11 ms·

Why Do Chrome Extensions Need to Access All My Data?

54 points by bradleybuda 14y ago

borisjabes 14y ago
A couple of notes on the article: 1. I'm really surprised legit vendors like LastPass don't become verified authors on the Chrome webstore; it's trivial to setup. We were able to do this for Meldium easily. 2. Joe's comments that it's hard to write an extension that steals data does not seem very true. Someone who is dedicated can do a lot with Javascript. 3. The author doesn't mention the model Mozilla follows with its addons: actual humans code review extensions to determine trustworthiness. They reject extensions containing obfuscated code for example.
- rictic 14y ago
  Agreed. It would be a rather short script to, e.g., send every js-accessible cookie on every site you visit up to a third party. It doesn't take a lot of code to capture a lot of high value data. The supposition that it does is quite strange.
deleted 14y ago
[deleted]
- celticjames 14y ago
  It does seem like an odd oversight that Chrome allows you to block plugins per site but not extensions. If you click the green lock in your address bar now, you can see the option to block all plugins. It stops java and flash, but allows extensions like adblock, etc to keep running on the page.
- dmethvin 14y ago
  Why pick on Chrome? How does this differ from extensions offered by Firefox or Internet Explorer? They all allow essentially similar behavior. Eventually it comes down to whether you trust the extension. If I'm running AdBlock it needs to be able to modify the HTML of any page and occasionally update its lists using the Internet. But AdBlock Extra Evil Edition might also be paid by someone to not block their ads or to leave beacons in place. A form filling application could potentially push evil information into a form and submit it before I could do anything. Or it may work the way I expect and only fill in data that I want to be filled. How do you allow the good stuff without also allowing the bad stuff?
  - borisjabes 14y ago
    This is definitely something that affects all browsers. That said, things are a little different with IE since it does not provide an extension marketplace or a fine-grained permissions model, which Chrome (and Firefox) do.
    - mcs 14y ago
      My bank requires firefox, for what I only assume to be for that reason.
    - aboodman 14y ago
      Firefox does not provide a fine-grained permission model for extensions.
hrwl 14y ago
Am I paranoid for not wanting to install any extensions in Chrome? There are some I'd like to use, Feedly is an example, but I can't get past the part of allowing them access to anything on any website. I would prefer something that lets you allow access on a case by case basis.
zspade 14y ago
Working in IT security at a large corp, this is exactly why we cannot allow install of Chrome on any machine in the firm.
- criley 14y ago
  It is possible to block the installation of Chrome extensions through group policy. http://www.chromium.org/administrators/policy-list-3 http://www.chromium.org/administrators/policy-list-3 You can whitelist and blacklist extensions, whitelist sources, force install extensions and block them by type only. It shouldn't be hard to prevent all extensions from running.
  - mustpax 14y ago
    It is downright scary how incompetent, indifferent and arrogant most IT organizations are. They are usually run by someone who's background is in procurement (i.e. buying things cheap) or compliance (i.e. lawyer). And if you try to explain something like this to them, they just DO NOT CARE.
- deleted 14y ago
  [deleted]
- joelthelion 14y ago
  Wide-ranging policies like this actually damage security as users will do anything to access the functionality that they want. Plus they will make users hate you.
  - freehunter 14y ago
    Security is about business enabling. We're here to help the business work efficiently, not to get in the way. Feature X might work nicer than Feature Y, but Feature X presents an unacceptable risk to the business. Users are going to demand Feature X even still. It's security's job to present these risks and it's up to the business to accept them or not. Policy is what you're talking about, and solid enforcement. If you don't have a way to ensure people are adhering to the policy, you're in a world of hurt because yes, they will do whatever they can to get the features they want.
r3m6 14y ago
The amazing thing here is: A few of my non-programmer friends told me that they would NEVER install a Chrome extension that can access all their data. At the same time, all of them have no issue at all to install a regular Windows application from, say, Download.com. They are surprised when I tell them that any Windows application can not only access all their data but could also format their hard drive... To cut a long story short: Google does a good job of educating users. Microsoft should follow (and innovate with a more fine grained security system).
