Hacker News Reader

Comment by ocdtrekkie | Hacker News Reader

This is going to be the new best feature for malware developers. (Note: Unpoliced malware is RAMPANT in the Chrome Web Store, Google is not policing it properly.)

View on HN

Because it makes it more convenient for people to voluntarily add the malware to their home screen and later voluntarily launch it?

Sorry, not seeing the malware connection. There's no extra permissions granted here.

BTW I agree Google should do more to improve the security model of extensions and apps on the Chrome store. I shouldn't have to grant the right to see all content on all pages just to pretty-print JSON responses. But don't confuse today's announcement with Chrome Web Store apps or extensions. There could be convergence later, but so far it's just a rev on the Install To Home Screen feature that's been there on iOS since it began.

Not true.

The user has to visit "your site twice over 2 separate days during the course of 2 weeks". Also a valid SSL certificate, service worker, and manifest file. We're definitely not in the 1990s with IE's AddFavorite() free-for-all anymore. :)

Emphasis could be added on the animated gif.

Check back in a year and see how much of the consumer protection Google has quietly removed. Look at the history of Facebook privacy defaults. (http://mattmckeon.com/facebook-privacy/)

This has nothing to do with anything.

There is one mitigating feature:

> The user has visited your site twice over two separate days during the course of two weeks.

This should help reduce the number of casual shitty sites that can make use of this - the user has to at least have a reasonable level of engagement before this triggers. It's far from foolproof but it is a promising start.

Right, but goog is weighing malware + cash vs not helping exploit their users and coming down on the side of malware. I'm sure the cash is incidental to this decision. It's really disappointing.

Yet another reason to tell your parents to buy iphones.

Google made this decision a long time ago. Try searching Google for "flash player". The top two links are malware. Google knows their AdWords are used to slip malware at the top of download searches for major products, but has never done anything about it, like say, disabling AdWords on a term like "flash player" where any paid ad is basically guaranteed to be malicious.

This is a twofold benefit for the sleezy company: Google gets paid directly by malware developers, and the added malware on people's computers helps drive consumers to switch to Chromebooks. The "rampant malware on Windows" problem is largely a Google creation, and of course, Google advocates their product as the solution.

Wow. That just really changed my model of paid search results... and I'm not quite sure yet how to put it back together.

I clicked both results for "flash player" and nothing on my computer (Mac) or in the browser (Chrome) warned me, whereas I have received warnings on other sites for "phishing attempts". I never would have downloaded anything from those sites, but my parents sure would have.

Who knows, if I were in a hurry and it was a program I wasn't familiar with or that I was trying to get for free? And if the site was more polished or a full html/css clone of the real site? It honestly might have worked on me.

What kind of malware do these bogus paid results contain? What would have happened if I'd installed them? What can you do to defend against that besides being a savvy web user?

Thanks for this. I learned something.

What?

How is making it easier for developers to distribute apps on the open web "malware + cash"? It's more like balancing the risk of malware against the benefits of openness and encouraging web app development.

It sounds like you might be misunderstanding the feature. Can you explain precisely how you envisage it being used by malware?

We certainly want to make sure that it leads to a great experience. With the browser controlling the heuristics of when then pop-up fires I think we can mitigate some of the risk.

That does sound like it may help, though I wouldn't count against common users being regularly shunted through malicious portals.

Spam is my biggest issue for Chrome on mobile (not that much malware, so far PlayServices/Bouncer has done a great job for me). There are many sites that launch an intent to the play store for a random app. Some others that launch a download of their app. It makes navigating some websites a pain. I fear that this feature will be exploited as well.

Reply on news.ycombinator.com