12 ms·

SSH client in Google Chrome

207 points by Garbage 14y ago

jlgreco 14y ago
From the reviews: "Aside from the odd quirks with using Ctrl+W on bash, emacs, or vim..." Sounds like fun. ;)
- suhastech 14y ago
  That is one of the reasons I prefer Mac.
- tonfa 14y ago
  Right-click, "Open as window". And voilà all your shortcuts.
  - JesseObrien 14y ago
    Thank you, this was bothering me as well but I guess I never thought to right click. :)
arb99 14y ago
Ideal for use on chromebooks. Looks like it has been around for quite a long time too (91k users)
- piinbinary 14y ago
  I'm curious: Is there any use case for this beyond Chromebooks?
  - andrewguenther 14y ago
    It is a nice alternative to Putty on Windows
    - christiangenco 14y ago
      Yeah, I've yet to find a good terminal on Windows.
  - frabcus 14y ago
    I only use a web browser and a terminal on OSX. Often I want to repeatedly swap between a terminal and a web browser tab - for example, when developing a web application. Having them in the same tabbed window might make the workflow, and division of my windows, more natural. Another example - I use mutt for email in a terminal. So if I'm writing an email about a web page, I might prefer it to be in the same window (different tab) as the web page. Downloading now to try it out...
    - juan_juarez 14y ago
      If it's easier to have your terminal in a browser tab than for it to be a separate application, that is a major failing on the part of your window manager (or at least your understanding of it).
- Hortinstein 14y ago
  doesn't ChromeOS has a built in SSH terminal? I received a Cr-48 (original beta) and I remember that was the feature i used the most
  - codeka 14y ago
    Yes, but it's a pain to use in comparison to this.
fatbird 14y ago
What a fantastic way to get people to give you the private key and tell you what host it's for.
- Firehed 14y ago
  I'm not about to install that extension and find out myself as that could cause some... serious problems... but that was my first thought as well. What's to stop this from doing something nefarious? Its sandboxing privileges are not remotely clear from what's in the app store, and I don't see of any reasonable way to contain what it can and cannot do. Granted this is equally a problem with any terminal emulator that you didn't compile yourself after examining the source code, but I have quite a bit more faith in Apple and the various Linux repo maintainers than some random guy publishing to the chrome app store. I don't know if Google even claims to vet its contents, but if they do I know they do a terrible job because I've ripped open some extensions to confirm they're doing some sketchy stuff (nothing insecure or worrying, more like adding affiliate links to your entire browsing experience)
  - captn3m0 14y ago
    I've been using this for quite some time, and there are basically two use-cases: a)alternate to putty for windows and b)an actual shell in your browser (You press Alt+1 instead of Alt-tab). The source for the extension is available at http://git.chromium.org/gitweb/?p=chromiumos/platform/assets.git;a=tree;f=chromeapps/hterm http://git.chromium.org/gitweb/?p=chromiumos/platform/assets... Also, handing it private keys is completely optional.
    - farnulfo 14y ago
      Do you know if it could be call from a link in a web page ?
  - kwn11 14y ago
    This is not some random guy publishing on chrome app store. This app is officially developed by Google.
Garbage 14y ago
Secure Shell FAQ - http://git.chromium.org/gitweb/?p=chromiumos/platform/assets.git;a=blob;f=chromeapps/hterm/doc/faq.txt http://git.chromium.org/gitweb/?p=chromiumos/platform/assets...
zyc 14y ago
Is this news? I have been using this for 6 months.
- schappim 14y ago
  Ditto. It's a great alternative to iTerm when not at my Mac.
RRRA 14y ago
So uhm, how does it handle sockets? I'm thinking of writing some kind of p2p as a webapp that would be universal but right now it seems my best option is webRTC that, if I understand what I've read correctly, will require a complete handling of the streams on a server... EDIT: Or how does NaCl differ from FirefoxOS goals and why?
- deleted 14y ago
  [deleted]
- otibom 14y ago
  NaCl executes native code in a sandbox, while FirefoxOS gives a plethora of APIs to Javascript. The end is similar (web pages have access to much more) but the mean is different.
  - jychang 14y ago
    *means are different as in "The ends justify the means". It took me a couple of reads to understand what you're saying.
- est 14y ago