- deleted 14y ago
  [deleted]
  - daeken 14y ago
    > Chrome extensions are worse than just "accessing all your data", since they actually inject code into running web apps en masse. At least with Windows, they'd have to patch a particular binary (and it's non-trivial to so). There's no need to patch binaries -- you can hook just about everything you want. Whether you want to intercept networking, file IO, or just about anything else, it's trivial with tools like Easyhook. A binary running under your account has complete control of everything happening under your account, in essence, and exercising that control is never hard.
joelthelion 14y ago
How do Firefox extension fare?
- msujaws 14y ago
  Extensions found at https://addons.mozilla.org/ https://addons.mozilla.org/ get reviewed by a human. If there are issues with the code (obfuscated, security risks, etc) the add-on is not approved.
VeejayRampay 14y ago
Hi, would someone be kind enough to explain why exactly the article and subsequent comments are limited to Chrome? Doesn't the very same problem exist with Firefox extensions / add-ons? After a quick online search, it seems that this problem is far from being a Chrome thing... [1] http://www.computerworld.com/s/article/9152578/Mozilla_confirms_infected_Firefox_add_ons_slipped_through_security http://www.computerworld.com/s/article/9152578/Mozilla_confi... [2] http://www.networkworld.com/columnists/2009/020309antonopoulos.html http://www.networkworld.com/columnists/2009/020309antonopoul...
- bpatrianakos 14y ago
  Because a reader asked a question specifically about Chrome. The article begins, "I'm a big fan of Google Chrome and I love using extensions. However, I've noticed that a lot of them request permissions to access all of my data on every site. Why is this?".
Silhouette 14y ago
On Windows, Chrome also deliberately circumvents the normal system security model, installing in the unprotected user directory rather than as a real application in order to allow its background updates. It also installs (silently, without permission, and for reasons unspecified) a Firefox plug-in, and it reinstalls/reactivates that plug-in even if the user has explicitly chosen to disable it. It amazes me that Google seem to get such a free ride with Chrome. A lot of the things it does are either indistinguishable from a lot of the things that malware does or leaving itself wide open to compromise if malware gets onto a system by some other mechanism.
- deleted 14y ago
  [deleted]
- jmillikin 14y ago
  > [Chrome] also installs (silently, without permission, > and for reasons unspecified) a Firefox plug-in, and it > reinstalls/reactivates that plug-in even if the user has > explicitly chosen to disable it. Could you elaborate more on this? Most of my machines have both Chrome and Firefox installed, but I don't see any unexpected or Chrome-related plugins in Firefox. A web search for [chrome installs firefox plugin] also turns up no relevant hits.
  - Silhouette 14y ago
    Interesting. Right now I'm looking at a Firefox plug-in called Google Update 1.3.21.135 in Firefox, which I recently disabled (again) because it offers no uninstall option. I certainly didn't put it there myself, nor have I ever knowingly approved it. I just checked, and a similar plug-in has been installed on every other machine we've got handy. Is it possible that you've got something installed that somehow blocks this? It's been happening for years for us, causing much gnashing of teeth. [Edit] Here's a link describing the plug-in: http://superuser.com/questions/156913/what-is-the-google-update-firefox-add-on http://superuser.com/questions/156913/what-is-the-google-upd...
    - nivla 14y ago
gingerlime 14y ago
This is also true for android apps. They ask for permissions that are very hard to figure out as a user. When the user is faced with two options: 1. Click Ok and get started with this app that looks cool. 2. Click No, and go back to the previous screen without the app. The choice becomes pretty obvious. My wife simply ignores it and clicks ok. I'm sure most users do the same after the first or second app they install and from then on it becomes a reflex response. Install. Ok. Ok.
- IheartApplesDix 14y ago
  Woe is the poor user, who is forced to make do with a free app that violates his privacy. Woe is the poor programmer, who is forced to offer his app for free. I mean, their is obviously no other solution. We should just quit complaining about it.
  - mehrzad 14y ago
    >their is obviously no other solution I don't like it in games, but for applications a freemium model (I hate the buzzword too) seems to be best for developers. Charge for extra features, like Instapaper, App.net, etc. Or go the route of free without ads and hope that the goodwill leads to recognition and donations.
