Hacker News Reader

Comment by ocdtrekkie | Hacker News Reader

So much this. Every extension is an attack vector. They have post-decryption access to all of your web content and largely make the entire benefit of HTTPS moot if you have a bunch of them.

Every extension you install should be carefully vetted and only enabled as long as absolutely necessary. It's the top malware vector I see today.

View on HN

You could say the same thing about almost anything: browsers, new root certificates, firewall software, antivirus software, anything you install on your own device, etc. Essentially, they're saying "anything you want to execute on your machine is a potential attack vector", and the only way to solve it is: "your browser is now your dumb-terminal into the mainframe (website), and we won't let you the device owner install anything that may potentially tamper with the data coming from our safe mainframe to your screen".

This is not where I want computing to go, and we're all just playing cat-and-mouse games feigning "security" when really "we" just don't trust the "plebs" to administer their own machines and keep themselves safe. This is arguably where Android is already, so one need only look there to see the future of computing and how the browser and "security" is being used as a trojan horse to get there.

This is an absurdist point of view.

If you go to the average non-technical user's Chrome extensions tab, they have 10-12 extensions. 7 of them are actively malicious.

This isn't like a "hey, freedom allows you the freedom to make mistakes" thing. This is a "good practice hasn't even been attempted here, and it's the top vector of all bad things ever" thing.

It's fine for browser extensions to exist, they serve a purpose. However, all existing extension stores should probably delist the entirety of their collection, solely re-accept extensions which an actual software engineer has reviewed, and make it much harder than one click to inadvertently install one when a website asks you to.

Is it more of an attack vector than the hundreds of unvettable third-party scripts the site usually loads itself?

A script loaded by a site needs to escape its sandbox. I assume an extension script is not in its own sandbox so it can read you banking details when you visit a banking website. I imagine they can read key presses so an extension can know your banking passwords.

Which is why extensions also nowadays only served via a web store which has moderation policies and moderators which look for this kind of stuff.

The Chrome Web Store is functionally a malware distribution system. There's no real moderation to speak of, and the vast majority of desktop PC malware is distributed by it.

Absolutely. Scripts compromise your activity on the site they're loaded on. Extensions compromise your activity on every single website you go to.

If you're looking at it that way, then we should apply even more scrutiny over native apps we install on our machine and not single out extensions.

Also, not all extensions run on every single site. Also, some extensions actually help in blocking malware, crypto-trackers etc so the potential upsides are also great.

Reply on news.ycombinator.com