  By using this http://developer.chrome.com/apps/socket.html http://developer.chrome.com/apps/socket.html I played with this API for a few days and here are my conclusions: 1. the socket.listen can not handle much concurrency. It's very easily DoS'd 2. javascript String and ArrayBuffer is PITA to mess with. I tried to write a partially working HTTP/1.1 server, all the encodings and string parsing made me give up. 3. calback style programming is the new GOTO
  - jrockway 14y ago
    You can use Dart instead of Javascript.
    - deleted 14y ago
      [deleted]
elktea 14y ago
Can't even look at the extension using Firefox. Nice work Google.
- jrockway 14y ago
  The description page loads fine for me in Iceweasel 10.0.0.2 on Debian unstable. (Iceweasel is Debian's fork of Firefox.) Perhaps you have Javascript blocked or something like that?
  - LukeShu 14y ago
    Confirming that it also works in Iceweasel-libre 18.0.1-3 on Parabola. (Iceweasel-libre is Parabola's fork of Debian's fork of Firefox)
- EwanToo 14y ago
  The link works perfectly in firefox here, can see the screenshots, descriptions, etc?
- graue 14y ago
  For me the link redirects to the front page of the Chrome Web Store, so I guess that's what's happening to you, too. But by entering "secure shell" in the search box I can view the screenshots, description and reviews of the app being discussed. Firefox 18 on Linux.
martinp 14y ago
Previous discussion: http://news.ycombinator.com/item?id=3910649 http://news.ycombinator.com/item?id=3910649
christiangenco 14y ago
THIS IS AWESOME I can now officially be productive on any computer running Chrome. Preferably one with caps lock remapped to escape.
- meaty 14y ago
  Yes: just like before with PuTTY or OpenSSH...
  - esteth 14y ago
    Except now you don't need to go install programs on someone else's computer if they have chrome installed.
    - meaty 14y ago
      No you don't for PuTTY at least. You can download the exe and stick it on the desktop or in the user profile directory.
jjcm 14y ago
Seems like it doesn't override the browser's basic keyboard shortcuts, some of which are heavily used in a terminal (ctrl+w for instance). I'd probably give it a run in place of putty if it werent for this.
- jamesaguilar 14y ago
  I don't know if this is the case for this particular extension. However, for most Chrome extensions, they can only use those shortcuts if they are opened in a separate window. You can select this option by right clicking on the app in the new tab page. I know that Chrome Remote Desktop can only use Ctrl-W in a separate window, but it works fine once it is in a separate window.
- tonfa 14y ago
  Right click on the app, select "open as new window" (if it's run in a tab it can't use the chrome shortcuts, for security reasons).
- meaty 14y ago
  That's because it's simply the wrong tool for the job. Stuff like this is a deal breaker either for the terminal or the browser model. Keep using PuTTY
  - BitMastro 14y ago
    It's just another tool.. If you're comfortable with PuTTY keep using it, nobody is stopping you. I believe having another option could be handy.
jwr 14y ago
This is exactly what I've been waiting for! The ability to take my critical secret information into a huge, buggy, extensible, unaudited, complex and constantly changing browser environment! Who could resist? This will also inspire innovators world-wide. Look at it this way: we can now find novel ways to steal passwords, secret keys, log sessions, access servers, sneak in trojans. Count me in.
- salmanapk 14y ago
  It might not be very safe at the moment, but this _is_ the future no matter how much you troll.
  - deleted 14y ago
    [deleted]
- meaty 14y ago
  You are the first person to articulate exactly what I think about such things perfectly! Give me PuTTY or SSH on a terminal any day over this.
- olalonde 14y ago
  "Middlebrow dismissal" comes to mind...
  - patio11 14y ago
