Hacker News Reader

Comment by Zikes | Hacker News Reader

There's a comment on the Chromium blog [1] (via magicalist's comment [2]) that nails this: if security is all they cared about, a signed certificate is all that's necessary.

Knowing that option exists and persisting with their store-only approach means they must have an ulterior motive of some sort, most likely control and money. Ad blockers that target Google Ads will be no more, as well as anything else that the user might want to use to subvert or circumvent. Extensions will also have to adhere to Google's moral code, and developers will once again be beholden to a greater authority in order to operate their business.

Just like with Facebook and the Apple app store, if you build a business on Google Chrome Extensions you now face having the plug pulled at any time for any reason, with absolutely no recourse.

[1] http://blog.chromium.org/2013/11/protecting-windows-users-fr...

[2] https://news.ycombinator.com/user?id=magicalist

View on HN

Would a signed certificate approach allow them to deny extensions, or not? If yes, they could still deny ad blockers that way. If no, it is a weaker form of security than this is.

The alleged reasoning is to stop malware. A signed certificate must come from an authority willing to put their own reputation on the line, but Google does not need to be the only such authority.

So the extension being installed on some malicious site would have a popup talking about security certificates and such, and asking the user whether they want to proceed? You and I might think twice, but most users just click "Yes". Signed certificates would not be adequate to protect the average user.

The idea is that the browser would only accept signed certificates, and only those certificates which the signing authority has not revoked. So long as the signing authority is in a trusted list, the user would see no Yes/No option at all. It would simply install, or be rejected outright with an explanation of why.

It would be like limiting web browsing to HTTPS only, except you would not be given the option to click through for unsigned certificates.

So then Google could still revoke the certificates of any ad blocking software.

Great! I am the "Definitely Not A Malware Author" certificate authority and I have signed this "Definitely Not Malware" extension.

Not quite. The DNAMA would quickly lose hard-won reputation once DNM was shown to be malware. Google not being the only CA doesn't mean everyone gets to be a CA.

> Not quite. The DNAMA would quickly lose hard-won reputation once DNM was shown to be malware.

No problem. I am a completely different "Definitely Not A Malware Author 2" certificate authority and I have signed this "Definitely Not Malware" extension.

> Google not being the only CA doesn't mean everyone gets to be a CA.

Oh. In that case who gets to decide who gets to be a CA?

Who decides who gets to be a CA for SSL certs? Similar process. Somehow my browser doesn't recognize a CA that would allow any random person to pretend to be Facebook.

The web browser authors/distributors decide what root CAs will be included in their browsers. So in this case concerning Chrome, Google decides.

Which means Google is still in charge, ultimately.

Which means that this digital signature scheme hasn't actually accomplished anything.

Google controls the entire browser, meaning they are in absolute control, ultimately. They could inject code into your banking web sites, they could block all the porn, whatever they want.

The idea isn't that the certificates would wrest control away from Google, it's that they wouldn't be able to use "omg the malwares" as a shield for their intentions. If there's a root CA that's handing out certs for malware extensions then sure, pull the plug, but if the root CA is handing out certs for ad blockers and Google pulls the plug then it'll be plain as day what they're doing.

Heck, all the browsers nowadays use extensions of some sort, maybe they could form a consortium for extension certifications so no one company would be in complete control. You could bet Mozilla would keep that sort of behavior in check, at least.

> If there's a root CA that's handing out certs for malware extensions then sure, pull the plug, but if the root CA is handing out certs for ad blockers and Google pulls the plug then it'll be plain as day what they're doing.

Pulling a root CA is no more public than blocking an extension from the Chrome Web Store. In both cases it is clear that Google has taken the action, and whoever has gotten blocked can protest it publicly (just like people do now for Apple App Store rejections). The Chrome Web Store doesn't give Google any kind of "cover" or "shield."

Additionally, revoking an entire root CA that was letting malware through (intentionally or unintentionally) would be far more intrusive than pulling a single extension from the Web Store, because every extension that the CA had approved would be affected, even if they were not malware.

What annoys me about this entire thread is that the OP (which was voted to the top of the story's comments) presumes that you can sprinkle some crypto fairy dust and get just as much security against malware without having to give up any control. And it goes so far as to assume bad intentions on Google's part for not doing it. But it's not that easy; crypto isn't a magic wand that lets you have your cake and eat it too.

> (OP:) if security is all they cared about, a signed certificate is all that's necessary.

Um no. It's not that simple.

Another option would be to allow untrusted extensions like the Android setting for "Allow untrusted sources" for installing apps.

Of course the problem with that route is preventing any unwanted-extension installer from maliciously enabling that option itself.

Reply on news.ycombinator.com