3 ms·

Yes, but if you write your own extension maybe you want to read and modify the data. For example, patch fingerprinting script so that it gets the wrong result.

Yes, but if you write your own extension maybe you want to read and modify the data. For example, patch fingerprinting script so that it gets the wrong result. Furthermore, malicious extension can read the data from the DOM, from forms (for example, password or credit card fields), and in some cases, from JS variables. They can insert fake information into the page. So preventing extensions from reading network data still leaves a lot of options for a malicious extension.

jimmydorry 2mo ago
So you're saying that because Google didn't completely up-end the security model and break almost every extension in the one-go, we should have no-progress towards a more secure extension model? uBlock Origin via declarative blocks is almost as powerful as the original. While I would trust gorhill with almost unfettered control over my browser, I don't trust EVERY extension owner (no do I trust uBlock Origin in perpetuity).
- glenstein 2mo ago
  >So you're saying that because Google didn't completely up-end the security model and break almost every extension in the one-go, we should have no-progress towards a more secure extension model? A funny argument to make because the thing that would make such a measure ridiculous as you rightly point out, is exactly what already makes the Manifest changes ridiculous in the first instance. They were making a rhetorical point and you elaborated on their point for them as if doing so expressed a disagreement.
  - jimmydorry 2mo ago
    I think a big step forward, towards a better security model, was overall a good thing, even if it meant that a good extension no longer had unfettered access to everything your browser saw. I don't think this change is ridiculous at all. And I don't want them to stop here either! v4 should close more of the avenues that malicious extensions are abusing! Extensions should declare everything up-front, so it's easy see if abuse is occuring.
    - simonra 2mo ago
      How do you secure against the system vendor (in this case the browser) limiting what the consumer/user can or can't do (alone or with the help of third parties) with the product after acquiring it though? After all security for individuals against commercial and otherwise organized interests is one of the, if not the most important security after life and health. Even if one values the market overall for financial reasons, there is a solid argument that preventing modifications (and thus also repairs) is anti-competitive. It would be damaging to society if manifestV4 is realized restricting what can run further, much like printers and operating systems where the users ability to run software they bring themselves is limited has been. Just as no one should have to go to a mechanic with a special deal with the manufacturer to get their car or tractor to work as desired, neither should users of software.
      - maccard 2mo ago
        You use a different browser, like Firefox.
        Forgeties79 2mo ago
        A browser that is routinely dumped on by HN for not being perfectly managed lol
        xboxnolifes 2mo ago
        HN routinely dumps on chrome too. There is no browser HN likes.
        Forgeties79 2mo ago
        Well chrome is obvious. Firefox always triggers the same complaints about Mozilla foundation. They’re valid, but the dog pile is always very striking. At the end of the day Firefox is a great browser and has enabled a bunch of great forks all outside of the chromium ecosystem. We can be critical and should be, but again, it’s very intense sometimes. Google is clearly worse.
- inigyou 2mo ago
  We should have the option to limit an extension to certain tabs or websites or at least windows, and extension authors should also have the option to specify that. An adblocker, by its nature, needs to access *. But Return YouTube Dislike could statically specify that it will only run on youtube.com, and that's fine. But the option to enable access to * is essential.
  - jimmydorry 2mo ago
    >An adblocker, by its nature, needs to access * Well that's what is in contention. Does everything claiming to be an adblocker really need access to *? Is Adblocker5++ (totally not malware) entitled to as much access as uBlock Origin? You can declare upfront all the URLs you don't want accessed (which on top of security gives a substantial performance boost), and who's to say someone won't figure out a better way of working within these constraints?
    - inigyou 2mo ago
      What does "entitled" mean here?
      - jimmydorry 2mo ago
        A valid claim. The unfettered access to. etc.
        inigyou 2mo ago
        What does that mean? The CPU runs instructions, it doesn't have entitlements or claims.
- franga2000 2mo ago
  Removing capabilities is not progress towards better security. Putting them behind opt-in permissions, making permissions more granular, more robust... those are security upgrades. Removing capabilities is a feature downgrade.
  - jimmydorry 2mo ago
    Security upgrades are never opt-in, and for good reason. The status quo would remain in-secure. Every encryption suite upgrade, SSL software version, DNS versions, etc. maintained backwards compatibility for a window then closed it... just like we have seen here with manifest v2 -> v3. "Please stop looking at all network requests, especially when you don't need to." doesn't result in action... while: "You can no longer look at all network requests" requires extension makers to update to the new paradigm.
    - franga2000 2mo ago
      New versions of encryption suites don't remove core functionality. This is like TLS removing SNI because it leaks information. It does, but the solution is ESNI, not removing SNI all together. It's not "please stop looking at network requests", it's "ask the user for informed consent to look at network requests". Make it a big scary red warning if you want to. Definitely don't auto-grant it to existing extensions. There are many options that don't involve removing functionality. It's like when Google removed SMS and clipboard permissions because they used to be too broad. People were pissed, a bunch of apps were killed, Google's walled garden got reinforced...
      - jimmydorry 1mo ago
        You're being naieve if you don't think SNI will be fully deprecated in the future when a standard is settled on and reaches wide-adoption. Scare prompt fatigue is real. If you're constantly blasting users with "XXX wants to do Y" which sounds scary, you're training them to just accept without thinking.
        1mo ago

jimmydorry 2mo ago

So you're saying that because Google didn't completely up-end the security model and break almost every extension in the one-go, we should have no-progress towards a more secure extension model? uBlock Origin via declarative blocks is almost as powerful as the original. While I would trust gorhill with almost unfettered control over my browser, I don't trust EVERY extension owner (no do I trust uBlock Origin in perpetuity).