    Can I phrase the same objection in a more HN-y manner? SSH terminals are high-sensitivity software. We frequently use them, with very sensitive credentials, to log into secured servers. There are two zones of trust involved: we trust that our local machine is not rooted, and we trust that the server is not rooted. The magic of SSL means that no matter how foul everything is between those two zones of trust, we can't get compromised. If we embed the SSH terminal in the browser, we now have four zones of trust: our local machine, the browser, the SSH terminal extension, and the server we connect to. This is a very scary broadening of our attack surface. While the terminal app siting on your machine is decades old and has been tested extensively, the browser extension almost certainly has not. The browser extension, in addition to possibly having vulnerabilities itself, is executing in the context of the browser. The browser is a very scary place to be, because its whole mission in life is connecting to the untrusted, infected cesspool of the Internet and then doing what the Internet tells it to. By grace of God and Google engineers, we generally assume that our browsers aren't going to crack out of the sandbox surrounding the sandbox surrounding the sandbox that all that evil Internet stuff is executing in, but we expect that, in the normal course of operation, those inner sandboxes are going to fall into the hands of the enemy, repeatedly. It therefore seems to be an exceptionally bad idea to take our holiest-of-holy credentials and move them inside the sandbox, closer to the attackers. This is particularly true in terms of a risk/benefit analysis, since the risks are incredible and the only benefit is "Saves you from having to do a single key chord to pop open an additional terminal on your machine." This is moot if you have total confidence in the Chrome and Native Client teams to never have a mistake which lets someone, e.g., read arbitrary process memory. That's happened before -- Mark Dowd et al found it. That would be pretty sucky if it happened on a browser you logged into your bank, because the attacker can probably grab your cookie and banking session. It would be much worse, though, if it happened on a machine used by a bank sysadmin who unwisely decided to use a terminal within his browser, because why steal one session when you can just steal the bank? (n.b. Note how this is possible without causing Chrome to execute arbitrary code or defeating the OS's protections against Chrome doing stuff outside the Chrome-box.)
shazam 14y ago
I've been using this for some time already
etherealG 14y ago
how different is the actual security here from running chrome on a machine with the same private keys? is the sandboxing any less secure protecting extensions from each other as from the native os underneath chrome?
cubsink 14y ago
Anyone criticizing this should seriously take a look in the mirror. Do you use stuff like Google Analytics in production? Well grats, then Google already own your production webpages. You include a script from their servers that can be used like any XSS. If not, well if you do not use third party jsonp, hotlinking or stuff that can be used to take control of your production machine, well then you are granted by me to rant on SSH in your browser. Otherwise, please realize that they probably can do equal damage or worse through your hotlinked scripts.
pjmlp 14y ago
Browser plugins? No thanks, the browser is for documents. No need to install security holes.
- Wintamute 14y ago
  The browser is for documents that have ... many supporting files, a dynamic scripting language, access to native OS features, access to the GPU, ability to blit bitmapdata at highspeed, and more. "Documents" doesn't cover it ... I think its fair to say that these days the browser is for software.
  - pjmlp 14y ago
    When I am not doing another web application for a customer that would be better having a desktop one, my browser is really only used for documents.
- recursive 14y ago
  1997 called.
  - pjmlp 14y ago
    And it feels like sunshine.
  - WayneDB 14y ago
    And they said that HTML/CSS/JS is still a kludgey solution for documents, apps and just about everything that it's being used for?
deleted 14y ago
[deleted]
guilloche 14y ago
If it is native-client, then it doesnot need to install. Why not just give us an url? I do not want this extension to pollute my chromium.
mrbill 14y ago
Not news - I've been using this ever since I got my Chromebook, 2-3 months ago.
brasic 14y ago
I wish this app could register itself as a handler for the ssh:// uri scheme [1]. [1] https://www.iana.org/assignments/uri-schemes/prov/ssh https://www.iana.org/assignments/uri-schemes/prov/ssh
millstone 14y ago
