Hacker News Reader

Comment by baby_souffle | Hacker News Reader

Ha! Beat me to it!

For anybody that's curious, the IP-Foo [0] browser extension puts a little 4/6 icon in the address bar to make it clear at a glance which dialect you're speaking for $currentWebPage

[0]: https://github.com/pmarks-net/ipvfoo

View on HN

cool, but "read and change your data on all websites" is imho not worth the functionality. that seems ripe for takeover by some scammer.

IPvFoo author here. The problem is that there's no way to obtain the (hostname, ip) stream from Chrome/Firefox without requesting the "all websites" permission.

In theory, browser vendors could define a narrowly-scoped permission that only reports (hostname, ip), or roll this functionality into the browser UI, but neither seems likely to happen.

I made IPvFoo to promote IPv6 adoption, and wouldn't consider selling it for less than $10M USD. It probably won't ever be worth that much because it's an easily-cloned utility without a "moat", but it's more rational to set a price than refuse to sell under any circumstances.

Just wondering, do you expect non-scammers to have the $10m?

No. I expect that I won't sell it because it's worth more to me than anyone else.

The danger with extension acquisitions is malicious buyers, who use their ability to run arbitrary code to steal credit card numbers or credentials, insert or replace ads, run cryptocurrency mining, etc. For malicious purposes number of installations is the important thing, not how clonable the extension is.

$10m could be worth it for a nation state actor targeting a specific high-value individual known to use the extension.

You can do those in private windows, there's separate permission for those: https://support.mozilla.org/en-US/kb/extensions-private-brow...

Miners need the least amount of permissions anyway.

yeah, i appreciate that. my post wasn't meant as a criticism, it's a cool project and i'm happy your extension exists.

i have no reason to think you'd sell out to scammers, but stranger things have happened and for a product whose whole utility to me is "huh, that's cool" it's not worth it. and i thought that was worth highlighting to others. some chrome extension hygeine is always good.

To determine ipv4/6, do you need to send that hostname and ip off to somewhere to get a response? or can it be done locally without leaving the machine?

You can determine that by looking at the value.

IPv4: 123.123.123.123

IPv6: 2001:db8::8a2e:370:7334

Oh yeah. DUH!

It's local. The webRequest API provides an 'ip' field with each request, and the hostname can be extracted from the URL. Once you have an IP address, just check for colons.

https://developer.chrome.com/docs/extensions/reference/api/w...

ipv6 addresses are different, so they’re easy to distinguish

Offtopic:

    // Don't waste time rewriting the same tooltip.
    // Don't waste time redrawing the same icon.

Finally someone who understands the basics.

> IPvFoo author here

It makes sense that you would notice the change then :D

Was this a situation where you had to do a double-take? Like, you opened HN today and saw that your extension said IPv6 and for a split second you wondered if your extension had made a mistake? Before seeing that indeed HN has IPv6 now.

I didn't really think it was a mistake, just switched to "Morpheus is fighting Neo!" mode and started collecting evidence, most of which is in the post.

> $10M USD

Hah. You take a strong starting position in the negotiations ;)

> roll this functionality into the browser UI,

Is it hard to get patches into firefox? I never tried, just curious.

$10M for access to a pool of 100k (and growing) tech-savy users that are harder to hack than gen-pop? You guys, the 100k+, are lucky I'm not made of money.

I appreciate the honesty, and the reality is that most add-on developers have a price; a lot of people would probably sell their add-on for $10M.

But these things auto update. If a government (or even just a moderately big org) really wants to spy on someone, and they determine that said someone uses IPvFoo, $10M isn't a very large price to pay to just get complete access to the target's web browser.

This isn't specific to your add-on in any way, but, well... that seems ripe for takeover by someone nefarious.

If your threat model includes a government...

Which it kinda should? It's not as if governments universally have proven themselves to not do messed up shit and not violate people's privacy

As a member of your country's public society at large, sure (media campaigns, propaganda, government contracts for IT equipment and infrastructure). For individual targeting.. not many people.

TY for making the extension. As someone who uses it daily, you are my saving grace and my go-to for telling when a website has enabled IPv6 or not, if it wasn't you making this post that's how I would have found out HN had enabled it too.

I get fun questions from people when I screenshare and they notice the green "6" or the red "4" and ask about it. Sure it doesn't do anything fancy behind the scenes but that's also what makes it perfect.

Thank you for writing this tool. It cheers me up every time I see a green 6.

Just download the repo as a zip file and manually upload it as an extension to your browser.

Note that the top-level manifest.json is for Chrome. To use it with Firefox, you have to copy "manifest/firefox-manifest.json" onto manifest.json first.

Though be warned, after a restart Firefox doesn't re-enable side loaded extensions that were added in the "debug" mode.

Also, Chrome (Google) has a habit of randomly disabling or removing side loaded extensions. I even had a side loaded extension that Google forced removal of because Google deemed it contained malware (which it didn't, I know because I wrote it).

Just read the source code.

Not good enough to protect against the kinds of attacks that OP is warning against. Chrome extensions update automatically and there have been many cases of extensions being purchased by malicious actors who modify the code to be spyware or adware.

You can download the current version and install it manually to get around that. If you do that and read the code you're probably safe.

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

So the problem is in the behaviour of the browser, but not the extension.

Read the code, don't update 'till you read the code, don't use the browser which knows better what is good for you.

Seems to me fine grained access controls would go a long way. The extension gets access to specific capabilities. Such as network connectivity. Local extensions have a much smaller blast radius.

In Chromium, you can click on the request in the Network panel and it will show the IP.

I see:

    Remote Address: [2606:7100:1:67::26]:443

When I put that into the url bar:

    https://[2606:7100:1:67::26]/

I also see Hacker News.

Reply on news.ycombinator.com