    - IheartApplesDix 14y ago
      Freemium is best for software firms with accounting departments, not developers, and not users. 99% of people writing software do not work for Valve or Google. If you are writing quality software, charge for it and people will pay for it. If you're porting another butt scratching tip calculator with twitter integration, then perhaps freemium is just the 5th buzzword you need to get that billion dollar eval.
andyl 14y ago
I don't trust Chrome with sensitive data. It's not that Firefox is so much better. But Mozilla doesn't have Google's motive or ability to cross-correlate data-streams.
Mahn 14y ago
No one would likely be able to cram enough code into a single plugin to manage to get "all" your information and still have a functioning plugin in only JavaScript. Does not compute. I don't see the logic in this statement.
- borisjabes 14y ago
  Agreed, that's definitely the weakest statement in the article. Mozilla does a better job here by having human editors review extension code.
- OGinparadise 14y ago
  I think he meant to say that they ask for so much data that no single plugin can use it all.
crandles 14y ago
I think it would be beneficial for Chrome (Android as well) to allow for an app to have a dynamic set of permissions. Instead of requiring all web access just so an app can perform an action on any page (when you decide for it to) - what if a specific user action could grant temporary/permanent access to a domain? E.g. Clicking an icon if the app is in the toolbar, or selecting a certain action from a menu. Chrome has a way to prompt for temporary permissions - but this brings up an alert box, and that is never ideal, it would be nice if the user interaction could be taken for permission. edit: apparently its in beta (https://news.ycombinator.com/item?id=5383011 https://news.ycombinator.com/item?id=5383011)
- gizmo686 14y ago
  Other features I wish Android's security model has are 'soft permissions', and 'pseudo permissions'. Soft permissions would be where an app can function without permission, but has feature(s) that require it. For example, if I install a game, I should be able to play it without giving it internet access. However, if they want to have a online high-score system they must require that I give them internet access in order to install the app; Pseudo permissions would be where the app thinks it has permission to use something, but it is really receiving bogus data. For example, say an app 'requires' access to my phones GPS system (when such access is not critical to the function of the app), it would appear to the app that it has access, but the data it receives would not corralate to the actually data. I think I recall seeing a project to implement both of these features in Android, but I do not recall what it is called.
nooneelse 14y ago
Perhaps all data access by extensions should be logged. It wouldn't be of much interest to most programming laymen, but it would be more accessible/understandable than pointing them to Extension Gallery and Web Store Inspector so they can look at the code. I wouldn't recognize well obfuscated code that can grab my CC#, but I can recognize the number itself just fine. At the least, it would let everyone know that their extension's activities are being watched. And laymen knowing that extension authors know that this activity is watched would be reassuring to the laymen. Could such logging be done by a separate extension?
jonknee 14y ago
Chrome is addressing this with a feature that grants access on a temporary basis to the active tab. This is a great improvement for many types of extensions. http://developer.chrome.com/beta/extensions/activeTab.html http://developer.chrome.com/beta/extensions/activeTab.html > The activeTab permission gives an extension temporary access to the currently active tab when the user invokes the extension - for example by clicking its browser action. Access to the tab lasts until the tab is navigated or closed. > The main benefit of the activeTab permission is that it displays no warning message during installation.
cickpass_broken 14y ago
For any Extension developers, there are some workarounds to avoid asking for the "tabs" permission. If you just need to know when a tab is visible for your content scripts to do things, use the Page Visibility API[1]. If you want your Extensions background scripts to notify all content scripts of something, you can rely on `chrome.storage.onChanged` event. The storage API does not warn users about permissions[2] If anyone's interested in code samples, I could through some snippets in a gist. [1] http://www.w3.org/TR/2011/WD-page-visibility-20110602/#sec-page-visibility http://www.w3.org/TR/2011/WD-page-visibility-20110602/#sec-p... [2] http://developer.chrome.com/extensions/permission_warnings.html#nowarning http://developer.chrome.com/extensions/permission_warnings.h...