Gave it a try. I find the interface to be very confusing. For example, the opening screen has a button with text "[Del] Delete", but hitting the Delete key instead takes me back to the previous page instead of deleting anything, and clicking it doesn't do anything. It took me a while to figure out how to get it to try to make a connection - even though it says "Enter" you actually have to press Enter twice. It then took me to a page with a link to the FAQ, which I tried to click on, but the link was not clickable. Also, the clipboard behavior is incredibly irritating: selecting any text automatically copies it to the clipboard with a giant SELECTION COPIED popup. It's also inconsistent: double clicking anywhere flashes the same SELECTION COPIED, which turns out to be a lie. It doesn't actually modify my clipboard in this latter case. And when I actually hit Cmd-C, it unselects my selection (WHY?) (The FAQ claims I can "disable this by setting the copy-on-select preference to false, but I wasn't easily able to find a place for preferences. After some hunting, I found that I have to control click on the app from Chrome's "Apps" page to disable this.) Anyways it's been hung at "Loading NaCl plugin..." for the last ten minutes. Either it takes a long time to load, or I don't have the NaCl plugin installed, and so it just decided to hang instead of tell me. I tried to install it by googling "NaCl", and found the link https://developers.google.com/native-client/ https://developers.google.com/native-client/. Clicking "Get Started" tells me to download an SDK and work through the "Getting Started Tutorials." All this for an SSH connection? Anyways, it was overall a frustrating and confusing experience. I've now got four identical connection entries, none of which I can figure out how to delete, and none of which ever successfully connected to anything. Argh.
- oakwhiz 14y ago
  That's odd, it loaded up almost immediately for me, with little effort on my part.
martinced 14y ago
I realize this is convenient for people running Chrome on OS X but... The way I surf is simple: Chrome is installed from the .tgz and certainly not from the rpm or deb files (simply put: I don't need to be root to install Chrome and Chrome is confined to a single user account). The account I use for surfing is separated from the account from which I use SSH to access SSH servers. Should someone "root" Chrome while I surf the Web, he'd still need to find what is called a "local root exploit" to access what's in the other user accounts (for example, but not limited to, SSH keys). I think there's no way that, for me, moving SSH inside the browser would provide me more security than having Chrome not doing SSH and being in a separate (throwaway) user account. It seems to be, once again, trading conveniency in the name of security. I don't doubt it fits Google's plan to make Chrome the OS that said and so they'll of course tell you: "Nothing to see here, move along". Another concerning thing, depending on how it's done, it's that the potential to mount a "mocking bird" attack may be strong on this one. Mocking birds attack tend to not work well when you use MagicSysRQ to emit a keypress bypassing X, sending you to a text console, and doing your SSH magic. I realize security is a pain, but it would be great if people could still criticize quite critical security issues on HN without having everyone downplaying the ones criticizing as "redditers" (is that an insult?), contrarians, etc. I love HN. I love entrepreneurship. But I do love Bruce Schneier too and I consider security to be something very important. Yet here everytime an app that does "one master online password to store all your passwords" gets upvoted like mad just because it's a "startup" and just because it "runs on a smartphone". I understand that some of you may not like the "tone" of people using sarcasm to make a point but... They're still making a point and, very often, it's a valid point. So it would be great if people could come up with better arguments than simply name-calling the ones pointing out the security implications of apps / plugins / etc.
- arcatek 14y ago
  I don't see how installing from an archive is safer than using a package, can you develop ? From my understanding, Chrome is obviously not chrooted, so a local root exploit will be required in either case to access to the other accounts (since it will run with your current privileges). And actually it seems easier to corrupt a chrome extracted in the home directory, since an intruder would not require root credentials to inject some code into your chrome (and replacing every bank front page with fishing pages, for example).
niels_olson 14y ago
How does this compare to anyterm? I understand one's client-side and one's server-side, but aren't they both rather exposed?
of 14y ago
I usually have multiple PuTTY windows open to a couple different servers. I wish it was easier to have multiple SSH sessions going with this extension.
pla3rhat3r 14y ago
Hell to the yes!

