Comment by ignoramous | Hacker News Reader

Comment by ignoramous | Hacker News Reader

Extensions can be uninstalled, revoked, disabled at will. Can't really bend BigTech to do your biding, and that trumps whatever the security argument brings to the table, imo. Extensions should be done in a security friendly way [0], and not the other way around of making software secure by disabling all extensibility [1].

Take the example of the Android ecosystem: If plugins were allowed for apps, pretty sure there'd be a better story around privacy today. An astonishing 40% of connections from an Oppo/Vivo or Xiaomi phones are to ad networks and trackers. And there's nothing you could do (without root) except to firewall it (apps have started working around pi-hole esque setups). XposedMod has brought plugin based development to Android [2], but it is niche and requires not just root, but replacing key framework components. Using it might still be worth it, though, given the relentlessness of OEMs and carriers.

And that's just sad.

[0] One way to tackle the problem of developers selling away rights to their extensions is to legally make it binding to publicly declare whenever ownership changes hands. Disable extensions across all installs, and let the users enable after the fact is made obvious to them.

[1] https://www.eff.org/deeplinks/2019/06/adversarial-interopera...

[2] https://www.xda-developers.com/best-xposed-modules/

> If plugins were allowed for apps, pretty sure there'd be a better story around privacy today .

Honest question : Can you expand on how this would work please?

If anything, extensions as in chrome extensions is something I try to avoid as much as possible : giving access to all of my data to a third party extension promising that is going to increase my privacy but that I need to trust 100% with a complete access is less than ideal.

> Honest question : Can you expand on how this would work please?

Such a thing is already possible today. Some require root, some require breaking PlayStore's terms of use.

One such example is: XPrivacyLua [0] by the creator of NetGuard. It helps fake location data, hide contacts and calendar, fake device-id, IMEI, MAC addresses etc on a per-app basis.

Another example is how VPN in Android [1][2] is widely used to block trackers and ads.

A third example would be how the accessibility service APIs are (ab)used to temporary grant permissions to apps [3].

A fourth would be reversing engineering tools like Frida [4] that help with inspecting apps, and even change their behaviour.

A fifth is repackaging APKs with advertisement and tracking code removed, like with YouTube [5].

I am attempting to build an app with most of these features combined in to one, lets see how far I get. My aim is probably to build something as close as possible to uMatrix/uBlockOrigin but without requiring root.

---

[0] https://github.com/M66B/XPrivacyLua/blob/master/README.md

[1] https://github.com/M66B/NetGuard

[2] https://github.com/blokadaorg/blokada

[3] Sam Ruston's Bouncer app: https://samruston.co.uk/

[4] https://securitygrind.com/bypassing-android-ssl-pinning-with...

[5] https://youtubevanced.com/

I just want to add that Android has a barely documented feature "Resource Overlay", designed to allow OEMs to customize stuff. [0] is a quick tutorial, [1] a bit longer introduction. The focus on configuration instead of code should make security a bit easier. Obviously they made it near impossible for even more advanced users to use, so opening that up a bit would be a good first step...

[0] https://code.tutsplus.com/tutorials/quick-tip-theme-android-... [1] https://developer.sony.com/posts/sony-contributes-runtime-re...

None of these answer my question though.

Repackaging, leveraging a security flaw to use xposed, etc, all of these add more vectors that can compromise your data.

You need to have complete trust in the person that wrote these, way more trust than just in the creators of an app that can just use the permissions you give them :/

I agree. My point was the security risk is worth it if extensibility is achieved. I cited the example of browsers and content blockers.

There are many intrusive permissions that already are major privacy and security risks-- Launchers, SMS apps, VPNs, and even alarm clocks that mine location data. The playing ground isn't level, right now, to counter this intrusion.

One way to affect what other apps do, without root, is to route the traffic via VPN and firewall as appropriate. That's possible only when a user enables a VPN to do so. Similarly, the plugins could also require a user to explicitly grant or deny permission for them to work. This is enough of a security measure as its on par with the current system in Android (regardless of its notoriety).

> None of these answer my question though.

May be I understood you wrong. I hope I made my point clear to you above?

Sometimes I like to inspect the code of existing addons to look for malicious code. My first sweep is regexing through the code for any URLs which means checking for (http?s://) and the next step is looking for any code that is deliberately obfuscated.

I built http://sublim.nl/crxviewer/ to do exactly that -- load in an extension and view the source, including doing a search through all files.

Reply on news.ycombinator.com