Hacker News Reader

Comment by hengheng | Hacker News Reader

I'm not too familiar with web development, so please forgive my question: Is this just a style sheet that the browser knows how to apply, or am I giving you read access to my e-mail?

View on HN

It's a browser extension - a bit of code that runs some scripts, in this case modifying the style of the page when you go to a specific domain (gmail). Extensions are run inside of the security sandbox for that domain with a higher privilege level than normal webpages - consequently, the extension could send all your email and activity from other tabs to a 3rd party. The Gmelius website says they don't though. You could, if you were so inclined, check the code inside the extension package if you wanted. If it was doing anything dodgy they'd be found out pretty quickly.

tl;dr Yes, it could read all your email. I doubt it does though.

Even easier than checking the source code, you could use a program like Fiddler2 to watch the network traffic from your browser, to double-check that the extension isn't sending home any private data.

Hi, basically the extension injects some CSS and JavaScript into your browser, targeting mail.google.com. It does not read or access your data.

Doesn't injecting JavaScript give you access?

Not unless their JS has ajax calls in it. But technically yeah they could, but, it's a pretty stupid fucken idea considering it would be found out almost immediately and suddenly it has become a blacklisted addon, their reputation has been destroyed etc.

Additionally you could just not update the addon ever if you're OK with it right now.

Seems fair enough to me, so it's basically the shareware security model where any application that carries malware instantly loses its reputation, even though it is technically able to do so. Interesting to see this carried over to web apps.

Reply on news.ycombinator.com