207 points by Garbage 14y ago

jlgreco 14y ago

From the reviews: "Aside from the odd quirks with using Ctrl+W on bash, emacs, or vim..." Sounds like fun. ;)

suhastech 14y ago
That is one of the reasons I prefer Mac.
tonfa 14y ago
Right-click, "Open as window". And voilà all your shortcuts.
- JesseObrien 14y ago
  Thank you, this was bothering me as well but I guess I never thought to right click. :)

arb99 14y ago

Ideal for use on chromebooks. Looks like it has been around for quite a long time too (91k users)

piinbinary 14y ago
I'm curious: Is there any use case for this beyond Chromebooks?
- andrewguenther 14y ago
  It is a nice alternative to Putty on Windows
  - christiangenco 14y ago
    Yeah, I've yet to find a good terminal on Windows.
- frabcus 14y ago
  I only use a web browser and a terminal on OSX. Often I want to repeatedly swap between a terminal and a web browser tab - for example, when developing a web application. Having them in the same tabbed window might make the workflow, and division of my windows, more natural. Another example - I use mutt for email in a terminal. So if I'm writing an email about a web page, I might prefer it to be in the same window (different tab) as the web page. Downloading now to try it out...
  - juan_juarez 14y ago
    If it's easier to have your terminal in a browser tab than for it to be a separate application, that is a major failing on the part of your window manager (or at least your understanding of it).
Hortinstein 14y ago
doesn't ChromeOS has a built in SSH terminal? I received a Cr-48 (original beta) and I remember that was the feature i used the most
- codeka 14y ago
  Yes, but it's a pain to use in comparison to this.

fatbird 14y ago

What a fantastic way to get people to give you the private key and tell you what host it's for.

Firehed 14y ago
I'm not about to install that extension and find out myself as that could cause some... serious problems... but that was my first thought as well. What's to stop this from doing something nefarious? Its sandboxing privileges are not remotely clear from what's in the app store, and I don't see of any reasonable way to contain what it can and cannot do. Granted this is equally a problem with any terminal emulator that you didn't compile yourself after examining the source code, but I have quite a bit more faith in Apple and the various Linux repo maintainers than some random guy publishing to the chrome app store. I don't know if Google even claims to vet its contents, but if they do I know they do a terrible job because I've ripped open some extensions to confirm they're doing some sketchy stuff (nothing insecure or worrying, more like adding affiliate links to your entire browsing experience)
- captn3m0 14y ago
  I've been using this for quite some time, and there are basically two use-cases: a)alternate to putty for windows and b)an actual shell in your browser (You press Alt+1 instead of Alt-tab). The source for the extension is available at http://git.chromium.org/gitweb/?p=chromiumos/platform/assets.git;a=tree;f=chromeapps/hterm http://git.chromium.org/gitweb/?p=chromiumos/platform/assets... Also, handing it private keys is completely optional.
  - farnulfo 14y ago
    Do you know if it could be call from a link in a web page ?
- kwn11 14y ago
  This is not some random guy publishing on chrome app store. This app is officially developed by Google.

Garbage 14y ago

Secure Shell FAQ - http://git.chromium.org/gitweb/?p=chromiumos/platform/assets.git;a=blob;f=chromeapps/hterm/doc/faq.txt http://git.chromium.org/gitweb/?p=chromiumos/platform/assets...

zyc 14y ago

Is this news? I have been using this for 6 months.

schappim 14y ago
Ditto. It's a great alternative to iTerm when not at my Mac.

