6 ms·

Issue with this “benign” extension is that it will be using “host_permissions”: “<all_urls>” In its manifest means it can basically do anything on any webpage

Issue with this “benign” extension is that it will be using “host_permissions”: “<all_urls>” In its manifest means it can basically do anything on any webpage you visit, scrape data etc. As an extension developer, no thanks. “Fun” pointless extensions like this that have no real utility, but funnily enough require broad permissions, are dangerous

Refusing23 2y ago
just like 'Grammarly' which is basically just a keylogger
- MrSS 2y ago
  Grammarly has to be able to connect back to their online service while the button addon could be implemented in a way that it can read every website but not send antyhing anywere (in theory, the addon could of course simulate a form and send data out through that or somehow). But yeah i tested grammarly for 5 minutes and found it crazy. there has to be a better way getting both worlds :|
  - bargainbin 2y ago
    Local software of course! But good luck getting funding for a product that doesn’t phone home every 5 seconds and present an opportunity to plague the user with ads “that they want to see”
    - vstollen 2y ago
      I haven’t used it myself, but the LanguageTool browser extension might allow users to use a self-hosted or locally running instance.
  - dspillett 2y ago
    In DayJob we've had to block (actually block, because people didn't listen to being asked not to use it and similar tools) Grammarly because it sending text that could potentially include client data off to their servers for checking would have given us a nasty fail should a client request or conduct an audit. As an alternative there is LanguageTool which you can install locally. We have it running on a small VM that people can configure their installs to talk to, and block the public service end-point (as sending to that would be a big no-no for us for the same reason as Grammarly). It doesn't have all the features of Grammarly so isn't a complete drop-in replacement, but the self-hosted version works as well as the free features of Grammarly.
    - Suppafly 2y ago
      >As an alternative there is LanguageTool which you can install locally. We have it running on a small VM that people can configure their installs to talk to, and block the public service end-point I'm surprised that Grammarly hasn't come up with a local service like that, I bet they have a ton of enterprise users that would appreciate it.
elaus 2y ago
> [...] but funnily enough require broad permissions I don't think there is a way to implement this without said permission. You can always check out the code from GitHub and install the extension locally to avoid any malicious changes in the future.
- skybrian 2y ago
  And that’s why it shouldn’t be in the Chrome app store at all. As a hobbyist developer, having that kind of access in other people’s browsers is not something I want, and I’m suspicious of developers who do seem to want it. It’s like “hey, I wrote a fun game that requires root access.” At least limit it to people who know what Github is.
  - firtoz 2y ago
    > hey, I wrote a fun game that requires root access So... Just like AAA game studios, eh?
    - MOARDONGZPLZ 2y ago
      No. They are large and presumably have some sort of trust, and can lose the trust of people if they do particularly shady things. This may not bear itself out in practice of course. But a game studio has something to lose, whereas hobbyist developer 73683 asking for root permissions for no real gain to you has nothing to lose from any number of things like scraping sites you visit or using your browser as a tor exit node or any number of things.
      - gryn 2y ago
        yeah, I'm sure Genshin impact's creators went out of business when their Kernel access anti-cheat was hacked by ransomware or more recently the hacks mid live broadcasted tournaments (don't remember which game, I think it was apex). I mean that's what kids, teenagers, and young adults and non technical people in general are known for: their prudence and good technical decision making. lets not talk about the other risk vector that Tencent, a chinese company is the one buying most of these game studios that have Kernel access (not exclusively).
d--b 2y ago
Yes they sell for quite a bit, and the buyer may not have the same idea of “fun” than the original guy.
vstollen 2y ago
Are (updates to) extensions from the Chrome and Firefox store usually vetted before publication? I‘ve heard that Firefox will only run signed extensions. Would you trust this process?
- zinekeller 2y ago
  > Are (updates to) extensions from the Chrome and Firefox store usually vetted before publication? Mozilla does not manually review most extensions (only extensions which Mozilla recommended are manually reviewed: https://support.mozilla.org/en-US/kb/add-on-badges https://support.mozilla.org/en-US/kb/add-on-badges). Chrome's policy is extensions are "reviewed periodically for compliance", but is unclear on how frequent is this periodic review (https://developer.chrome.com/docs/webstore/review-process https://developer.chrome.com/docs/webstore/review-process).
6510 2y ago
The permissions need to be more specific some how. I think the correct approach is to have the option to have a function isolated from the rest of the code. Then pay a trusted party to review the functionality of the function. In this case said function may only 1) access the html on the website, 2) find the button and 3) return only that what makes the button. Then the permission prompt, written by the trusted party, can be something accurate like: This extension wants to copy buttons from websites. I'm calling it DEWISOTT computing: does exactly what it says on the tin You can go wild update your extension 1000 times per day without touching the function.
- dotancohen 2y ago
  > written by the trusted party This is the weak, and expensive, link.
  - 6510 2y ago
    The programming notary should be expensive per line. If a function gets certified and a decent description it can be published for other developers to further scrutinize and use the same. With user.script or greasemonkey scripts it is kinda expected to read the script before use. Short scripts are easier to check. Funny example https://userscripts-mirror.org/scripts/show/179526 https://userscripts-mirror.org/scripts/show/179526 If the potentially dubious part can be isolated the notary, the publisher, the other developer and the user can easily review it. It seems much better than the current installing black boxes?
resonious 2y ago
It seems crazy that extensions don't have a permission for making network requests. Getting permission to access the DOM on all pages I visit is fine if there's no way to exfiltrate!
- robryk 2y ago
  You can always exfiltrate by inserting stuff into the page's DOM that will do the exfil from the page's context.
  - aembleton 2y ago
    Should have a seperate permission to modify the DOM. This extension only needs to read the DOM.
    - teruakohatu 2y ago
      Yes, a network access and DOM write permission should be one and the same. I think the reason it isn't done is because there are so many ways to leak data over a network. If the extension can trigger a DNS lookup somehow, it can exfiltrate data. Android used to have a network permission but Google removed it.
      - beeboobaa3 2y ago
        > Android used to have a network permission but Google removed it. That's because google is in the ads business and wants apps to always be able to exfiltrate data to google (google analytics, google ads, etc) & display ads without needing additional permissions. Having a network permission means there is an incentive for apps to not have the network permission which means they can't load ads. And Google wants you to look at their ads.
  - gtsteve 2y ago
    I would hope that high value target sites such as banks would implement CSPs to prevent that or make it more difficult though.
ivanjermakov 2y ago
1. Wait for an extension to become popular 2. Sell it to a company with malicious intentions 3. Get ad/spy/malware in your browser
- geek_at 2y ago
  that happened to me. I installed a plugin that would parse all pages for email addresses and store them for later reference. A few months later i started to see strange ads on pages that shouldn't have ads.
rc_mob 2y ago
How is OP supposed to build the extension without doing this?
doctorpangloss 2y ago
My dude. Google Chrome hoovers up all your browsing history. Google knows the content of pages you visit, because you make search queries to visit them, and most sites use Google Analytics or Webmaster tools, or the sites are in their index and can be looked up by URL reported by Chrome. Google has your Gmail, YouTube, Google Drive… if it wanted to, it could access your private stuff because it has access to your email. You are whinging about a silly joke project with a hypothetical concern, when you are already granting broad permissions to all of your data.
dougseismic 2y ago
As a fellow extension developer, you'll know that remote code is extremely sandboxed by the review process and you can jump into the code easily. Hell if you're that paranoid, sniff any remote connections with mitmproxy and generally just... understand what an extension does before you leave it on your machine. Some extensions are just fun; this extension is wicked for me as design inspiration but yeah, salty take and hackernews PB+J

