Re:More on DataSpii: How extensions hide their grabs and how...
by theamk on Friday July 19, 2019 @12:17AM
(#20476131)
Why do browser extensions do so much worse compared to, say generic Linux software? I think the biggest problem is lack of reputation -- the "value" of being trusted extension author is low, as long as people can find you in the appstore, you'll get the installs.
There are probably many ways to fix this, but one of the least-impactful ways to do so is to use third parties for extension approval -- if extension authors do not care about their reputation, let's find someone else who does!
The system would be simple:
(1) Anyone can publish an "extension whitelist", a list of (extension, version, hash) entries. Maybe it's just a webpage in a special format.
(2) In my browser, I can optionally subscribe to as many extension whitelists as I want.
(3) If I have any whitelist installed, then any extension versions must be on the whitelist. Auto-update does not work if the next version won't be on the whitelist.
That's it! I am sure that once such system is in place, then would be people who would provide such whitelists. There are already people out there that examine source code of extensions they run, as the original article shows.
And additionally, one could make automatic approvals -- say an AV vendor could scan extensions from app store, and automatically make a whitelist of all scanned and safe versions.
This will be a big departure from the current extension model, and it will bring control back to the user.
... and of course, this is why there is approximately 0% chance this or similar idea will ever get implemented. Chrome nowdays is not about user control at all.
There are probably many ways to fix this, but one of the least-impactful ways to do so is to use third parties for extension approval -- if extension authors do not care about their reputation, let's find someone else who does!
The system would be simple:
(1) Anyone can publish an "extension whitelist", a list of (extension, version, hash) entries. Maybe it's just a webpage in a special format.
(2) In my browser, I can optionally subscribe to as many extension whitelists as I want.
(3) If I have any whitelist installed, then any extension versions must be on the whitelist. Auto-update does not work if the next version won't be on the whitelist.
That's it! I am sure that once such system is in place, then would be people who would provide such whitelists. There are already people out there that examine source code of extensions they run, as the original article shows.
And additionally, one could make automatic approvals -- say an AV vendor could scan extensions from app store, and automatically make a whitelist of all scanned and safe versions.
This will be a big departure from the current extension model, and it will bring control back to the user.
... and of course, this is why there is approximately 0% chance this or similar idea will ever get implemented. Chrome nowdays is not about user control at all.