RRRA 14y ago

So uhm, how does it handle sockets? I'm thinking of writing some kind of p2p as a webapp that would be universal but right now it seems my best option is webRTC that, if I understand what I've read correctly, will require a complete handling of the streams on a server... EDIT: Or how does NaCl differ from FirefoxOS goals and why?

deleted 14y ago
[deleted]
otibom 14y ago
NaCl executes native code in a sandbox, while FirefoxOS gives a plethora of APIs to Javascript. The end is similar (web pages have access to much more) but the mean is different.
- jychang 14y ago
  *means are different as in "The ends justify the means". It took me a couple of reads to understand what you're saying.
est 14y ago
By using this http://developer.chrome.com/apps/socket.html http://developer.chrome.com/apps/socket.html I played with this API for a few days and here are my conclusions: 1. the socket.listen can not handle much concurrency. It's very easily DoS'd 2. javascript String and ArrayBuffer is PITA to mess with. I tried to write a partially working HTTP/1.1 server, all the encodings and string parsing made me give up. 3. calback style programming is the new GOTO
- jrockway 14y ago
  You can use Dart instead of Javascript.
  - deleted 14y ago
    [deleted]

elktea 14y ago

Can't even look at the extension using Firefox. Nice work Google.

jrockway 14y ago
The description page loads fine for me in Iceweasel 10.0.0.2 on Debian unstable. (Iceweasel is Debian's fork of Firefox.) Perhaps you have Javascript blocked or something like that?
- LukeShu 14y ago
  Confirming that it also works in Iceweasel-libre 18.0.1-3 on Parabola. (Iceweasel-libre is Parabola's fork of Debian's fork of Firefox)
EwanToo 14y ago
The link works perfectly in firefox here, can see the screenshots, descriptions, etc?
graue 14y ago
For me the link redirects to the front page of the Chrome Web Store, so I guess that's what's happening to you, too. But by entering "secure shell" in the search box I can view the screenshots, description and reviews of the app being discussed. Firefox 18 on Linux.

martinp 14y ago

Previous discussion: http://news.ycombinator.com/item?id=3910649 http://news.ycombinator.com/item?id=3910649

christiangenco 14y ago

THIS IS AWESOME I can now officially be productive on any computer running Chrome. Preferably one with caps lock remapped to escape.

meaty 14y ago
Yes: just like before with PuTTY or OpenSSH...
- esteth 14y ago
  Except now you don't need to go install programs on someone else's computer if they have chrome installed.
  - meaty 14y ago
    No you don't for PuTTY at least. You can download the exe and stick it on the desktop or in the user profile directory.

jjcm 14y ago

Seems like it doesn't override the browser's basic keyboard shortcuts, some of which are heavily used in a terminal (ctrl+w for instance). I'd probably give it a run in place of putty if it werent for this.

jamesaguilar 14y ago
I don't know if this is the case for this particular extension. However, for most Chrome extensions, they can only use those shortcuts if they are opened in a separate window. You can select this option by right clicking on the app in the new tab page. I know that Chrome Remote Desktop can only use Ctrl-W in a separate window, but it works fine once it is in a separate window.
tonfa 14y ago
Right click on the app, select "open as new window" (if it's run in a tab it can't use the chrome shortcuts, for security reasons).
meaty 14y ago
That's because it's simply the wrong tool for the job. Stuff like this is a deal breaker either for the terminal or the browser model. Keep using PuTTY
- BitMastro 14y ago
  It's just another tool.. If you're comfortable with PuTTY keep using it, nobody is stopping you. I believe having another option could be handy.

jwr 14y ago

This is exactly what I've been waiting for! The ability to take my critical secret information into a huge, buggy, extensible, unaudited, complex and constantly changing browser environment! Who could resist? This will also inspire innovators world-wide. Look at it this way: we can now find novel ways to steal passwords, secret keys, log sessions, access servers, sneak in trojans. Count me in.

