News for hackers. Stuff that matters.

A comment on Malware in the browser: how you might get hacked by a Chrome extension. Parent comment

Re:Malware in the browser: how you might get hacked by a Chr... by ungzd on Monday July 18, 2016 @11:27AM (#12115615)
Most useful extensions require access to all sites so permissions system isn't very helpful at all.
[ Parent | on HN ]
Re:Malware in the browser: how you might get hacked by a Chr... by medmunds on Monday July 18, 2016 @11:51AM (#12115789)
> Most useful extensions require access to all sites

That may be true for "always-running" extensions like ad blockers, but there's another useful class of "on-demand" extensions that don't need full access -- think Evernote or Pinboard clippers. They only need access to the one site you're looking at, and only when you invoke them.

Chrome added a tightly-scoped "activeTab" permission a few years back, for exactly this case. Before that, on-demand extensions did need all-sites access, and unfortunately a lot of extensions (and tutorials and example code) haven't been updated.

https://developer.chrome.com/extensions/activeTab

[ Parent | on HN ]
Re:Malware in the browser: how you might get hacked by a Chr... by leesalminen on Monday July 18, 2016 @11:28AM (#12115623)
I agree. I think that there could be more finely grained permissions. I basically have so sigh and resign myself anytime I want an extension badly enough.
[ Parent | on HN ]