Hacker News Reader

Comment by herodotus | Hacker News Reader

On Safari, when you highlight this extension, you get this warning:

* Webpage Contents Can read sensitive information from webpages, including passwords, phone numbers, and credit cards ..... * Can see when you visit all webpages

Is the cure worse than the disease? Analytics might be an invasion of my privacy, but it is benign compared with seeing my password. I am not saying that the extension steals my passwords, but how do I know it does not?

View on HN

This was one of the issues with ad-blockers. They would start of legit and say that they needed all this access in order to efficiently block everything. Then a few years down the line they would sell out to a company that would use this access to mine information about you and sell it to the highest bidder. They would obviously not go as far as to mine your credit card info, because that would get them banned I’m sure.

So then Apple made a sandboxed ad-block extension point which would take a list of rules and apply them directly.

This wasn’t flexible enough for everyone, so now we are back to square one again.

If they only ship the credit card mining code to 1 in 10k users, they could go undetected for long time and still make a tidy profit...

You know how many right the average windows/linux/macos desktop application has?

You'd basically have to read the code every single time it updates, or at least hope someone does that and would publicly raise the issue (and that you're getting the same version as everyone else).

That said, the analytics scripts can also do all of that. They can only do it on pages where they're embedded, of course, but especially for Google's scripts, that's probably most (not all) web sites (either in the form of Analytics, Tag Manager, or Ads).

>You'd basically have to read the code every single time it updates, or at least hope someone does that

Firefox now has a program where they go through a vetting process for a subset of the available extensions.

>Recommended extensions differ from other extensions that are regularly reviewed by Firefox staff in that they are curated extensions that meet the highest standards of security, functionality, and user experience. Firefox staff thoroughly evaluate each extension before it receives Recommended status.

https://support.mozilla.org/en-US/kb/recommended-extensions-...

Browser extensions seem like a security nightmare in general.

They used to be much worse. People ended up with a dozen toolbars, plugins, and extensions that hijacked their search to sketchy sites like "Internet Web Search" and injected random ads into the page.

As opposed to running scripts from random websites with zero oversight.

Browsers have the sandbox. Extensions are outside of it, within a different one, but the further up you go the more vulnerabilities there are.

You know how many right the average windows/linux/macos desktop application has?

DNS level blocking with a Pihole is much safer in this regard, but also less capable, since it only works on anything that uses a dedicated domain that can be identified.

In this case, google analytics only goes through analytics.google.com, so it’s easy to block at a DNS level.

Thanks: I will use my Pihole. Should have thought of that.

Google Analytics should be on the default list, I didn't have to take any explicit steps to block it other than select whichever blocklist the pihole developers recommended.

Third-party JavaScript running on a domain could similarly steal passwords typed into that domain.

True, but if I activate the extension, can it steal passwords from any domain I visit?

The permission this warning is for is "inject arbitrary code into any site", so yes.

Would your bank add third party js to their site without vetting it and locking it down?

Also, please don’t answer that honestly because lots of banks actually had vulnerabilities that allowed hackers to inject js into their sites to steal login info.

that's just the generic warning that they have for most extensions, because the webextension security model doesn't allow for granular permissions.

There are about 60: https://developer.chrome.com/docs/extensions/mv3/declare_per...

The warning is for the "inject arbitrary code into any page" one.

Right, that's why I said "most", not all. There might be 60 separate permissions, but to do most non-trivial things you need the "inject arbitrary code into any page" permission.

Reply on news.ycombinator.com