glenstein 2mo ago
>So you're saying that because Google didn't completely up-end the security model and break almost every extension in the one-go, we should have no-progress towards a more secure extension model? A funny argument to make because the thing that would make such a measure ridiculous as you rightly point out, is exactly what already makes the Manifest changes ridiculous in the first instance. They were making a rhetorical point and you elaborated on their point for them as if doing so expressed a disagreement.
- jimmydorry 2mo ago
  I think a big step forward, towards a better security model, was overall a good thing, even if it meant that a good extension no longer had unfettered access to everything your browser saw. I don't think this change is ridiculous at all. And I don't want them to stop here either! v4 should close more of the avenues that malicious extensions are abusing! Extensions should declare everything up-front, so it's easy see if abuse is occuring.
  - simonra 2mo ago
    How do you secure against the system vendor (in this case the browser) limiting what the consumer/user can or can't do (alone or with the help of third parties) with the product after acquiring it though? After all security for individuals against commercial and otherwise organized interests is one of the, if not the most important security after life and health. Even if one values the market overall for financial reasons, there is a solid argument that preventing modifications (and thus also repairs) is anti-competitive. It would be damaging to society if manifestV4 is realized restricting what can run further, much like printers and operating systems where the users ability to run software they bring themselves is limited has been. Just as no one should have to go to a mechanic with a special deal with the manufacturer to get their car or tractor to work as desired, neither should users of software.
    - maccard 2mo ago
      You use a different browser, like Firefox.
      - Forgeties79 2mo ago
        A browser that is routinely dumped on by HN for not being perfectly managed lol
        xboxnolifes 2mo ago
        HN routinely dumps on chrome too. There is no browser HN likes.
        Forgeties79 2mo ago
        Well chrome is obvious. Firefox always triggers the same complaints about Mozilla foundation. They’re valid, but the dog pile is always very striking. At the end of the day Firefox is a great browser and has enabled a bunch of great forks all outside of the chromium ecosystem. We can be critical and should be, but again, it’s very intense sometimes. Google is clearly worse.
inigyou 2mo ago
We should have the option to limit an extension to certain tabs or websites or at least windows, and extension authors should also have the option to specify that. An adblocker, by its nature, needs to access *. But Return YouTube Dislike could statically specify that it will only run on youtube.com, and that's fine. But the option to enable access to * is essential.
- jimmydorry 2mo ago
  >An adblocker, by its nature, needs to access * Well that's what is in contention. Does everything claiming to be an adblocker really need access to *? Is Adblocker5++ (totally not malware) entitled to as much access as uBlock Origin? You can declare upfront all the URLs you don't want accessed (which on top of security gives a substantial performance boost), and who's to say someone won't figure out a better way of working within these constraints?
  - inigyou 2mo ago
    What does "entitled" mean here?
    - jimmydorry 2mo ago
      A valid claim. The unfettered access to. etc.
      - inigyou 2mo ago
        What does that mean? The CPU runs instructions, it doesn't have entitlements or claims.
franga2000 2mo ago
Removing capabilities is not progress towards better security. Putting them behind opt-in permissions, making permissions more granular, more robust... those are security upgrades. Removing capabilities is a feature downgrade.
- jimmydorry 2mo ago
  Security upgrades are never opt-in, and for good reason. The status quo would remain in-secure. Every encryption suite upgrade, SSL software version, DNS versions, etc. maintained backwards compatibility for a window then closed it... just like we have seen here with manifest v2 -> v3. "Please stop looking at all network requests, especially when you don't need to." doesn't result in action... while: "You can no longer look at all network requests" requires extension makers to update to the new paradigm.
  - franga2000 2mo ago
    New versions of encryption suites don't remove core functionality. This is like TLS removing SNI because it leaks information. It does, but the solution is ESNI, not removing SNI all together. It's not "please stop looking at network requests", it's "ask the user for informed consent to look at network requests". Make it a big scary red warning if you want to. Definitely don't auto-grant it to existing extensions. There are many options that don't involve removing functionality. It's like when Google removed SMS and clipboard permissions because they used to be too broad. People were pissed, a bunch of apps were killed, Google's walled garden got reinforced...
    - jimmydorry 1mo ago
      You're being naieve if you don't think SNI will be fully deprecated in the future when a standard is settled on and reaches wide-adoption. Scare prompt fatigue is real. If you're constantly blasting users with "XXX wants to do Y" which sounds scary, you're training them to just accept without thinking.
      - 1mo ago