54 points by bradleybuda 14y ago

A couple of notes on the article: 1. I'm really surprised legit vendors like LastPass don't become verified authors on the Chrome webstore; it's trivial to setup. We were able to do this for Meldium easily. 2. Joe's comments that it's hard to write an extension that steals data does not seem very true. Someone who is dedicated can do a lot with Javascript. 3. The author doesn't mention the model Mozilla follows with its addons: actual humans code review extensions to determine trustworthiness. They reject extensions containing obfuscated code for example.

rictic 14y ago
Agreed. It would be a rather short script to, e.g., send every js-accessible cookie on every site you visit up to a third party. It doesn't take a lot of code to capture a lot of high value data. The supposition that it does is quite strange.

deleted 14y ago

[deleted]

celticjames 14y ago
It does seem like an odd oversight that Chrome allows you to block plugins per site but not extensions. If you click the green lock in your address bar now, you can see the option to block all plugins. It stops java and flash, but allows extensions like adblock, etc to keep running on the page.
dmethvin 14y ago
Why pick on Chrome? How does this differ from extensions offered by Firefox or Internet Explorer? They all allow essentially similar behavior. Eventually it comes down to whether you trust the extension. If I'm running AdBlock it needs to be able to modify the HTML of any page and occasionally update its lists using the Internet. But AdBlock Extra Evil Edition might also be paid by someone to not block their ads or to leave beacons in place. A form filling application could potentially push evil information into a form and submit it before I could do anything. Or it may work the way I expect and only fill in data that I want to be filled. How do you allow the good stuff without also allowing the bad stuff?
- borisjabes 14y ago
  This is definitely something that affects all browsers. That said, things are a little different with IE since it does not provide an extension marketplace or a fine-grained permissions model, which Chrome (and Firefox) do.
  - mcs 14y ago
    My bank requires firefox, for what I only assume to be for that reason.
  - aboodman 14y ago
    Firefox does not provide a fine-grained permission model for extensions.

hrwl 14y ago

Am I paranoid for not wanting to install any extensions in Chrome? There are some I'd like to use, Feedly is an example, but I can't get past the part of allowing them access to anything on any website. I would prefer something that lets you allow access on a case by case basis.

zspade 14y ago

Working in IT security at a large corp, this is exactly why we cannot allow install of Chrome on any machine in the firm.

criley 14y ago
It is possible to block the installation of Chrome extensions through group policy. http://www.chromium.org/administrators/policy-list-3 http://www.chromium.org/administrators/policy-list-3 You can whitelist and blacklist extensions, whitelist sources, force install extensions and block them by type only. It shouldn't be hard to prevent all extensions from running.
- mustpax 14y ago
  It is downright scary how incompetent, indifferent and arrogant most IT organizations are. They are usually run by someone who's background is in procurement (i.e. buying things cheap) or compliance (i.e. lawyer). And if you try to explain something like this to them, they just DO NOT CARE.
deleted 14y ago
[deleted]
joelthelion 14y ago
Wide-ranging policies like this actually damage security as users will do anything to access the functionality that they want. Plus they will make users hate you.
- freehunter 14y ago
  Security is about business enabling. We're here to help the business work efficiently, not to get in the way. Feature X might work nicer than Feature Y, but Feature X presents an unacceptable risk to the business. Users are going to demand Feature X even still. It's security's job to present these risks and it's up to the business to accept them or not. Policy is what you're talking about, and solid enforcement. If you don't have a way to ensure people are adhering to the policy, you're in a world of hurt because yes, they will do whatever they can to get the features they want.

r3m6 14y ago

The amazing thing here is: A few of my non-programmer friends told me that they would NEVER install a Chrome extension that can access all their data. At the same time, all of them have no issue at all to install a regular Windows application from, say, Download.com. They are surprised when I tell them that any Windows application can not only access all their data but could also format their hard drive... To cut a long story short: Google does a good job of educating users. Microsoft should follow (and innovate with a more fine grained security system).

