7 ms·

The Karma connection in Chrome Web Store

154 points by supermatou 2y ago

tencentshill 2y ago
Is there any way to only allow chrome extensions to update with permission? It seems like any extension on the store could become malicious overnight, automatically, for millions of users.
- modeless 2y ago
  I don't think so. However, extensions are automatically disabled if they request more permissions. And in Manifest v3 most extensions won't have access to most pages unless you click on them.
  - lapcat 2y ago
    > And in Manifest v3 most extensions won't have access to most pages unless you click on them. That's not necessarily true.
    - modeless 2y ago
      Personally I have 15 extensions installed. Only four of them have access to all sites, and two of those are because they are not updated to Manifest v3 yet. I didn't say it was impossible for a Manifest v3 extension to have access to all sites. Most will not.
- lapcat 2y ago
  > Is there any way to only allow chrome extensions to update with permission? With a firewall.
  - extraduder_ire 2y ago
    Can a firewall rule distinguish between an extension update and a new install? Would blocking the entire chrome web store cause other problems in chrome?
- advisedwang 2y ago
  Most users have no way to vet a chrome extension update (or on initial install). If we want strong security for everyone, we need better solutions than that
- skybrian 2y ago
  Here is one workaround: if you have to use a Chrome extension, make a separate profile just for that task. Don’t run any by default.
- sovok_x 2y ago
  AFAIK there are two ways for this, neither of which is convenient to use: install all extensions from the source (you can unpack an existing crx for it or use their clonned repo if it's opensource) or use a group policy to disable extensions autoupdate and update each of them manually when the new version has something you want.
yapyap 2y ago
[flagged]
- bjackman 2y ago
  How does Firefox avoid this problem?
  - renewiltord 2y ago
    There are very few users, so no one buys the extensions.
  - joshuaturner 2y ago
    If anything the non Developer Editions of Firefox disabling the ability to load an extension locally (without resetting it every time the browser starts) closes one path to preventing auto-updating of extensions.
    - sundarurfriend 2y ago
      That's a path necessary only in Chrome - Firefox allows you to disable auto-update of extensions, both wholesale and individually, without extraneous steps like that. (The ability to load extensions locally would be great for its own reasons, but that's irrelevant to this discussion.)
- deleted 2y ago
  [deleted]
semenko 2y ago
I was optimistically hoping some of the MV3 changes would result in Chrome webstore policy enforcement being standardized, but that hasn't happened. Sensor Tower (https://sensortower.com/ https://sensortower.com/) makes a lot of popular extensions, like StayFocusd https://www.stayfocusd.com/ https://www.stayfocusd.com/. They seem to resell ad data (in violation of [1]?) and ship likely obfuscated code [2] (in violation of [3]?), but there's no enforcement or even clear reporting mechanism. [1] https://developer.chrome.com/docs/webstore/program-policies/limited-use/ https://developer.chrome.com/docs/webstore/program-policies/... [2] https://robwu.nl/crxviewer/?crx=https%3A%2F%2Fclients2.google.com%2Fservice%2Fupdate2%2Fcrx%3Fresponse%3Dredirect%26os%3Dmac%26arch%3Dx86-32%26os_arch%3Dx86-32%26nacl_arch%3Dx86-32%26prod%3Dchromecrx%26prodchannel%3Dunknown%26prodversion%3D9999.0.9999.0%26acceptformat%3Dcrx2%2Ccrx3%26x%3Did%253Dlaankejkbhbdhmipfmgcngdelahlfoji%2526uc&qf=content-scripts%2Fad-finder.js&qb=1 https://robwu.nl/crxviewer/?crx=https%3A%2F%2Fclients2.googl... [3] https://developer.chrome.com/docs/webstore/program-policies/code-readability https://developer.chrome.com/docs/webstore/program-policies/...
- Raed667 2y ago
  Event with MV3 you still have access to `chrome.webRequest.onBeforeRequest` and content scripts, so this particular issue won't be 100% solved. I don't think the solution is technical. The solution would be a strict policy, and nuke every extension and publisher from the store who even hints at doing this kind of BS.
- palant 2y ago
  Note: I am the author of this article. MV3 makes it considerably harder to introduce a security vulnerability, but it doesn’t really help with outright malicious extensions. In the end this isn’t an issue which can be solved by technical means. It’s a moderation issue, and Google currently seems to be scaling back moderation despite not being great at it to start with.
michaelbuckbee 2y ago
There was a question raised but not really answered about "what do these extensions what with all this browsing data?" - while it may be that they're used for direct ad targeting (like real time ad buying against your IP address) it's more likely that they're selling "click stream" data. In its most innocuous form, this is stuff like SimilarWeb (which is like a more advanced Google Trends), but in the B2B world, it's also custom enterprise reports that are like "how many people that use our bank at xyz also use any other bank at this array of domains and which are most common?"
- palant 2y ago
  Note: I am the author of this article. That question is answered, in the last section of the article. And: yes, they are selling it, as they admit in the privacy policy.
cxr 2y ago
Most people aren't (or at least feel they aren't) able to take a hardline stance about only using free software, but if there's one area of your digital life you should be able to apply it to, it's browser extensions.
- deleted 2y ago
  [deleted]
bborud 2y ago
Why is Google not policing this? Liability concerns?
- altairprime 2y ago
  Not reliably detectable by machines, not willing to allocate humans.
deleted 2y ago
[deleted]
barumrho 2y ago
I've decided that browser extensions are too much of a security/privacy risk. I just stick with 1password extension and an ad blocker extension that uses Safari's Content Blocker API only. And then from time to time I have a dedicated profile on Chrome to use other extensions that might be useful, but I don't do day-to-day browsing there.
- blibble 2y ago
  I'm similar I have all relatives set up with a separate browser for e.g. banking, and it has no extensions at all then the usual internet browsing one with the security nightmare than is the chrome/firefox app store
_fw 2y ago
I am absolutely flabbergasted at the fact that Chrome extension security is the way it is, considering how much Google spends to keep chrome secure. How is it, in 2024, users can still blindly install malicious software directly into their browser from a web store with Google’s name at the top of it? This goes to show even the most cautious and conscientious of users can get caught out by their extension changing hands. What, is Google expecting us to review our extensions, and their permissions, and their authors, and their authors’ associated businesses, every time we want to use our computer? Additionally, are we even able to review the source code of extensions if they are not open source?
- timabdulla 2y ago
  You can unpack and view the code of any extension after you've installed it. There's even a rule against obfuscation, though I'm not sure how enforced that is. A Chrome extension is basically a zip archive with a bunch of JavaScript inside. There's no safeguarding of the code within.
  - Raed667 2y ago
    > There's even a rule against obfuscation Does that only cover the background/web-worker or does it also include the UI parts (popup, content-ui, dev-tools...) ? That would make using something like React or Vue almost impossible.
    - timabdulla 2y ago
      There's no rule against minification, which I assume is what you're referring to when you say it would make using React or Vue impossible. There's a difference between minification and obfuscation, but again, I'm not sure how they adjudicate it or how much they enforce it.
  - hysan 2y ago
    > There's even a rule against obfuscation This is definitely not enforced. I’ve downloaded multiple extensions in the past when I wanted to learn how they worked. All of them were obfuscated. edit: saw the below comment and editing before this gets questioned. I’m not talking about minification. It was definitely obfuscation.

