Hacker News Reader

Comment by crazygringo | Hacker News Reader

+1000

Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum.

And I'd also really like a way to track both injected scripts and elements so that they wouldn't be able to make any HTTP requests without additional permissions, not even an <img src="..."> tag if the src isn't just a data URL or local extension resource.

E.g. I want to be able to install an extension that stops YouTube videos from playing as soon as I navigate to the page, without worrying my entire browsing history or worse is being sent to a third-party.

View on HN

> Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum.

They already can: extension authors can specify that their extension only operates on specific URL's.

The problem is that most extensions are designed to work on all web sites, so you have to choose between security and convenience.

Most users pick the latter and trust the former.

This model works pretty well overall since harmful extensions never take long before getting flagged by the community.

> This model works pretty well overall since harmful extensions never take long before getting flagged by the community.

No, this model works pretty well for stealthy extensions which take malicious actions without getting detected.

It also works well for normal useful extensions. We can figure out ways to eliminate stealthy malicious extensions without removing the most useful feature of extensions.

Nacho Analytics just shut down after slurping all full URLs from 2 million extension installs for over six months.

> Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum.

This seems like a good idea until you realize that the behavior you might want to modify is coming from a different domain loaded by the page and you have no control over how they set that up.

So the app should ask for a permission to a reasonable set of domains, and when you're installing it, you should get a clearly laid out permissions / privacy risk management worksheet to look at and agree to.

That would indeed be nice, but currently the domain list is hardcoded in the json file.

Many sites use dozens of domains. Some (probably most) are ads, tracking, and the like. But much of it is stuff needed to run the site. I don't think there is a reasonable set of defaults other than things not on an ad blocker blacklist. And asking the user to approve each domain on a page is too much -- how would they decide, and how would they know which one prevented the site from working properly?

What if that's fundamentally a flawed way of building things? Maybe your site should provide all of the assets it needs...

It's certainly flawed, but providing all of the assets creates a different class of problems. Both approaches have pros and cons, plus the original comment I replied to passed it off as a solution to the problem at hand, which it's not.

>should be able to have their permissions limited by domain

Does Chrome not support this? One more reason not to use it.

https://i.imgur.com/CJT8zsE.png

It does. For instance, here are the domains my reddit app is allowed access to: https://i.imgur.com/lRetX62.png

The non-reddit domains are for expando capability.

> Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum.

This would break adblockers, which are by far the most commonly used extensions

Reply on news.ycombinator.com