Re:Trustworthy Chrome Extensions, by default
by X-Cubed on Monday October 01, 2018 @04:58PM
(#18116754)
A lot of that functionality is already possible through Declarative Content[1] and Optional Permissions[2]. These remove the need for extensions to have permissions to all websites, while enabling them to be given permission to a site after installation. However, these features weren't part of the original APIs, so I think a lot of extension developers aren't familiar with them, don't want to refactor their existing codebases to support these features, or are targeting multiple browsers where other browsers don't support this functionality.
1. https://developer.chrome.com/extensions/declarativeContent 2. https://developer.chrome.com/apps/permissions
For example, it would be easy for Google/Mozilla/etc to compile a list of HTML tags and attributes that can never be used to inject javascript. Lots of "HTML sanitization" libraries do this, for instance. Then, we could get permissions like "remove content", "inject non-interactive content" and "inject interactive content". An ad blocker, for instance, should work with no network access whatsoever and should never need to inject code. So I can totally lock it down to not being able to do anything except replace ads by empty <div> tags.
I think there's an opportunity for browser builders here with more granular permissions in other areas too (eg "network access but only to domains x and y", which ofc only makes sense if you can't also inject arbitrary interactive content but ok). No user is of course ever going to read those, or understand which combination of permissions make sense, but a Google reviewer can. Then the reviewer doesn't need to review anymore whether the code does something bad, but only whether the requested permissions would _allow_ the code to do something bad an whether the permissions make sense for what the extension is supposed to be doing.
Eg LastPass ought to work just fine with only "access to *.lastpass.com" plus "inject only non-interactive content".
This could be particularly powerful if browser designers would create a way for extensions to show possibly-interactive content on the top/left/side/bottom of the page (in a popover bar for instance) that is clearly not part of the page DOM. Then, LastPass can remove their "click to auto-fill" icons inside user/pass forms and replace them by a "That looks like a login form. Do you want to auto-login?" popover bar with an ok button. The UX is still great, security is greatly improved.
I don't pretend to be smarter than the teams that build browsers, so I may be missing something. Nevertheless right now I think that this, combined with the feature announced in this post where extensions can be locked down to specific websites, will remove the need for nearly any "can change anything on any website and do anything with it" extensions (which are pretty much the norm right now). Gmail extension? Website-specific. Pinterest "pin it" button? Non-interactive (make the injected button just be a selector and show the final "pin selected images" action in a popover bar). HN-Submit? Non-interactive. And so on.