Hacker News Reader

Comment by the_duke | Hacker News Reader

The issue with Chrome extensions, just like with android apps, is that people never check the permissions and just click OK.

Extensions make it even easier to install them, though, just need to redirect a user.

I've also come upon some spam sites that try to get you to install extensions with annoying alerts that prevent you from closing the page, playing a recorded message "To close the page, just install the XX extension".

The only remedy is good screening in the app stores. Actually, for apps/extensions installed from the official repository, I would be OK with remote removal. This would probably spark an outcry from certain parties, but as long as it does not extend to manually installed extensions it's acceptable to me.

View on HN

I remain baffled that alerts in modern browsers are still handled with an OS-level modal dialog that prevents interaction with the browser's interface elements.

Couldn't the alert instead be rendered as an overlay to the page itself, be modal to just that tab, and not disable the browser Chrome? This would make it much harder for pages to "trap" users with alert spam. The existing policies (don't allow this page to create more dialogs -> page instantly redirects to itself to reset the flag) aren't doing a good enough job.

That's at least what Firefox does.

> Couldn't the alert instead be rendered as an overlay to the page itself, be modal to just that tab, and not disable the browser Chrome?

Firefox and Safari do exactly that.

> The existing policies (don't allow this page to create more dialogs -> page instantly redirects to itself to reset the flag) aren't doing a good enough job.

Does that work? I've never seen any pages that circumvent alert blocking like that, and I'd have imagined that any sensible implementation would disable alerts for the entire session (or at least a few minutes).

I don't know what the exact exploit of the behavior is, but I've observed it on several "infected" computers while working in tech support. I've seen it on Internet Explorer, Microsoft Edge, Google Chrome, and some variation of it on Safari, all of which I was only able to remedy by forcefully closing the browser using the task manager or equivalent.

Truthfully, I have not actually observed this behavior on Firefox, and I'm quite thankfully no longer in the business of providing technical support to personal computer users, so hopefully I never will.

Firefox and Safari already don't use the OS modal dialog and Chrome is working on it

https://docs.google.com/document/d/1wtV5rmLhbf1OZkbg7crtCt6h...

I had my words at an Edge developer about this problem, and they seemed at least interested in my feedback. So here's hoping Edge fixes this too.

I do read the permissions for Android apps - they all want permissions to everything. For no good reason. Enter apathy

BlackBerry allowed fine-grained permissions, and this was 7-8 years ago. But rooted phone, Xposed and Xprivacy brings this feature to Android.

There is a very good reason. Apps can auto-update (the default) if they haven't added permissions over the previous versions. Consequently it is very common practise to add every permission you can conceive of using at the beginning, versus having to support a large body of users who haven't updated your app in ages.

In theory some very recent barely used newer Android version fixes this by asking for permissions at first use of them (eg first time using camera or first time accessing contacts). In practise this doesn't matter for several years.

I was corrected on Twitter by Will Harris, who works on Chrome security, and it turns out that remote removal actually is in place for extensions that have been blacklisted from the official repository. I've added a small addendum correcting this.

I was under the impression all chrome extensions had to go through the chrome web store now. I don't think you can manually install them anymore (outside of installing in developer mode). I could be wrong though.

This is true. They've actually made it difficult to do even with Developer Mode active, which is probably a net win.

Obviously there's no net win, given that TFA is talking about extensions distributed on Chrome's Web Store, infecting over 130000 users before it was banned.

That kind of proves the walled garden is pretty ineffective, the only accomplishment being the lock-in of users to Google's Web Store as the sole distribution mechanism, thus keeping Chrome a proprietary platform, in spite of the open-source nature of its code.

The only real advantage of the web store is the ability to uninstall banned extensions. But that could have been accomplished just as well by digital signing of the distributed packages.

Yes, and Web Store only has problems if you want to keep stuff internal ('enterprise' distribution).

This does seem like a total mess.

It's so annoying - on Windows, you can't even prevent Chrome from complaining every time you start it up when you have Developer Mode (and unpacked extensions) active. On Linux it doesn't, fortunately. I just want to use my own extension and it's not something that others would benefit from.

I even tried to put my extension up on the Web Store just because of this but I gave up once my (obviously valid) credit card got rejected. Now I just live with it.

They do, but Google's policing of the web store is an absolute joke. Tell it at parties, people will laugh.

I've reported malicious extensions and a year later they're still there racking up installs.

Most useful extensions require access to all sites so permissions system isn't very helpful at all.

I agree. I think that there could be more finely grained permissions. I basically have so sigh and resign myself anytime I want an extension badly enough.

> Most useful extensions require access to all sites

That may be true for "always-running" extensions like ad blockers, but there's another useful class of "on-demand" extensions that don't need full access -- think Evernote or Pinboard clippers. They only need access to the one site you're looking at, and only when you invoke them.

Chrome added a tightly-scoped "activeTab" permission a few years back, for exactly this case. Before that, on-demand extensions did need all-sites access, and unfortunately a lot of extensions (and tutorials and example code) haven't been updated.

https://developer.chrome.com/extensions/activeTab

Doesn't the keyboard command to close the tab/window work in these cases? Thankfully, I've never encountered such BS.

Reply on news.ycombinator.com