the code (i.e. running the extension "manually") is the best option, aside from two critical factors: skill and effort. (Not very much of either is needed, if you know basic JavaScript, but it's a significant "mental hurdle".)
akyuu 3y ago
You can also use a declarative adblocker like uBlock Origin Lite [1], which only provides the browser with a list of elements to filter, but doesn't have any permissions to read content or perform requests. Or simply use your hosts file to apply OS-wide filtering with no browser add-ons needed [2]. Be aware that if you use these "passive" blocking methods, there are some sites like YouTube where you will see ads, because in these cases it's necessary to actually manipulate page content to hide them. What you can do is use a traditional adblocker but enable it only for these few sites where the declarative approach is not enough, take a look at [3] for more details. [1] https://github.com/uBlockOrigin/uBOL-home https://github.com/uBlockOrigin/uBOL-home [2] https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts [3] https://seirdy.one/posts/2022/06/04/layered-content-blocking/ https://seirdy.one/posts/2022/06/04/layered-content-blocking...

xnx 3y ago

This is what Manifest v3 is trying to protect against.

josephcsible 3y ago
That's what Google claims Manifest v3 is trying to protect against, but it's actually trying to protect against ad blockers being effective.
- NoZebra120vClip 3y ago
  Tell me, is it a sound security architecture that allows extensions like that to read and write to every web page I will ever see? Or perhaps that is a desperate hack to get'er done and there may be a safer way to implement that kind of thing? Sure, Google wants to architect things so that ad blockers as we know them now aren't really feasible. But I think that we can conceded that Google has a good point in saying these world-read-write-anything extensions are not good for us.
  - plorkyeran 3y ago
    Manifest v3 does not remove the ability for an extension to spy on all of your network traffic; only the part where it can block the network requests it's observing.
  - autoexec 3y ago
    Besides the fact that Google doesn't stop extensions from seeing everything, there's nothing wrong with allowing extensions to do that. You should have the ability to selectively block/allow/modify content however you want before it's displayed in your browser. The biggest issues with extensions are things like silent updates (perhaps after the developer sold their extension to a bad actor) and extensions that depend on online resources. An extension that you've verified does what it claims to and nothing else, can read/write everything, doesn't update automatically, and never sends data to random servers isn't a problem at all.
    - NoZebra120vClip 3y ago
      > You should have the ability to selectively block/allow/modify content however you want before it's displayed in your browser. Conceivably, this could mostly be accomplished without the extension being able to see all content. Such as manipulation by regexp.
      - autoexec 3y ago
        I can't have an extension remove every line that contains the string "google" if it can't see every line. It'd still have to be able to access all the content to be able to parse through it for a match.
        NoZebra120vClip 3y ago
        Sure you could. The browser could have an API that says "give me a list of regexps and substitutions" and then the extension supplies that list, and the browser itself does the parsing and processing. This is flexible because the extension can specify the modifications. It's like a pipeline in Bash. You could work with an end-user to build some patterns to match, then pass them to "grep" or "perl" for processing, and neither the user nor shell need to be privy to a file's contents.
kccqzy 3y ago
And also Apple's 2015-era content blocker extensions.
jeffbee 3y ago
This is why I am convinced that the entire online privacy discourse is a psy-op by global intelligence agencies.
GeekyBear 3y ago
Of course, Google doesn't want to do what Mozilla and Apple do and pay human beings to vet extension code looking for malware. They'll just claim that making ad blockers less effective is the only possible action they can take.
- xnx 3y ago
  If an extension can load and interpret new code on the fly, that code cannot be vetted by human beings.
  - franga2000 3y ago
    Just don't allow extensions that do that. An automated search for eval(), remote imports and script tags would probably catch most of these and if someone manages to hide it from the auditors, since source code needs to be available, a security researcher would find and report it eventually.
  - GeekyBear 3y ago
    This is one of the major differences between Apple's App Store rules and Google's Play Store rules. Apple has traditionally not allowed third party apps to download and execute code. Apple doesn't trust you to write your own JavaScript engine, for instance. You have to use Apple's. On the Play Store side, the ability to download executable code has proven to be an issue, as you mention. > Known as Joker, this family of malicious apps has been attacking Android users since late 2016 and more recently has become one of the most common Android threats. One of the keys to Joker’s success is its roundabout way of attack. The apps are knockoffs of legitimate apps and, when downloaded from Play or a different market, contain no malicious code other than a “dropper.” After a delay of hours or even days, the dropper, which is heavily obfuscated and contains just a few lines of code, downloads a malicious component and drops it into the app. https://arstechnica.com/information-technology/2020/09/joker-the-malware-that-signs-you-up-for-pricey-services-floods-android-markets/ https://arstechnica.com/information-technology/2020/09/joker...
- tredre3 3y ago
  Mozilla claims that they review all the code, but in practice they don't. They have an automated tool that looks for certain things. If nothing is found, this is the end of the code review. If things are flagged, then a human will look at the code a little. If you have an established extension and push an update, odds are there will be no human review of the code changes. That is how most malicious extensions happen. Sure, Mozilla historically had less malicious extensions than Chrome. But that's for the same reason that Linux has less viruses than Windows: hackers will target the 90% of users and not waste time on the rest. I say all this as a staunch Firefox user and maintainer of a handful of extensions.