Refusing23 2y ago

just like 'Grammarly' which is basically just a keylogger

MrSS 2y ago
Grammarly has to be able to connect back to their online service while the button addon could be implemented in a way that it can read every website but not send antyhing anywere (in theory, the addon could of course simulate a form and send data out through that or somehow). But yeah i tested grammarly for 5 minutes and found it crazy. there has to be a better way getting both worlds :|
- bargainbin 2y ago
  Local software of course! But good luck getting funding for a product that doesn’t phone home every 5 seconds and present an opportunity to plague the user with ads “that they want to see”
  - vstollen 2y ago
    I haven’t used it myself, but the LanguageTool browser extension might allow users to use a self-hosted or locally running instance.
- dspillett 2y ago
  In DayJob we've had to block (actually block, because people didn't listen to being asked not to use it and similar tools) Grammarly because it sending text that could potentially include client data off to their servers for checking would have given us a nasty fail should a client request or conduct an audit. As an alternative there is LanguageTool which you can install locally. We have it running on a small VM that people can configure their installs to talk to, and block the public service end-point (as sending to that would be a big no-no for us for the same reason as Grammarly). It doesn't have all the features of Grammarly so isn't a complete drop-in replacement, but the self-hosted version works as well as the free features of Grammarly.
  - Suppafly 2y ago
    >As an alternative there is LanguageTool which you can install locally. We have it running on a small VM that people can configure their installs to talk to, and block the public service end-point I'm surprised that Grammarly hasn't come up with a local service like that, I bet they have a ton of enterprise users that would appreciate it.

elaus 2y ago

> [...] but funnily enough require broad permissions I don't think there is a way to implement this without said permission. You can always check out the code from GitHub and install the extension locally to avoid any malicious changes in the future.

