Hacker News Reader

Comment by gkoberger | Hacker News Reader

(EDIT: The extension is back up!)

I used to work on Mozilla's Add-ons store, and god I hate the reviews. Mozilla used to do them manually. I WORKED there, and wasn't able to get unblocked (for an extension used by almost everyone at Mozilla) because I was using jQuery... which was started by a guy who ALSO worked at Mozilla. So I feel ya completely.

The only thing I'll say is... Extensions have a scary level of access (they're basically almost as easy to use as a website, but with unlimited powers such as recording every site you visit and stealing passwords), and the average user will never understand that. The source code is hidden and updates are pushed to users silently, so a compromised GitHub account could result in a huge hack of everyone's everything. They're far more dangerous than a malicious iPhone app in Apple's app store.

Luckily, this seems automated, and seems like they'll fix it. Especially if it gets traction here.

View on HN

>The only thing I'll say is... Extensions have a scary level of access (they're basically almost as easy to use as a website, but with unlimited powers such as recording every site you visit and stealing passwords), and the average user will never understand that.

Probably not going to be all that popular on HN, but this is why I'm very hesitant about using extensions on Firefox (and I suppose Chrome too, but it's been a while since I've used that browser). I'm not going to audit the source code of these extensions, so why should I trust them with privileges to essentially record every website I visit?

I wish Chrome and Firefox would adopt a content blocking system similar to Safari, where the author of the ad blocker can essentially tell the browser what content to block, but the ad blocker itself doesn't get any information about user activity. This could exist alongside the existing extension system, in case additional capabilities are needed.

Yes this is less powerful than giving the ad blockers content to all the user's browsing history, but I'd happily exchange less effective ad blocking in exchange for enhanced privacy

I've stopped using extensions altoghether. And I used quite a few back in the day, even made a couple myself.

"Hesitant" doesn't convey the level of fear everyone should feel after reading "Has acess to: All data on all websites".

Same applies to apps, of course.

By the way, I think a pi-hole is safer than an ad-blocker extension, but I'm not sure. What would I be opening myself to if it gets hacked and my DNS server is now the enemy?

As long as you don't blithly accept new ssh connection end points or bypass certificate warnings, you should be fine.

They could track where you go online via the DNS requests ( the sites at least ), and they could mess with anything unencrypted.

Used to be if an HTTPS site loaded an HTTP script resource it provided a dangerous place middlemen could invade your secure session.

chrome, IE ( presumably now Edge as well ) and firefox rightfully block mixed content by default, and have for some time

https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_...

( the mentioned Firefox 23 came out in 2013, so like I said, a while )

> I wish Chrome and Firefox would adopt a content blocking system similar to Safari, where the author of the ad blocker can essentially tell the browser what content to block, but the ad blocker itself doesn't get any information about user activity.

Please, no. This is exactly what makes Safari all-around worthless, despite all the hard work they put into it.

Chrome will get forked the minute they do this, and the forked version will restore that functionality, and I will immediately install that fork and uninstall Chrome.

>Please, no. This is exactly what makes Safari all-around worthless, despite all the hard work they put into it.

Keep in mind that I said that the legacy extension system should remain in place, for people such as yourself that wish to utilize it.

That said, I wouldn't characterize Safari's content blockers as worthless. It's not as effective as Firefox's ad blockers, but I still rarely see ads. If I had to guess, I'd say under five ads per month manage to sneak through.

In my mind that just means switching over the big boy browser to that approach just means giving an incentive for more of those types of ads that slip through.

Isn't this what Manifest v3 does?

> I wish Chrome and Firefox would adopt a content blocking system similar to Safari...

This is exactly what Chrome's Manifest v3 offers. As they put it: "There's a new declarativeNetRequest API which lets extensions modify and block network requests in a privacy-preserving and performant way."[0] MV3 went live earlier this year so you can build on it now, but no word on when extensions will be required to migrate.

Manifest v3 has been widely criticized [1] for weakening ad blocking which of course aligns with Google's self-interest. It's a tough balance to strike.

[0] https://developer.chrome.com/docs/extensions/mv3/intro/mv3-o...

[1] https://news.ycombinator.com/item?id=20044430

Nope, MV3 weakens ad blocking, but still gives full read access to the requests.

The CWS developer program policy does not allow extensions to request unnecessary permissions. If an extension doesn't have a good reason to observe network requests in MV3, it will/should be rejected.

So yes, it's technically possible to observe network requests but in practice few should be doing it.

Extensions such as uBlock Origin just happen to be important enough that they should not be subjected to these limitations. They're essential browser features that for some reason haven't been integrated into the browser itself yet.

AFAIK the author is just one guy. I'm sure he's the best guy there is, but if tomorrow morning he finds his favorite horse's head in his bed, I wouldn't fault him for including some tiny little script in it, you know, practically nothing!

> The only thing I'll say is... Extensions have a scary level of access (they're basically almost as easy to use as a website, but with unlimited powers such as recording every site you visit and stealing passwords), and the average user will never understand that.

I’ll second that. I worked for a group which was a startup acquired by AVG. They were a data science acquihire so that avg could better monetize the data they’d been collecting from their extensions over the previous decade.

Once I found decade old content from my dead father’s browser, I decided to never use an extension again.

> Extensions have a scary level of access (they're basically almost as easy to use as a website, but with unlimited powers such as recording every site you visit and stealing passwords), and the average user will never understand that.

Seems to me that the solution to that is to make permissions extremely granular and grade the level of review scrutiny an extension gets by its permission granularity. Then, only extensions that want to access or modify something truly sensitive would run the risk of getting smacked down randomly like this (as is always liable to happen with an automated process).

Not just "read all websites" but "read the URL only", "read the visuals but not the HTML/CSS", "inject predefined code onto only website X".

