Show HN: A Firefox extension to add latency to distracting webpages | Hacker News Reader

Show HN: A Firefox extension to add latency to distracting webpages

addons.mozilla.org

232 pointsoldtapwater51 comments

Looks like an interesting extension, but unfortunately I would never install it given that "this add-on can access data for all your websites". As far as I am aware, this means it can read and record all data in all websites I visit (including emails, banks, etc) and record everything I type anywhere (including usernames and passwords).

Even if the extension's source code is available on GitHub, there is no guarantee that the code hosted at addons.mozilla.org corresponds to the same one found on GitHub; and even if I (or someone else) could verify that the code is indeed the same, and that there is nothing malicious in it right now, there is no guarantee this will still be the case in future (silent) updates.

To be clear, this is more of a criticism to Mozilla Firefox's security model, not to this particular extension.

I used to have this exact same fear and never downloaded any extensions bc of that, until I started making browser extensions. Pretty much any useful extension needs the access that prompts that generic message about accessing all the data.

Any extension that's listed on the web stores have to be reviewed for malicious code, and they must do what the listing say they do. So if your browser extension has your passwords, then that extension would be considered a password manager.

The extension probably listens to the IPs of well-known time wasting websites like HN or reddit, then adds a latency to the browsing. Same with an ad blocker -- they know every site you visit but only to compare them with their blacklist of advertising IP addresses.

Of course, you have to trust they aren't doing anything else with that info, which you can probably assume you're mostly safe if you don't need an account to use the extension.

I believe only "recommended extensions" for Firefox are tech reviewed, which this one is not.

https://support.mozilla.org/en-US/kb/recommended-extensions-...

According to [0], Mozilla requires all extensions to have a source in human-readable format and runs a test suite on them. They mention "code review" there, but don't say whether it's manual or automatic. I'd love to hear about it from someone who has some experience with the process.

[0] https://extensionworkshop.com/documentation/publish/submitti...

For my extension the review was automatic, and flags things like direct html editing. I only have a few hundred users though, so I'm not sure at what point they decide to do manual reviews.

There's a link to his github in the extension page. You can read his source code: https://github.com/OskarDamkjaer/FirefoxDelayWebpage

most of the relevant code is in https://github.com/OskarDamkjaer/FirefoxDelayWebpage/blob/ma...

It actually matches a regular expression against the URL; I don't think it looks at the IP addresses.

You are incorrect. You can inspect extensions that you download to compare the source code to the github release, or even audit the specific source you have have downloaded. Please don't spread FUD.

Would it be feasible for browsers to have a console window that enumerates add-on's to display things like URL's contained in the code, what is stored in local storage, session storage, etc? Asking because this topic comes up a lot and might not if the browser had a way to show explicit detailed permissions and capabilities vs. high level abstract permissions. This would be for less than technical people that probably won't be viewing source code, but could click a shiny button in the add-on page and get some idea if the addon shows URL, http(s), number of times the addon has used GET or POST or other methods:

  URL: http://some.site.tld/    [ INSECURE GET:1 POST:2]
  URL: https://some.other.tld/  [ SECURE GET:3 POST:2 ]

Maybe in about:networking have a tab for logging / debugging all addons?

.xpis are just zip files.

You can literally just save them from addons.mozilla.org and look inside - it's js so it's not compiled, and obfuscated code is against Mozilla policy.

Automatic updates are optional too.

Microsoft Application Inspector might be handy for some superficial profiling - https://github.com/microsoft/ApplicationInspector

> obfuscated code is against Mozilla policy

You can submit obfuscated code as long as you also upload non-obfuscated code to Mozilla. Not sure if that separate code upload is public or not...

Obfuscated code is not allowed on any of the browser extension stores. Mozilla requires the attachment of the original source code if you use a bundler such as webpack, or if the code is minified.

Only reviewers have access to the source code, unless you configure the listing to make the code public.

This message is not accurate IMO.

Basically, if the addon wants to interact with any kind of urls, this message is unavoidable. Which means that even if the addon doesn't require to access any data of the websites, as long as it wants to be triggered for any websites, this message is not going to be avoidable.

https://extensionworkshop.com/documentation/develop/request-... has more information.

FTFY: To be clear, this is more a criticism of _every browser's_ security model,...

I do agree with you though. What is surprising is that technically, this should be fairly easy to solve:

- own the CI system (to make sure the sources match the built versions)

- make sources (the ones that went into build) clearly visible

- disable silent updates

The solution should surely involve more granular permissions?

I'm assuming this permission has no need to read the body of network responses, inject anything into the responses, read cookies etc.

However, it probably has no option than to request the "read and change all network data" permission because there is nothing weaker that will let it do what it needs to do.

Making sources available isn't a scalable option to help with this in my opinion. Who is going to be doing thorough security audits of every extension + every update?

This is exactly the approach taken by F-Droid (for Android apps). All apps available on F-Droid have been automatically built from a publicly available repository, and you can either download the binary (APK) or the source tarball that they used to produce it. Updates are manual.

