4 ms·

There's a comment on the Chromium blog [1] (via magicalist's comment [2]) that nails this: if security is all they cared about, a signed certificate is all that

by Zikes 13y ago

There's a comment on the Chromium blog [1] (via magicalist's comment [2]) that nails this: if security is all they cared about, a signed certificate is all that's necessary. Knowing that option exists and persisting with their store-only approach means they must have an ulterior motive of some sort, most likely control and money. Ad blockers that target Google Ads will be no more, as well as anything else that the user might want to use to subvert or circumvent. Extensions will also have to adhere to Google's moral code, and developers will once again be beholden to a greater authority in order to operate their business. Just like with Facebook and the Apple app store, if you build a business on Google Chrome Extensions you now face having the plug pulled at any time for any reason, with absolutely no recourse. [1] http://blog.chromium.org/2013/11/protecting-windows-users-from-malicious.html http://blog.chromium.org/2013/11/protecting-windows-users-fr... [2] https://news.ycombinator.com/user?id=magicalist https://news.ycombinator.com/user?id=magicalist

deleted 13y ago
[deleted]
jfoster 13y ago
Would a signed certificate approach allow them to deny extensions, or not? If yes, they could still deny ad blockers that way. If no, it is a weaker form of security than this is.
- Zikes 13y ago
  The alleged reasoning is to stop malware. A signed certificate must come from an authority willing to put their own reputation on the line, but Google does not need to be the only such authority.
  - jfoster 13y ago
    So the extension being installed on some malicious site would have a popup talking about security certificates and such, and asking the user whether they want to proceed? You and I might think twice, but most users just click "Yes". Signed certificates would not be adequate to protect the average user.
    - Zikes 13y ago
      The idea is that the browser would only accept signed certificates, and only those certificates which the signing authority has not revoked. So long as the signing authority is in a trusted list, the user would see no Yes/No option at all. It would simply install, or be rejected outright with an explanation of why. It would be like limiting web browsing to HTTPS only, except you would not be given the option to click through for unsigned certificates.
      - jfoster 13y ago
        So then Google could still revoke the certificates of any ad blocking software.
  - haberman 13y ago
    Great! I am the "Definitely Not A Malware Author" certificate authority and I have signed this "Definitely Not Malware" extension.
    - sirsar 13y ago
      Not quite. The DNAMA would quickly lose hard-won reputation once DNM was shown to be malware. Google not being the only CA doesn't mean everyone gets to be a CA.
      - haberman 13y ago
        > Not quite. The DNAMA would quickly lose hard-won reputation once DNM was shown to be malware. No problem. I am a completely different "Definitely Not A Malware Author 2" certificate authority and I have signed this "Definitely Not Malware" extension. > Google not being the only CA doesn't mean everyone gets to be a CA. Oh. In that case who gets to decide who gets to be a CA?
        JSadowski 13y ago
        Who decides who gets to be a CA for SSL certs? Similar process. Somehow my browser doesn't recognize a CA that would allow any random person to pretend to be Facebook.
        haberman 13y ago
        The web browser authors/distributors decide what root CAs will be included in their browsers. So in this case concerning Chrome, Google decides. Which means Google is still in charge, ultimately. Which means that this digital signature scheme hasn't actually accomplished anything.
        Zikes 13y ago
        Google controls the entire browser, meaning they are in absolute control, ultimately. They could inject code into your banking web sites, they could block all the porn, whatever they want. The idea isn't that the certificates would wrest control away from Google, it's that they wouldn't be able to use "omg the malwares" as a shield for their intentions. If there's a root CA that's handing out certs for malware extensions then sure, pull the plug, but if the root CA is handing out certs for ad blockers and Google pulls the plug then it'll be plain as day what they're doing. Heck, all the browsers nowadays use extensions of some sort, maybe they could form a consortium for extension certifications so no one company would be in complete control. You could bet Mozilla would keep that sort of behavior in check, at least.
Mindless2112 13y ago
Another option would be to allow untrusted extensions like the Android setting for "Allow untrusted sources" for installing apps. Of course the problem with that route is preventing any unwanted-extension installer from maliciously enabling that option itself.

by Zikes 13y ago

deleted 13y ago

[deleted]

jfoster 13y ago

Would a signed certificate approach allow them to deny extensions, or not? If yes, they could still deny ad blockers that way. If no, it is a weaker form of security than this is.

Zikes 13y ago
The alleged reasoning is to stop malware. A signed certificate must come from an authority willing to put their own reputation on the line, but Google does not need to be the only such authority.
- jfoster 13y ago
  So the extension being installed on some malicious site would have a popup talking about security certificates and such, and asking the user whether they want to proceed? You and I might think twice, but most users just click "Yes". Signed certificates would not be adequate to protect the average user.
  - Zikes 13y ago
    The idea is that the browser would only accept signed certificates, and only those certificates which the signing authority has not revoked. So long as the signing authority is in a trusted list, the user would see no Yes/No option at all. It would simply install, or be rejected outright with an explanation of why. It would be like limiting web browsing to HTTPS only, except you would not be given the option to click through for unsigned certificates.
    - jfoster 13y ago
      So then Google could still revoke the certificates of any ad blocking software.
- haberman 13y ago
  Great! I am the "Definitely Not A Malware Author" certificate authority and I have signed this "Definitely Not Malware" extension.
  - sirsar 13y ago
    Not quite. The DNAMA would quickly lose hard-won reputation once DNM was shown to be malware. Google not being the only CA doesn't mean everyone gets to be a CA.
    - haberman 13y ago
      > Not quite. The DNAMA would quickly lose hard-won reputation once DNM was shown to be malware. No problem. I am a completely different "Definitely Not A Malware Author 2" certificate authority and I have signed this "Definitely Not Malware" extension. > Google not being the only CA doesn't mean everyone gets to be a CA. Oh. In that case who gets to decide who gets to be a CA?
      - JSadowski 13y ago
        Who decides who gets to be a CA for SSL certs? Similar process. Somehow my browser doesn't recognize a CA that would allow any random person to pretend to be Facebook.
        haberman 13y ago
        The web browser authors/distributors decide what root CAs will be included in their browsers. So in this case concerning Chrome, Google decides. Which means Google is still in charge, ultimately. Which means that this digital signature scheme hasn't actually accomplished anything.
        Zikes 13y ago
        Google controls the entire browser, meaning they are in absolute control, ultimately. They could inject code into your banking web sites, they could block all the porn, whatever they want. The idea isn't that the certificates would wrest control away from Google, it's that they wouldn't be able to use "omg the malwares" as a shield for their intentions. If there's a root CA that's handing out certs for malware extensions then sure, pull the plug, but if the root CA is handing out certs for ad blockers and Google pulls the plug then it'll be plain as day what they're doing. Heck, all the browsers nowadays use extensions of some sort, maybe they could form a consortium for extension certifications so no one company would be in complete control. You could bet Mozilla would keep that sort of behavior in check, at least.

Mindless2112 13y ago

Another option would be to allow untrusted extensions like the Android setting for "Allow untrusted sources" for installing apps. Of course the problem with that route is preventing any unwanted-extension installer from maliciously enabling that option itself.