Trustworthy Chrome Extensions, by default

Re:Trustworthy Chrome Extensions, by default by seanwilson on Monday October 01, 2018 @11:48PM (#18118673)

> Again, it's not hard for a malicious extension/app to do that, it's just that only the malicious extensions/apps are going to do that. So it becomes easier to educate users with simple rules like, "if a site asks for a permission that's unrelated to what you're doing, always say no."

Are you sure it's this simple? Adblockers and password managers for example require wide ranging permissions to work and there's plenty of popular extensions in the same situation.

[ Parent | on HN ]

Re:Trustworthy Chrome Extensions, by default by Ajedi32 on Tuesday October 02, 2018 @12:07AM (#18118726)

Password managers don't need extensive permissions, they just need a built-in autofill API. Similarly, you could implement a basic adblocker via a declarative content blocking API.

Fine-grained permissions will allow for this sort of thing.

[ Parent | on HN ]

Re:Trustworthy Chrome Extensions, by default by seanwilson on Tuesday October 02, 2018 @11:34AM (#18122623)

Does that cover the functionality of most popular extensions though? When there's an API that matches up with the purpose of the extension, it's more straightforward. I would have thought the popularity of those particular example extensions is what partially drove the creation of those APIs as well.

[ Parent | on HN ]

Re:Trustworthy Chrome Extensions, by default by Ajedi32 on Tuesday October 02, 2018 @12:04PM (#18122891)

The APIs I mentioned in my previous comment don't exist yet. My point is that Google is going to need to _build_ APIs to fulfill all of the most common use cases (including those ones) in order to succeed in their goal of making extension permissions more fine-grained.

So yes, the functionality of most popular extensions will be covered by the new APIs, because Google will designing the new APIs with those popular extensions in mind.

[ Parent | on HN ]