deleted 14y ago
[deleted]
- daeken 14y ago
  > Chrome extensions are worse than just "accessing all your data", since they actually inject code into running web apps en masse. At least with Windows, they'd have to patch a particular binary (and it's non-trivial to so). There's no need to patch binaries -- you can hook just about everything you want. Whether you want to intercept networking, file IO, or just about anything else, it's trivial with tools like Easyhook. A binary running under your account has complete control of everything happening under your account, in essence, and exercising that control is never hard.

joelthelion 14y ago

How do Firefox extension fare?

msujaws 14y ago
Extensions found at https://addons.mozilla.org/ https://addons.mozilla.org/ get reviewed by a human. If there are issues with the code (obfuscated, security risks, etc) the add-on is not approved.

VeejayRampay 14y ago

Hi, would someone be kind enough to explain why exactly the article and subsequent comments are limited to Chrome? Doesn't the very same problem exist with Firefox extensions / add-ons? After a quick online search, it seems that this problem is far from being a Chrome thing... [1] http://www.computerworld.com/s/article/9152578/Mozilla_confirms_infected_Firefox_add_ons_slipped_through_security http://www.computerworld.com/s/article/9152578/Mozilla_confi... [2] http://www.networkworld.com/columnists/2009/020309antonopoulos.html http://www.networkworld.com/columnists/2009/020309antonopoul...

bpatrianakos 14y ago
Because a reader asked a question specifically about Chrome. The article begins, "I'm a big fan of Google Chrome and I love using extensions. However, I've noticed that a lot of them request permissions to access all of my data on every site. Why is this?".

Silhouette 14y ago

On Windows, Chrome also deliberately circumvents the normal system security model, installing in the unprotected user directory rather than as a real application in order to allow its background updates. It also installs (silently, without permission, and for reasons unspecified) a Firefox plug-in, and it reinstalls/reactivates that plug-in even if the user has explicitly chosen to disable it. It amazes me that Google seem to get such a free ride with Chrome. A lot of the things it does are either indistinguishable from a lot of the things that malware does or leaving itself wide open to compromise if malware gets onto a system by some other mechanism.

deleted 14y ago
[deleted]
jmillikin 14y ago
> [Chrome] also installs (silently, without permission, > and for reasons unspecified) a Firefox plug-in, and it > reinstalls/reactivates that plug-in even if the user has > explicitly chosen to disable it. Could you elaborate more on this? Most of my machines have both Chrome and Firefox installed, but I don't see any unexpected or Chrome-related plugins in Firefox. A web search for [chrome installs firefox plugin] also turns up no relevant hits.
- Silhouette 14y ago
  Interesting. Right now I'm looking at a Firefox plug-in called Google Update 1.3.21.135 in Firefox, which I recently disabled (again) because it offers no uninstall option. I certainly didn't put it there myself, nor have I ever knowingly approved it. I just checked, and a similar plug-in has been installed on every other machine we've got handy. Is it possible that you've got something installed that somehow blocks this? It's been happening for years for us, causing much gnashing of teeth. [Edit] Here's a link describing the plug-in: http://superuser.com/questions/156913/what-is-the-google-update-firefox-add-on http://superuser.com/questions/156913/what-is-the-google-upd...
  - nivla 14y ago

gingerlime 14y ago

This is also true for android apps. They ask for permissions that are very hard to figure out as a user. When the user is faced with two options: 1. Click Ok and get started with this app that looks cool. 2. Click No, and go back to the previous screen without the app. The choice becomes pretty obvious. My wife simply ignores it and clicks ok. I'm sure most users do the same after the first or second app they install and from then on it becomes a reflex response. Install. Ok. Ok.