salmanapk 14y ago
It might not be very safe at the moment, but this _is_ the future no matter how much you troll.
- deleted 14y ago
  [deleted]
meaty 14y ago
You are the first person to articulate exactly what I think about such things perfectly! Give me PuTTY or SSH on a terminal any day over this.
olalonde 14y ago
"Middlebrow dismissal" comes to mind...
- patio11 14y ago
  Can I phrase the same objection in a more HN-y manner? SSH terminals are high-sensitivity software. We frequently use them, with very sensitive credentials, to log into secured servers. There are two zones of trust involved: we trust that our local machine is not rooted, and we trust that the server is not rooted. The magic of SSL means that no matter how foul everything is between those two zones of trust, we can't get compromised. If we embed the SSH terminal in the browser, we now have four zones of trust: our local machine, the browser, the SSH terminal extension, and the server we connect to. This is a very scary broadening of our attack surface. While the terminal app siting on your machine is decades old and has been tested extensively, the browser extension almost certainly has not. The browser extension, in addition to possibly having vulnerabilities itself, is executing in the context of the browser. The browser is a very scary place to be, because its whole mission in life is connecting to the untrusted, infected cesspool of the Internet and then doing what the Internet tells it to. By grace of God and Google engineers, we generally assume that our browsers aren't going to crack out of the sandbox surrounding the sandbox surrounding the sandbox that all that evil Internet stuff is executing in, but we expect that, in the normal course of operation, those inner sandboxes are going to fall into the hands of the enemy, repeatedly. It therefore seems to be an exceptionally bad idea to take our holiest-of-holy credentials and move them inside the sandbox, closer to the attackers. This is particularly true in terms of a risk/benefit analysis, since the risks are incredible and the only benefit is "Saves you from having to do a single key chord to pop open an additional terminal on your machine." This is moot if you have total confidence in the Chrome and Native Client teams to never have a mistake which lets someone, e.g., read arbitrary process memory. That's happened before -- Mark Dowd et al found it. That would be pretty sucky if it happened on a browser you logged into your bank, because the attacker can probably grab your cookie and banking session. It would be much worse, though, if it happened on a machine used by a bank sysadmin who unwisely decided to use a terminal within his browser, because why steal one session when you can just steal the bank? (n.b. Note how this is possible without causing Chrome to execute arbitrary code or defeating the OS's protections against Chrome doing stuff outside the Chrome-box.)

shazam 14y ago

I've been using this for some time already

etherealG 14y ago

how different is the actual security here from running chrome on a machine with the same private keys? is the sandboxing any less secure protecting extensions from each other as from the native os underneath chrome?

cubsink 14y ago

Anyone criticizing this should seriously take a look in the mirror. Do you use stuff like Google Analytics in production? Well grats, then Google already own your production webpages. You include a script from their servers that can be used like any XSS. If not, well if you do not use third party jsonp, hotlinking or stuff that can be used to take control of your production machine, well then you are granted by me to rant on SSH in your browser. Otherwise, please realize that they probably can do equal damage or worse through your hotlinked scripts.

pjmlp 14y ago

Browser plugins? No thanks, the browser is for documents. No need to install security holes.

Wintamute 14y ago
The browser is for documents that have ... many supporting files, a dynamic scripting language, access to native OS features, access to the GPU, ability to blit bitmapdata at highspeed, and more. "Documents" doesn't cover it ... I think its fair to say that these days the browser is for software.
- pjmlp 14y ago
  When I am not doing another web application for a customer that would be better having a desktop one, my browser is really only used for documents.
recursive 14y ago
1997 called.
- pjmlp 14y ago
  And it feels like sunshine.
- WayneDB 14y ago
  And they said that HTML/CSS/JS is still a kludgey solution for documents, apps and just about everything that it's being used for?

deleted 14y ago

[deleted]

guilloche 14y ago

If it is native-client, then it doesnot need to install. Why not just give us an url? I do not want this extension to pollute my chromium.

mrbill 14y ago

Not news - I've been using this ever since I got my Chromebook, 2-3 months ago.