It also incentivises extensions to ask for less permissions so they can pass review more quickly.

Seriously. It is completely unacceptable that the default level of access has become "everything."

To be fair, Chrome has been really restricting access. The past year or two, they've gotten really fine-grained. You have to ask for every permission, and even explain to the reviewer why you need it.

> It is completely unacceptable that the default level of access has become "everything."

Even on Android (and I presume iPhone) where apps ask for/document their permissions requirements, most people just say "Yes" and move along. Most people have neither the time nor the expertise to critically evaluate whether or not an extension needs any of a dozen permissions.

I sympathize, but I have no idea how you can realistically solve this.

it shouldn't be necessary for users to know this because the permission-granting relationship is potentially adversarial, so the user will always be on the back foot unless they're technical/power users. It should be Google's responsibility to ensure that extensions only request the permissions they need.

> It should be Google's responsibility...

That seems ripe for more of the same articles of this flavor. The specifics would probably be just something akin to "turns out that using this permission in a way that Google didn't anticipate immediately gets your app shelved and leads to loss of users."

If you extrapolate down the fine-grained-permissions line, you eventually end up with effectively a legal system where the rules are encoded explicitly (and enforced programmatically) but the spirit-vs-letter of the law is left to interpretation by a judge (the reviewer in this case).

That's probably better than the scenario we have right now. Such a system of smaller permissions would be an improvement over every extension asking for all permissions and being able to do what they want with your browser.

Average users are absolutely not gonna read all that stuff, much less understand it, when they accidentally install a malicious extension. I'm all for more powerful browser extensions (I really miss vimperator...), and I agree that permissions should be more granular, but I don't think that's gonna fix the issues that the average user of chrome has with them.

I dont think they were talking about average users reading it, but rather permissions are used as a trigger for the thoroughness / rigour of review scrutiny. Ie, this is a proposal to help the pulish/takedown issue, rather than to help users make better decisions.

Chrome permissions work like this and are quite fine-grained.

When an extension update changes the required permissions it gets disabled and you get a prompt to re-enable with the changed permissions.

> Especially if it gets traction here.

Only if gets traction here, history proves.

You're giving HN a bit too much credit.

What's the "good faith" reason for this stuff? Is it that the code itself gets manually reviewed and so you're not supposed to be hiding behind obfuscation?

There has been a rash of scurrilous people buying popular Chrome extensions and or paying owners to add malicious code.

The malicious code can add third party script references which then behave differently depending on target user or time of access, and these can be credential thefts/keylogging, (very inefficient) cryptocurrency miners, ad injection or participation in click farms, or just general connivery.

I'm very glad Google is starting to do source code review on extensions, it's long overdue given the access they have.

At Mozilla (and this was 10 years ago), you couldn't minify or modify any library. (There were ways to include binaries, but it was complicated.)

In this case, they flagged a pattern of unicode that Google felt nobody with good intentions would be using. Turns out, Lodash used that string for something, hence the blocking. It had nothing to do with obfuscation, but rather a good-faith attempt to block bad things.

Similar to how you might trigger heavy ratelimits on a request like `wp-admin/index.php`, since it's clearly a bot trying to find vulnerabilities.

> a string that Google felt nobody with good intentions would be using

It looks like it triggered on text having too much entropy, which is really reckless on such short sequences. If there's no specific thing it's trying to block, there's less good faith to give credit for.

Well, we don't know what happened behind the scenes. Based on the fact that they took down an extension that hadn't been updated in a month, it makes me think a serious vulnerability was discovered behind the scenes in other extensions.

Keep in mind that it triggered on three separate strings. The chance of them all being malware/vulnerability signatures seems pretty low, unless their method for generating those is particularly reckless.

Yeah, pretty much. Extensions shouldn't be obfuscated. Would you choose to run code in a privileged context (and "the whole browser" is awfully privileged!) if you suspected the author was hiding something? Same principle.

In this case, the review was pretty much correct. The code absolutely looked obfuscated, forcing the author to dig through a bunch of dependencies just to figure out where the offending strings (in HIS OWN EXTENSION!) were coming from.

And the answer turned out to be benign. But it sure didn't look benign until a relatively deep analysis was done. Extension reviews aren't supposed to be for deep analysis.

Funnily enough, the MDN documentation about extensions mentions using jQuery. (See the paragraph above this: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...)

It's pretty sad that getting any of these automated issues resolved requires this. I get the whole need to be able to properly review extensions before they are in the store. Its such a high security vulnerability.

However. Banning an old app suddenly and not really providing any response to deal with it... that's not a good solution.

You know, it sounds to me like a real pain point that could add customer value if it were addressable. As such it suggests that if someone were bright enough to come up with a solution to curating these sorts of things you could add real value that an enterprise customer would pay big money for.

It has billion dollar startup written all over it.

Oh absolutely.

This is something I chew over all the time. How can we have a large corporation dealing with the number of users that Amazon/Google/etc are dealing with, as well as the number of malicious parties trying to break them without resorting to either systems that create excessive false negatives and provide little to no appeals process of any use, and without having a massive overhead cost for handling the appeals in a judicially reasonable way.

Everytime I work on it, it turns into that it requires more people who are properly trained in almost legal theory, and then you end up quickly with the same problem that many policing and court systems have which is very quickly individuals with an axe to grind work to achieve regulatory capture.

It's been fewer than 24 hours since this happened, and they send him an email immediately with steps to fix it.

It sucks, but remember that Chrome Extensions have basically unlimited power, and Google is doing their best to protect users.

[EDIT: And it's resolved! The extension is back]

Well I'm glad they resolved it so fast. That's excellent.

Reply on news.ycombinator.com