IheartApplesDix 14y ago
Woe is the poor user, who is forced to make do with a free app that violates his privacy. Woe is the poor programmer, who is forced to offer his app for free. I mean, their is obviously no other solution. We should just quit complaining about it.
- mehrzad 14y ago
  >their is obviously no other solution I don't like it in games, but for applications a freemium model (I hate the buzzword too) seems to be best for developers. Charge for extra features, like Instapaper, App.net, etc. Or go the route of free without ads and hope that the goodwill leads to recognition and donations.
  - IheartApplesDix 14y ago
    Freemium is best for software firms with accounting departments, not developers, and not users. 99% of people writing software do not work for Valve or Google. If you are writing quality software, charge for it and people will pay for it. If you're porting another butt scratching tip calculator with twitter integration, then perhaps freemium is just the 5th buzzword you need to get that billion dollar eval.

andyl 14y ago

I don't trust Chrome with sensitive data. It's not that Firefox is so much better. But Mozilla doesn't have Google's motive or ability to cross-correlate data-streams.

Mahn 14y ago

No one would likely be able to cram enough code into a single plugin to manage to get "all" your information and still have a functioning plugin in only JavaScript. Does not compute. I don't see the logic in this statement.

borisjabes 14y ago
Agreed, that's definitely the weakest statement in the article. Mozilla does a better job here by having human editors review extension code.
OGinparadise 14y ago
I think he meant to say that they ask for so much data that no single plugin can use it all.

crandles 14y ago

I think it would be beneficial for Chrome (Android as well) to allow for an app to have a dynamic set of permissions. Instead of requiring all web access just so an app can perform an action on any page (when you decide for it to) - what if a specific user action could grant temporary/permanent access to a domain? E.g. Clicking an icon if the app is in the toolbar, or selecting a certain action from a menu. Chrome has a way to prompt for temporary permissions - but this brings up an alert box, and that is never ideal, it would be nice if the user interaction could be taken for permission. edit: apparently its in beta (https://news.ycombinator.com/item?id=5383011 https://news.ycombinator.com/item?id=5383011)

gizmo686 14y ago
Other features I wish Android's security model has are 'soft permissions', and 'pseudo permissions'. Soft permissions would be where an app can function without permission, but has feature(s) that require it. For example, if I install a game, I should be able to play it without giving it internet access. However, if they want to have a online high-score system they must require that I give them internet access in order to install the app; Pseudo permissions would be where the app thinks it has permission to use something, but it is really receiving bogus data. For example, say an app 'requires' access to my phones GPS system (when such access is not critical to the function of the app), it would appear to the app that it has access, but the data it receives would not corralate to the actually data. I think I recall seeing a project to implement both of these features in Android, but I do not recall what it is called.

nooneelse 14y ago

Perhaps all data access by extensions should be logged. It wouldn't be of much interest to most programming laymen, but it would be more accessible/understandable than pointing them to Extension Gallery and Web Store Inspector so they can look at the code. I wouldn't recognize well obfuscated code that can grab my CC#, but I can recognize the number itself just fine. At the least, it would let everyone know that their extension's activities are being watched. And laymen knowing that extension authors know that this activity is watched would be reassuring to the laymen. Could such logging be done by a separate extension?

jonknee 14y ago

Chrome is addressing this with a feature that grants access on a temporary basis to the active tab. This is a great improvement for many types of extensions. http://developer.chrome.com/beta/extensions/activeTab.html http://developer.chrome.com/beta/extensions/activeTab.html > The activeTab permission gives an extension temporary access to the currently active tab when the user invokes the extension - for example by clicking its browser action. Access to the tab lasts until the tab is navigated or closed. > The main benefit of the activeTab permission is that it displays no warning message during installation.

cickpass_broken 14y ago

For any Extension developers, there are some workarounds to avoid asking for the "tabs" permission. If you just need to know when a tab is visible for your content scripts to do things, use the Page Visibility API[1]. If you want your Extensions background scripts to notify all content scripts of something, you can rely on `chrome.storage.onChanged` event. The storage API does not warn users about permissions[2] If anyone's interested in code samples, I could through some snippets in a gist. [1] http://www.w3.org/TR/2011/WD-page-visibility-20110602/#sec-page-visibility http://www.w3.org/TR/2011/WD-page-visibility-20110602/#sec-p... [2] http://developer.chrome.com/extensions/permission_warnings.html#nowarning http://developer.chrome.com/extensions/permission_warnings.h...