Trustworthy Chrome Extensions, by default

Re:Trustworthy Chrome Extensions, by default by zbowling on Monday October 01, 2018 @05:11PM (#18116851)

You are not the majority of users though that have the ability to check extensions code to vet them. That would be a huge feature ask for small number of users and I bet you would suffer from review fatigue reading all updates to all extensions. This was the problem with many grease monkey scripts and why addons/extensions are king.

[ Parent | on HN ]

Re:Trustworthy Chrome Extensions, by default by snaky on Monday October 01, 2018 @06:08PM (#18117229)

That's why people invented peer review.

You cannot read all the code of all the extensions you use, and if you are 'regular user', you shouldn't, but you trust some power users, researchers, developers who read the code of particular version of particular extension.

All that is needed is some infrastructure for that. You could even tune the percentage of people you trust who audited the new version of extension to mark it automatically updated for you.

That's not actually have to be anonymous audit process, most of the people in security industry have names, and you know, they actually use extensions too, so they usually read the code anyway. All we need is the checkbox where they could 'ack' the extension.

[ Parent | on HN ]

Re:Trustworthy Chrome Extensions, by default by hollerith on Monday October 01, 2018 @10:47PM (#18118479)

To get the arrangement you describe would require Google to voluntarily give up some of its current control over Chrome (or for Chrome users to switch to another browser).

[ Parent | on HN ]

Re:Trustworthy Chrome Extensions, by default by meesles on Monday October 01, 2018 @05:39PM (#18117059)

So if you can't ask the downloader to verify the code, and extension developers can put almost whatever they want on your browser, what are you supposed to do? Just trust randoms to not infect your computer intentionally or neglectfully?

Unless there's another option, I agree with the OP of this thread. Not allowing a 'locked dependency' type of mechanism for extensions continues to be very dangerous.

Alternate idea: Google can take responsibility for software they are distributing in a more serious manner.

[ Parent | on HN ]

Re:Trustworthy Chrome Extensions, by default by Flenser on Tuesday October 02, 2018 @01:35AM (#18119061)

One thing you can do to mitigate risk is to disable any extension you aren't actively using day to day and only turn them on when you need them. If an extension goes rogue it will then hopefully be detected before you activate it again.

[ Parent | on HN ]