skybrian 2y ago
And that’s why it shouldn’t be in the Chrome app store at all. As a hobbyist developer, having that kind of access in other people’s browsers is not something I want, and I’m suspicious of developers who do seem to want it. It’s like “hey, I wrote a fun game that requires root access.” At least limit it to people who know what Github is.
- firtoz 2y ago
  > hey, I wrote a fun game that requires root access So... Just like AAA game studios, eh?
  - MOARDONGZPLZ 2y ago
    No. They are large and presumably have some sort of trust, and can lose the trust of people if they do particularly shady things. This may not bear itself out in practice of course. But a game studio has something to lose, whereas hobbyist developer 73683 asking for root permissions for no real gain to you has nothing to lose from any number of things like scraping sites you visit or using your browser as a tor exit node or any number of things.
    - gryn 2y ago
      yeah, I'm sure Genshin impact's creators went out of business when their Kernel access anti-cheat was hacked by ransomware or more recently the hacks mid live broadcasted tournaments (don't remember which game, I think it was apex). I mean that's what kids, teenagers, and young adults and non technical people in general are known for: their prudence and good technical decision making. lets not talk about the other risk vector that Tencent, a chinese company is the one buying most of these game studios that have Kernel access (not exclusively).

d--b 2y ago

Yes they sell for quite a bit, and the buyer may not have the same idea of “fun” than the original guy.

vstollen 2y ago

Are (updates to) extensions from the Chrome and Firefox store usually vetted before publication? I‘ve heard that Firefox will only run signed extensions. Would you trust this process?

zinekeller 2y ago
> Are (updates to) extensions from the Chrome and Firefox store usually vetted before publication? Mozilla does not manually review most extensions (only extensions which Mozilla recommended are manually reviewed: https://support.mozilla.org/en-US/kb/add-on-badges https://support.mozilla.org/en-US/kb/add-on-badges). Chrome's policy is extensions are "reviewed periodically for compliance", but is unclear on how frequent is this periodic review (https://developer.chrome.com/docs/webstore/review-process https://developer.chrome.com/docs/webstore/review-process).

6510 2y ago

The permissions need to be more specific some how. I think the correct approach is to have the option to have a function isolated from the rest of the code. Then pay a trusted party to review the functionality of the function. In this case said function may only 1) access the html on the website, 2) find the button and 3) return only that what makes the button. Then the permission prompt, written by the trusted party, can be something accurate like: This extension wants to copy buttons from websites. I'm calling it DEWISOTT computing: does exactly what it says on the tin You can go wild update your extension 1000 times per day without touching the function.

dotancohen 2y ago
> written by the trusted party This is the weak, and expensive, link.
- 6510 2y ago
  The programming notary should be expensive per line. If a function gets certified and a decent description it can be published for other developers to further scrutinize and use the same. With user.script or greasemonkey scripts it is kinda expected to read the script before use. Short scripts are easier to check. Funny example https://userscripts-mirror.org/scripts/show/179526 https://userscripts-mirror.org/scripts/show/179526 If the potentially dubious part can be isolated the notary, the publisher, the other developer and the user can easily review it. It seems much better than the current installing black boxes?

resonious 2y ago

It seems crazy that extensions don't have a permission for making network requests. Getting permission to access the DOM on all pages I visit is fine if there's no way to exfiltrate!

robryk 2y ago
You can always exfiltrate by inserting stuff into the page's DOM that will do the exfil from the page's context.
- aembleton 2y ago
  Should have a seperate permission to modify the DOM. This extension only needs to read the DOM.
  - teruakohatu 2y ago
    Yes, a network access and DOM write permission should be one and the same. I think the reason it isn't done is because there are so many ways to leak data over a network. If the extension can trigger a DNS lookup somehow, it can exfiltrate data. Android used to have a network permission but Google removed it.
    - beeboobaa3 2y ago
      > Android used to have a network permission but Google removed it. That's because google is in the ads business and wants apps to always be able to exfiltrate data to google (google analytics, google ads, etc) & display ads without needing additional permissions. Having a network permission means there is an incentive for apps to not have the network permission which means they can't load ads. And Google wants you to look at their ads.
- gtsteve 2y ago
  I would hope that high value target sites such as banks would implement CSPs to prevent that or make it more difficult though.

ivanjermakov 2y ago

1. Wait for an extension to become popular 2. Sell it to a company with malicious intentions 3. Get ad/spy/malware in your browser

geek_at 2y ago
that happened to me. I installed a plugin that would parse all pages for email addresses and store them for later reference. A few months later i started to see strange ads on pages that shouldn't have ads.

rc_mob 2y ago

How is OP supposed to build the extension without doing this?

doctorpangloss 2y ago

My dude. Google Chrome hoovers up all your browsing history. Google knows the content of pages you visit, because you make search queries to visit them, and most sites use Google Analytics or Webmaster tools, or the sites are in their index and can be looked up by URL reported by Chrome. Google has your Gmail, YouTube, Google Drive… if it wanted to, it could access your private stuff because it has access to your email. You are whinging about a silly joke project with a hypothetical concern, when you are already granting broad permissions to all of your data.

dougseismic 2y ago

As a fellow extension developer, you'll know that remote code is extremely sandboxed by the review process and you can jump into the code easily. Hell if you're that paranoid, sniff any remote connections with mitmproxy and generally just... understand what an extension does before you leave it on your machine. Some extensions are just fun; this extension is wicked for me as design inspiration but yeah, salty take and hackernews PB+J