Hacker News Reader

Comment by pcthrowaway | Hacker News Reader

I'm terrified of browser extensions for this very same reason (and yes, I still use them). I wish the browser vendors supported some kind of pinning to source code for open source extensions. Right now I have at least 2 extensions running that I know could access my passwords on any website as I enter them. One of those is Lastpass, which I use for storing/generating those passwords anyway, and the other is AdBlock Plus. Could other extensions access sensitive information? I'm not sure, but I hate not being able to see the source code of apps which need so many permissions.

View on HN

Re AdblockPlus, I can recommend Ublock Origin instead. The UBO developer (Raymond Hill) repeatedly chose ethical behavior over money.

Alas the Great Suspender just fell prey to malware after its creator sold it off: https://news.ycombinator.com/item?id=25846504

I think Apple have the right idea with app review on browser extensions for Safari.

The other nice thing about Safari’s approach is that for common extension functionality it is just a set of rules that are executed. So no malware can be run because extension code isn’t actually reading the dom. Nor does it have access to load remote resources.

I hear that a lot of companies are doing unethical things. Maybe the government should only grant corporations to form which are headed by approved people?

Not a bad idea, even if sarcastic.

> I wish the browser vendors supported some kind of pinning to source code for open source extensions.

Chrome used to. You used to be able to just download the source code of an extension, point Chrome at it, and done you are.

Well, you still can. But Chrome will CONSTANTLY nag you about it and try to forget you added that extension using source, like it's some vile crime.

They removed it because of "security", which is a hilarious reason because it just made everything so much worse.

AdBlock Plus is owned by a company who is selling ads. Use uBlock Origin instead, please.

To be more precise: You can pay them to get your ads listed as "acceptable ads" which will then pass the filter rules of ABP.

Would be a real shame if some software would block your ads because you didn't want to pay, wouldn't it?

Given the reputation of ABP, I'd be worried too.

At least with LastPass you know they have a commercial model and reputation to incentivise better behaviour. If you download something that is free then that pressure doesn't exist.

have you read their privacy policy? They layout they can spy on everything and share with anyone they want.

You'd think if they were serious about privacy their privacy policy would just say "we spy on nothing and collect nothing and share with no one". 1password effectively has that privacy policy, lastpass does not.

https://www.logmeininc.com/legal/privacy/us

https://1password.com/jp/legal/privacy/

Reply on news.ycombinator.com