Hacker News Reader

Comment by amelius | Hacker News Reader

Note: this plugin can read and change all the data on the websites you visit.

Extensions that do this terrify me. Imagine a popular Chrome extension, say, Fireshot, with 2 million active installs, selling out. The next update of the app gets shipped with a screen scraper that looks at coinbase.com. Some time after you've last visited your dashboard, it opens a connection on some entirely unrelated site and posts to the 'send' page to send all of your BTC to a third party address.

Or if you have 2FA enabled for sends, just intercept the send POST with an address of your choice, but display the user's originally input address on the confirmation screen. To make it even more confusing, keep a list of transactions:intended accounts so any time the user looks on _any_ bitcoin site it shows the transaction was going to the right account.

You can set a flag on Chrome (chrome://flags/#extension-active-script-permission) to block the extension by default and only activate it when you click the pageAction/browserAction or if you whitelist it (for that website only or for all websites).

Also, two extensions come in handy: "Chrome extension source viewer" [1] and "Extensions Update Notifier" [2] (self-descriptive titles). The second one can automatically disable extensions when they're updated.

They're honestly a little annoying if you have more than a handful of extensions since they lack some essential features (e.g. viewing a code diff from the previous version), but at least they're open source! :)

[1]: https://chrome.google.com/webstore/detail/chrome-extension-s...

[2]: https://chrome.google.com/webstore/detail/extensions-update-...

The bitcoin people will tell you that if you're using the same computer to browse the web as to hold a bitcoin wallet, you're doing it wrong.

(there are other conclusions one could reach from this, such as the disadvantages of being your own uninsured bank)

Isn't that how silk road guy got caught by the feds.

i thought he signed up for a forum with an email tied to his real life identity but used his previously anon handle

It was a StackOverflow question he posted while creating Silk Road, in which he used his real name (before switching to the "frosty" alias in under a minute).

And his SSH key had both the username and hostname set to that alias ("frosty@frosty"), which is how they connected him to Silk Road.

Specifically, it was this question: https://stackoverflow.com/questions/15445285/how-can-i-conne...

I always use incognito mode (disable all extensions) when visiting relevant sites. I wonder if it's enough.

We should try and be more sinister. Imagine a company purchases or influences a plugin so much that when a news article is read about E Corp dumping toxic waste into drinking water the content is changed to play down the numbers and sentiment.

Without reading the source, I reckon this is because not all Medium blogs are under medium.com subdomains, so you can't request access only to *.medium.com in the extension manifest.

This is the reason. The code does look for a specific appname that is present on all medium blogs before running the code. If this were a closed source extension I would worry about it, but since it's open source you can verify it's not doing anything malicious. That said, I think I will copy the source and turn it into a user script so I don't have to install another extension.

Can one verify if the published source is the same as the published extension?

Yes, Chrome extensions are just packaged code. No compiling or anything necessary.

However, Chrome will automatically update the extension.

Things that could go wrong:

* The author could wake up in a bad mood one day and decide to push a malicious update.

* The author's computer could be compromised, and someone could steal the signing keys and publish a malicious version of the extension.

* The author could get bored of the extension and transfer ownership to someone who offers to maintain it for them, but who turns out to be malicious.

* The author could be in need of some cash and could decide to accept one of the many offers they no doubt get from shady parties to buy their extension.

I'm sure the author of this extension would never do any of these things... but I'm not sure enough to risk it. :/

Open/close source is not going to help you here: nothing stops a malicious author from publishing one version open source while publishing the malicious one.

The only way to find out is to run the extension in Chrome and inspect it with the debugger.

One of the things I can’t understand as a Chrome user and developer is how limited your options for explicit extension permissions are. Either people will not install extensions (basically my case), or the Chrome team will teach people to ignore warnings and extensive permissions not unlike what we used to do with SSL/Mixed Content warnings. (Which I guess is what they already do on Android, but still.)

Firefox also had to learn about the vulnerability of Firefox extensions the hard way, but training users to scrutinize permissions would be a great opportunity.

One (perhaps sinister) explanation would be that Google really doesn't want people to install plugins, because they are often used to remove ads. Of course, Google wants Chrome to be an independent project, but this could explain why the issue doesn't get priority.

As someone else mentioned, this is so it works on custom domain publications, but you can verify in the source nothing nefarious is going on.

It's also on the list of issues to fix: https://github.com/thebaer/MMRA/issues/15

Can't any extension do this? They all insert javascript onto pages and they can interact with your browser directly. That's like saying "this extension can do exactly what every other extension can do".

An extension can only read/modify pages that it has explicitly requested to be able to read/modify in its manifest. In this case, the extension has requested to read/modidy "https://*/*" (which is necessary since Medium is often used to power other domains).

It is sadly true that most extensions which do anything useful end up needing to request permission to all web sites. And that's why I mostly refuse to use extensions...

Extensions can specify if they want read/change access to only one domain (or more). This extension could have specified medium.com alone.

Reply on news.ycombinator.com