Hacker News Reader

Comment by dcow | Hacker News Reader

This is a spicy essay for sure but what is the author's actual point? If the user grants you permission to do all these things, then you have permission to do all these things. If you can't be trusted and abuse that permission then you are not ethical. If you aren't ethical someone will find out and your extension will be removed in the worst case and simply not approved in the common case. The author even admits as much saying this thing would never pass Google's review process in a million years. Sounds like there's no real risk here and we're mostly just enjoying the show...

I do agree about the permission UI box. Surely that's a completely simple fix on Google's part to force the user to scroll through the permissions box before accepting.

View on HN

Is that solving any real problem? Will any single person actually be protected by that annoyance? The permissions already appear roughly sorted by invasiveness. Is the sixth one really going to be the one that your install decision hinges on? I mean, once you have "Read and change all your data on websites" it's game over anyway if the extension is truly malicious.

I think perhaps we need to agree on the real problems that exist.

It's not like users are getting their data stolen left and right out there and man these extension trojans are winning the battle against good extensions and we just can't shake 'em. All your base... are belong to us.

It seems the status quo is that extension fraud, while entirely possible as this article demonstrates, is not actually a problem. If you don't trust a piece of software to access your webpage content then don't grant it the permission to do so. I think the onus is on alarmist pieces like this to bring the data supporting the existence of a problem to be alarmed about in the first place.

I mean, raise your hand if you've been pwned by a malicious Chrome extension recently...

It's very early for users to not understand and for apps to ask for a bunch of permissions. One great example is Grammarly, which is a keylogger that helps users with grammar. I don't think Grammarly has bad intentions, but still, millions of users are giving it access to everything they type.

How else would it correct their grammar? Users want it doing that. It’s not malware.

Okay, maybe "keylogger" was incorrect, but Grammarly has the potential to expose users to all types of security risks they might not realize are possible.

Here's a past example: https://bugs.chromium.org/p/project-zero/issues/detail?id=15...

I have nothing against Grammarly; it's a legitimate company and they seem to respond well to security vulnerabilities, but it still bothers me because a user doesn't think through the potential ramifications of using software that records every keystroke.

It's a tutorial to build a Chrome extension. Like, a project template. He links source code, found a privacy issue in Chrome, and the Grinch-plundering Whoville character made me laugh. That's already asking a lot for a Substack post.

> force the user to scroll through the permissions box before accepting.

Something else used to do that. Java, maybe? Whatever it was had regular enough updates that I _habitually_ drag the scroll bar directly or simply hit the end key to this day when I get to EULAs and other long modal popups.

Reply on news.ycombinator.com