154 points by supermatou 2y ago

Is there any way to only allow chrome extensions to update with permission? It seems like any extension on the store could become malicious overnight, automatically, for millions of users.

modeless 2y ago
I don't think so. However, extensions are automatically disabled if they request more permissions. And in Manifest v3 most extensions won't have access to most pages unless you click on them.
- lapcat 2y ago
  > And in Manifest v3 most extensions won't have access to most pages unless you click on them. That's not necessarily true.
  - modeless 2y ago
    Personally I have 15 extensions installed. Only four of them have access to all sites, and two of those are because they are not updated to Manifest v3 yet. I didn't say it was impossible for a Manifest v3 extension to have access to all sites. Most will not.
lapcat 2y ago
> Is there any way to only allow chrome extensions to update with permission? With a firewall.
- extraduder_ire 2y ago
  Can a firewall rule distinguish between an extension update and a new install? Would blocking the entire chrome web store cause other problems in chrome?
advisedwang 2y ago
Most users have no way to vet a chrome extension update (or on initial install). If we want strong security for everyone, we need better solutions than that
skybrian 2y ago
Here is one workaround: if you have to use a Chrome extension, make a separate profile just for that task. Don’t run any by default.
sovok_x 2y ago
AFAIK there are two ways for this, neither of which is convenient to use: install all extensions from the source (you can unpack an existing crx for it or use their clonned repo if it's opensource) or use a group policy to disable extensions autoupdate and update each of them manually when the new version has something you want.

yapyap 2y ago

[flagged]

bjackman 2y ago
How does Firefox avoid this problem?
- renewiltord 2y ago
  There are very few users, so no one buys the extensions.
- joshuaturner 2y ago
  If anything the non Developer Editions of Firefox disabling the ability to load an extension locally (without resetting it every time the browser starts) closes one path to preventing auto-updating of extensions.
  - sundarurfriend 2y ago
    That's a path necessary only in Chrome - Firefox allows you to disable auto-update of extensions, both wholesale and individually, without extraneous steps like that. (The ability to load extensions locally would be great for its own reasons, but that's irrelevant to this discussion.)
deleted 2y ago
[deleted]

