Hacker News Reader

Comment by zmmmmm | Hacker News Reader

> The modern browser extension API has done a good job balancing extensibility with security

No, it hasn't. Almost every single extension I install tells me some variant of "This extension can intercept and modify all of your browsing traffic". That's not "well balanced", it's completely broken. This is happening clearly for extensions by well intentioned people that do not need those permissions. I can't help but cynically interpret the current situation as intentional on Google's part because having the security model be "trust Google to vet the extensions" happens to centralise all the power with them. If you can't trust an extension from the wild then they might as well not exist, right?

People laughed Java out of the browser because it took 500ms to start, but at least it had an actual security model.

View on HN

+1000

Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum.

And I'd also really like a way to track both injected scripts and elements so that they wouldn't be able to make any HTTP requests without additional permissions, not even an <img src="..."> tag if the src isn't just a data URL or local extension resource.

E.g. I want to be able to install an extension that stops YouTube videos from playing as soon as I navigate to the page, without worrying my entire browsing history or worse is being sent to a third-party.

>should be able to have their permissions limited by domain

Does Chrome not support this? One more reason not to use it.

https://i.imgur.com/CJT8zsE.png

It does. For instance, here are the domains my reddit app is allowed access to: https://i.imgur.com/lRetX62.png

The non-reddit domains are for expando capability.

> Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum.

This seems like a good idea until you realize that the behavior you might want to modify is coming from a different domain loaded by the page and you have no control over how they set that up.

So the app should ask for a permission to a reasonable set of domains, and when you're installing it, you should get a clearly laid out permissions / privacy risk management worksheet to look at and agree to.

That would indeed be nice, but currently the domain list is hardcoded in the json file.

Many sites use dozens of domains. Some (probably most) are ads, tracking, and the like. But much of it is stuff needed to run the site. I don't think there is a reasonable set of defaults other than things not on an ad blocker blacklist. And asking the user to approve each domain on a page is too much -- how would they decide, and how would they know which one prevented the site from working properly?

What if that's fundamentally a flawed way of building things? Maybe your site should provide all of the assets it needs...

It's certainly flawed, but providing all of the assets creates a different class of problems. Both approaches have pros and cons, plus the original comment I replied to passed it off as a solution to the problem at hand, which it's not.

> Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum.

They already can: extension authors can specify that their extension only operates on specific URL's.

The problem is that most extensions are designed to work on all web sites, so you have to choose between security and convenience.

Most users pick the latter and trust the former.

This model works pretty well overall since harmful extensions never take long before getting flagged by the community.

> This model works pretty well overall since harmful extensions never take long before getting flagged by the community.

No, this model works pretty well for stealthy extensions which take malicious actions without getting detected.

It also works well for normal useful extensions. We can figure out ways to eliminate stealthy malicious extensions without removing the most useful feature of extensions.

Nacho Analytics just shut down after slurping all full URLs from 2 million extension installs for over six months.

> Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum.

This would break adblockers, which are by far the most commonly used extensions

The standard for plugins on windows was for a long time "go to shady website and download a dll with arbitrary code. drop it in the magic folder to run it with full permissions"

I just had a horrid flashback to ActiveX plugin installation wizards in Windows 98...

extensions could just as easily modify executable you download, or source code.

>I can't help but cynically interpret the current situation as intentional on Google's part because having the security model be "trust Google to vet the extensions" happens to centralise all the power with them.

Isn't the situation the same with Mozilla? I thought that the reason was that most extensions do, in fact, need to be able to view and modify all your web browsing traffic. For example, my essential addons are uBlock origin, uMatrix, and Tree Tabs. Clearly the first needs to modify web pages, the second needs to intercept traffic, and the last needs the entire list of web pages I have open.

Can you give an example of an extension which requires permissions it shouldn't need?

I think there's a lot of room for finer-grained permissions. Why is it that removing (uBlock Origin), adding (Stylus), and modifying (Privacy Badger) elements all require the same permissions?

Because all three of those are, at the core, the very same thing? Whether removing, adding, or modifying, you're changing the contents of the HTML/CSS.

Whether it should be done in a more finely grained way, not sure, but if you have the permissions to modify then by definition you have the permission to remove or add content.

This is fear mongering. Every website could try 0-days exploits or drive-by downloads . Every app can abuse its permissions and track you/upload your photos/eavesdrop on your conversations. Every neighbor you have could spy on you through your windows/note when you come and go/follow you. Your grocery shop owner can poison your food. Etc etc. You can't blindly trust anything "from the wild" yet you can't really live without it. That's why we naturally do give trust by reputation, but at the same time remain vigilant.

>Every website could try 0-days exploits or drive-by downloads

That's an unfair comparison. Any piece of software could try and 0day you. The point is that in a permission-based system, the permissions for browser extensions are in practice far too permissive to the point of being broken.

>You can't blindly trust anything "from the wild" yet you can't really live without it.

The point about permissions is to provide granularity to trust. I may trust an app to use my camera without trusting it to track my location in the background.

>Every app can abuse its permissions and track you/upload your photos/eavesdrop on your conversations.

This is the best comparison - mobile phone permissions - and on this front browser extensions are far worse. The majority of every single extension I install wants complete control to everything. In contrast, most apps only require a few things as appropriate. Yes, there are those flashlight apps which require _every_ permission, and those are basically the standard of extensions.

It should be added that UXSS (basically a malicious extension) is basically an RCE in the browser which in some cases is more beneficial than a full RCE, e.g. easier to steal banking creds.

We still have locks on doors.

Recently I started an extension which ran into a need for that 'everything' permission. IIRC it has to do with tab management. I imagine browsers could limit requests for tab access by URL patterns, so not sure why they don't yet.

500ms to start but like flash, download site in 20s before anything but splash screen.

To me back in those days:

Java applet loading felt like 30 seconds of staring at a gray reactangle while your entire browser ui locks up, sometimes ending in "applet uninited"

Flash game loading was just a few seconds of a black rectangle, browser ui did not lock up, then custom loader, and it usually worked.

Reply on news.ycombinator.com