> To be clear, this is more of a criticism to Mozilla Firefox's security model, not to this particular extension.

It's a fair comment, but this extension works by injecting javascript into every page the browser loads. If this capability were removed or even changed, it would break a ton of existing extensions (and compatibility with the many extensions written for Chrome).

Given the nature of javascript and the web, once you can run a bit of javascript on a page, you can do just about anything, so the phrasing "can access data" sounds scary but it is accurate. Of course, "can" doesn't mean "does", hence all the other commenters suggesting auditing the code.

Speaking of auditing extension code, I like https://addons.mozilla.org/en-US/firefox/addon/crxviewer/

The problem with trying to cure this security model is that once an extension can rewrite page HTML, it can inject transmission of your data to a third-party, and so any addon that affects pages (such as this one) is correctly labeled as "can access your data", because it absolutely can.

To make any headway on this, you would need to start considering how to prohibit JavaScript from transmitting page content to remote servers if it's been modified by an addon, but that would then break all JavaScript modified by adblockers, and so there's not any easy solution there either.

If you can think of a valid security model here that isn't vulnerable to today's arbitrary JavaScript execution issues, I think you'd find a willing audience. Chrome tried to solve this by nailing down what extensions can do, and the adblockers all flipped out because they won't be able to run arbitrary JavaScript in-page anymore. It remains unclear how this can ever be solved.

> Looks like an interesting extension, but unfortunately I would never install it given that "this add-on can access data for all your websites". As far as I am aware, this means it can read and record all data in all websites I visit (including emails, banks, etc) and record everything I type anywhere (including usernames and passwords).

> Even if the extension's source code is available on GitHub, there is no guarantee that the code hosted at addons.mozilla.org corresponds to the same one found on GitHub; and even if I (or someone else) could verify that the code is indeed the same, and that there is nothing malicious in it right now, there is no guarantee this will still be the case in future (silent) updates.

> To be clear, this is more of a criticism to Mozilla Firefox's security model, not to this particular extension.

Uhhh... yeah

An alternative would be to throttle your network speed to like 2g with your dev tools, although this will obviously effect, say, YouTube more than HN

The relevant post from a day ago: I Add 3-25 Seconds of Latency to Every Site I Visit.

https://news.ycombinator.com/item?id=22319383

I read that post and wished that there was a Firefox extension but could not find out. Glad someone made one.

Something I started messing around with: add a global stylesheet with the rule

body { filter: grayscale(100%); }

(only gotcha is position: fixed; elements breaking in Firefox?)

It feels a lot easier to focus on what I'm reading and to not be sucked in or distracted by websites. I bet psychologically color activates reward systems that may not be as healthy for digital content.

I actually liked it so much that I used accessibility options to make my entire computer and phone grayscale. So far it's great! Also has better performance than a CSS filter for stuff like video.

Hammerspoon shortcut to toggle grayscale & color (applescript not mine, borrowed from https://github.com/shavidzet/osa-grayscale)

  hs.hotkey.bind({"cmd", "ctrl", "alt"}, "c", function()
   hs.osascript.applescript([[
  tell application "System Preferences"
    reveal anchor "Seeing_Display" of pane id "com.apple.preference.universalaccess"
  end tell
  
  tell application "System Events" to tell process "System Preferences"
    repeat while not (exists of checkbox "Use grayscale" of group 1 of window "Accessibility")
      delay 0.1
    end repeat
    set theCheckbox to checkbox "Use grayscale" of group 1 of window "Accessibility"
    tell theCheckbox
      # If the checkbox is not checked, check it to turn grayscale on
      if not (its value as boolean) then
        set checked to true
        click theCheckbox
      else # else turn grayscale off
        set checked to false
        click theCheckbox
      end if
    end tell
  end tell
  tell application "System Preferences"
      quit
  end tell
   ]])
  end)

Love this idea. It would be interesting to see what different ways (AI) you could predict that a site is distracting based on personal and wide-spread usage habits. Some advanced method that doesn't require a user generated whitelist would be the next level for this.

This and the post yesterday about adding latency to websites reaffirms an idea I've been thinking about lately - adding friction back into digital processes helps break some of the addictive power they have.

Imagine if you had to use a printer to print out your facebook feed when you wanted to see it. Then, in order to interact, you had to write on that paper the comments, likes, etc. that you wanted to transmit and scan it back into the system. That mode of interaction seems "primitive" compared to the way we use things on our phones, but I think carries with it a lot of nice advantages like introducing time buffers for your mind to catch up to your impulses.

There is also Leechblock which contains the same functionality along with blocking and some in-depth config. But this may be a cool solution for someone who only cares about the latency part.

I tried Leechblock, and found it unusable (on my Android phone). It broke my back bar, and often wouldn't follow through links (instead taking me to where I already was).

This is really nice!

It would be nice (from my experience) to make the delay variable - - this stops people "Learning" ways of avoiding the always fixed length delay.