semenko 2y ago

I was optimistically hoping some of the MV3 changes would result in Chrome webstore policy enforcement being standardized, but that hasn't happened. Sensor Tower (https://sensortower.com/ https://sensortower.com/) makes a lot of popular extensions, like StayFocusd https://www.stayfocusd.com/ https://www.stayfocusd.com/. They seem to resell ad data (in violation of [1]?) and ship likely obfuscated code [2] (in violation of [3]?), but there's no enforcement or even clear reporting mechanism. [1] https://developer.chrome.com/docs/webstore/program-policies/limited-use/ https://developer.chrome.com/docs/webstore/program-policies/... [2] https://robwu.nl/crxviewer/?crx=https%3A%2F%2Fclients2.google.com%2Fservice%2Fupdate2%2Fcrx%3Fresponse%3Dredirect%26os%3Dmac%26arch%3Dx86-32%26os_arch%3Dx86-32%26nacl_arch%3Dx86-32%26prod%3Dchromecrx%26prodchannel%3Dunknown%26prodversion%3D9999.0.9999.0%26acceptformat%3Dcrx2%2Ccrx3%26x%3Did%253Dlaankejkbhbdhmipfmgcngdelahlfoji%2526uc&qf=content-scripts%2Fad-finder.js&qb=1 https://robwu.nl/crxviewer/?crx=https%3A%2F%2Fclients2.googl... [3] https://developer.chrome.com/docs/webstore/program-policies/code-readability https://developer.chrome.com/docs/webstore/program-policies/...

Raed667 2y ago
Event with MV3 you still have access to `chrome.webRequest.onBeforeRequest` and content scripts, so this particular issue won't be 100% solved. I don't think the solution is technical. The solution would be a strict policy, and nuke every extension and publisher from the store who even hints at doing this kind of BS.
palant 2y ago
Note: I am the author of this article. MV3 makes it considerably harder to introduce a security vulnerability, but it doesn’t really help with outright malicious extensions. In the end this isn’t an issue which can be solved by technical means. It’s a moderation issue, and Google currently seems to be scaling back moderation despite not being great at it to start with.

michaelbuckbee 2y ago

There was a question raised but not really answered about "what do these extensions what with all this browsing data?" - while it may be that they're used for direct ad targeting (like real time ad buying against your IP address) it's more likely that they're selling "click stream" data. In its most innocuous form, this is stuff like SimilarWeb (which is like a more advanced Google Trends), but in the B2B world, it's also custom enterprise reports that are like "how many people that use our bank at xyz also use any other bank at this array of domains and which are most common?"

palant 2y ago
Note: I am the author of this article. That question is answered, in the last section of the article. And: yes, they are selling it, as they admit in the privacy policy.

cxr 2y ago

Most people aren't (or at least feel they aren't) able to take a hardline stance about only using free software, but if there's one area of your digital life you should be able to apply it to, it's browser extensions.

deleted 2y ago
[deleted]

bborud 2y ago

Why is Google not policing this? Liability concerns?

altairprime 2y ago
Not reliably detectable by machines, not willing to allocate humans.

deleted 2y ago

[deleted]

barumrho 2y ago

I've decided that browser extensions are too much of a security/privacy risk. I just stick with 1password extension and an ad blocker extension that uses Safari's Content Blocker API only. And then from time to time I have a dedicated profile on Chrome to use other extensions that might be useful, but I don't do day-to-day browsing there.

blibble 2y ago
I'm similar I have all relatives set up with a separate browser for e.g. banking, and it has no extensions at all then the usual internet browsing one with the security nightmare than is the chrome/firefox app store

_fw 2y ago

I am absolutely flabbergasted at the fact that Chrome extension security is the way it is, considering how much Google spends to keep chrome secure. How is it, in 2024, users can still blindly install malicious software directly into their browser from a web store with Google’s name at the top of it? This goes to show even the most cautious and conscientious of users can get caught out by their extension changing hands. What, is Google expecting us to review our extensions, and their permissions, and their authors, and their authors’ associated businesses, every time we want to use our computer? Additionally, are we even able to review the source code of extensions if they are not open source?

timabdulla 2y ago
You can unpack and view the code of any extension after you've installed it. There's even a rule against obfuscation, though I'm not sure how enforced that is. A Chrome extension is basically a zip archive with a bunch of JavaScript inside. There's no safeguarding of the code within.
- Raed667 2y ago
  > There's even a rule against obfuscation Does that only cover the background/web-worker or does it also include the UI parts (popup, content-ui, dev-tools...) ? That would make using something like React or Vue almost impossible.
  - timabdulla 2y ago
    There's no rule against minification, which I assume is what you're referring to when you say it would make using React or Vue impossible. There's a difference between minification and obfuscation, but again, I'm not sure how they adjudicate it or how much they enforce it.
- hysan 2y ago
  > There's even a rule against obfuscation This is definitely not enforced. I’ve downloaded multiple extensions in the past when I wanted to learn how they worked. All of them were obfuscated. edit: saw the below comment and editing before this gets questioned. I’m not talking about minification. It was definitely obfuscation.