Hacker News Reader

Comment by arcatek | Hacker News Reader

A good thing would probably to have a way to see the requests triggered by installed extensions. Even checking this list once in a while and manually reporting the suspicious ones with a "report" button would make these rogue extensions almost worthless.

View on HN

Have you tried out the new "Chrome Apps & Extensions Developer Tool" https://chrome.google.com/webstore/detail/chrome-apps-extens... ?

It appears to log what actions each application and extension performs, view permissions, and debug the extensions' background pages

That would be pretty nice.. I tend to have half a dozen extensions loaded, mostly dev extensions from trusted sources. I've also used the source versions of a few as well.

I think one of the worst things to me is the number of drive-by installers that now target chrome, firefox and ie with malware extensions, or transparent proxies. I saw one on a friend's son's computure and mainly noticed because there were additional ads on Amazon's site. Sometimes I think we should bring back outlaw (dead or alive) status for certain classes of criminal dredge on society... Then I think about where the likes of Snowden would fall from the governments perspective and think it over again.

Just a guess but can you see those in the DevTools on the Network tab? Needs to be open before you load the page. I'd check but I don't have any extensions installed except WTF and the WebGL Inspector.

This depends on what/how the extension is accessing the network. They have a background page and they can inject scripts on visited pages. If they are injecting scripts which then make the requests then it would show up in the DevTools on the page you are visiting, but this is uncommon.

Instead it is far more likely for the extension to make the requests from their background page (which has elevated permissions) which is essentially its own page with its own inspector. You can inspect each extension individually by going to your extension listing, enabling developer mode and inspecting the background page of the extension you suspect.

Right, but I think the parent was suggesting a way to see historical URL accesses by extensions so you could audit them.

You can see EFF PrivacyBadger code getting injected in the source tab in dev tools, not positive about network requests. It wouldn't be hard to test though, just make a simple extension that does XHR to example.com and load it up locally. Chrome extensions are surprisingly easy to write, and there are some simple tutorials if you google around a bit :)

EDIT: here's how to inspect extensions you're curious about: https://developer.chrome.com/extensions/tut_debugging

Reply on news.ycombinator.com