syntaxing 3y ago

Ublock origin is the way to go for Adblock extensions. Also, NextDNS is way more flexible than pihole since you don’t need to host anything. AdGuard DNS provides the same service. Both are priced at $20/year and its money well spent IMO. NextDNS provides 300K queries per montb for free. With cache, that should last one person for one month.

hedora 3y ago
Of course, NextDNS and AdGuard are indistinguishable from a watering hole attack. (I've never heard of them; this is a fundamental problem with using centralized "privacy preserving" services.) https://en.wikipedia.org/wiki/Watering_hole_attack https://en.wikipedia.org/wiki/Watering_hole_attack I think ublock origin is a bit better, in that it is open source. Does it support reproducible builds though?
- akyuu 3y ago
  NextDNS and AdGuard DNS are just DNS providers that return filtered results for ad-related DNS queries. Their filter lists are public: https://github.com/orgs/nextdns/repositories?type=all https://github.com/orgs/nextdns/repositories?type=all https://github.com/AdguardTeam/AdGuardSDNSFilter https://github.com/AdguardTeam/AdGuardSDNSFilter If you don't trust their DNS servers for whatever reason, you can simply add these entries to your hosts file to replicate their functionality locally.
- ameshkov 3y ago
  Sorry for jumping in but since AG is mentioned. If you want to have all the data under you control, there's this: https://github.com/AdguardTeam/AdGuardHome https://github.com/AdguardTeam/AdGuardHome Regarding open source, AdGuard DNS actually is: https://github.com/AdguardTeam/AdGuardDNS https://github.com/AdguardTeam/AdGuardDNS In the case of AdGuard DNS being open source does not change the fact that it is a centralized service and using such a service is a matter of trust.
  - syntaxing 3y ago
    AdGuard home or pihole does not prevent “watering hole attacks” (honestly feels like paranoia more than safety but whatever). At the end of the day, you need a DNS for non filtered sites which AdGuard home and pihole uses cloudflare by default.

andai 3y ago

Even worse, even if you know an extension is OK (you can audit the code: iirc the rules say the source has to be readable), it can auto-update after being acquired by a malicious actor (e.g. The Great Suspender). For TGS I use the last known good version, as an "unpacked" extension. I think this approach of taking ownership of the code (i.e. running the extension "manually") is the best option, aside from two critical factors: skill and effort. (Not very much of either is needed, if you know basic JavaScript, but it's a significant "mental hurdle".)

akyuu 3y ago

You can also use a declarative adblocker like uBlock Origin Lite [1], which only provides the browser with a list of elements to filter, but doesn't have any permissions to read content or perform requests. Or simply use your hosts file to apply OS-wide filtering with no browser add-ons needed [2]. Be aware that if you use these "passive" blocking methods, there are some sites like YouTube where you will see ads, because in these cases it's necessary to actually manipulate page content to hide them. What you can do is use a traditional adblocker but enable it only for these few sites where the declarative approach is not enough, take a look at [3] for more details. [1] https://github.com/uBlockOrigin/uBOL-home https://github.com/uBlockOrigin/uBOL-home [2] https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts [3] https://seirdy.one/posts/2022/06/04/layered-content-blocking/ https://seirdy.one/posts/2022/06/04/layered-content-blocking...