brasic 14y ago

I wish this app could register itself as a handler for the ssh:// uri scheme [1]. [1] https://www.iana.org/assignments/uri-schemes/prov/ssh https://www.iana.org/assignments/uri-schemes/prov/ssh

millstone 14y ago

Gave it a try. I find the interface to be very confusing. For example, the opening screen has a button with text "[Del] Delete", but hitting the Delete key instead takes me back to the previous page instead of deleting anything, and clicking it doesn't do anything. It took me a while to figure out how to get it to try to make a connection - even though it says "Enter" you actually have to press Enter twice. It then took me to a page with a link to the FAQ, which I tried to click on, but the link was not clickable. Also, the clipboard behavior is incredibly irritating: selecting any text automatically copies it to the clipboard with a giant SELECTION COPIED popup. It's also inconsistent: double clicking anywhere flashes the same SELECTION COPIED, which turns out to be a lie. It doesn't actually modify my clipboard in this latter case. And when I actually hit Cmd-C, it unselects my selection (WHY?) (The FAQ claims I can "disable this by setting the copy-on-select preference to false, but I wasn't easily able to find a place for preferences. After some hunting, I found that I have to control click on the app from Chrome's "Apps" page to disable this.) Anyways it's been hung at "Loading NaCl plugin..." for the last ten minutes. Either it takes a long time to load, or I don't have the NaCl plugin installed, and so it just decided to hang instead of tell me. I tried to install it by googling "NaCl", and found the link https://developers.google.com/native-client/ https://developers.google.com/native-client/. Clicking "Get Started" tells me to download an SDK and work through the "Getting Started Tutorials." All this for an SSH connection? Anyways, it was overall a frustrating and confusing experience. I've now got four identical connection entries, none of which I can figure out how to delete, and none of which ever successfully connected to anything. Argh.

oakwhiz 14y ago
That's odd, it loaded up almost immediately for me, with little effort on my part.

martinced 14y ago

I realize this is convenient for people running Chrome on OS X but... The way I surf is simple: Chrome is installed from the .tgz and certainly not from the rpm or deb files (simply put: I don't need to be root to install Chrome and Chrome is confined to a single user account). The account I use for surfing is separated from the account from which I use SSH to access SSH servers. Should someone "root" Chrome while I surf the Web, he'd still need to find what is called a "local root exploit" to access what's in the other user accounts (for example, but not limited to, SSH keys). I think there's no way that, for me, moving SSH inside the browser would provide me more security than having Chrome not doing SSH and being in a separate (throwaway) user account. It seems to be, once again, trading conveniency in the name of security. I don't doubt it fits Google's plan to make Chrome the OS that said and so they'll of course tell you: "Nothing to see here, move along". Another concerning thing, depending on how it's done, it's that the potential to mount a "mocking bird" attack may be strong on this one. Mocking birds attack tend to not work well when you use MagicSysRQ to emit a keypress bypassing X, sending you to a text console, and doing your SSH magic. I realize security is a pain, but it would be great if people could still criticize quite critical security issues on HN without having everyone downplaying the ones criticizing as "redditers" (is that an insult?), contrarians, etc. I love HN. I love entrepreneurship. But I do love Bruce Schneier too and I consider security to be something very important. Yet here everytime an app that does "one master online password to store all your passwords" gets upvoted like mad just because it's a "startup" and just because it "runs on a smartphone". I understand that some of you may not like the "tone" of people using sarcasm to make a point but... They're still making a point and, very often, it's a valid point. So it would be great if people could come up with better arguments than simply name-calling the ones pointing out the security implications of apps / plugins / etc.

arcatek 14y ago
I don't see how installing from an archive is safer than using a package, can you develop ? From my understanding, Chrome is obviously not chrooted, so a local root exploit will be required in either case to access to the other accounts (since it will run with your current privileges). And actually it seems easier to corrupt a chrome extracted in the home directory, since an intruder would not require root credentials to inject some code into your chrome (and replacing every bank front page with fishing pages, for example).

niels_olson 14y ago

How does this compare to anyterm? I understand one's client-side and one's server-side, but aren't they both rather exposed?

of 14y ago

I usually have multiple PuTTY windows open to a couple different servers. I wish it was easier to have multiple SSH sessions going with this extension.

pla3rhat3r 14y ago

Hell to the yes!