Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum.
And I'd also really like a way to track both injected scripts and elements so that they wouldn't be able to make any HTTP requests without additional permissions, not even an <img src="..."> tag if the src isn't just a data URL or local extension resource.
E.g. I want to be able to install an extension that stops YouTube videos from playing as soon as I navigate to the page, without worrying my entire browsing history or worse is being sent to a third-party.
They already can: extension authors can specify that their extension only operates on specific URL's.
The problem is that most extensions are designed to work on all web sites, so you have to choose between security and convenience.
Most users pick the latter and trust the former.
This model works pretty well overall since harmful extensions never take long before getting flagged by the community.
No, this model works pretty well for stealthy extensions which take malicious actions without getting detected.
This seems like a good idea until you realize that the behavior you might want to modify is coming from a different domain loaded by the page and you have no control over how they set that up.
Does Chrome not support this? One more reason not to use it.
The non-reddit domains are for expando capability.
This would break adblockers, which are by far the most commonly used extensions
Isn't the situation the same with Mozilla? I thought that the reason was that most extensions do, in fact, need to be able to view and modify all your web browsing traffic. For example, my essential addons are uBlock origin, uMatrix, and Tree Tabs. Clearly the first needs to modify web pages, the second needs to intercept traffic, and the last needs the entire list of web pages I have open.
Can you give an example of an extension which requires permissions it shouldn't need?
Whether it should be done in a more finely grained way, not sure, but if you have the permissions to modify then by definition you have the permission to remove or add content.
That's an unfair comparison. Any piece of software could try and 0day you. The point is that in a permission-based system, the permissions for browser extensions are in practice far too permissive to the point of being broken.
>You can't blindly trust anything "from the wild" yet you can't really live without it.
The point about permissions is to provide granularity to trust. I may trust an app to use my camera without trusting it to track my location in the background.
>Every app can abuse its permissions and track you/upload your photos/eavesdrop on your conversations.
This is the best comparison - mobile phone permissions - and on this front browser extensions are far worse. The majority of every single extension I install wants complete control to everything. In contrast, most apps only require a few things as appropriate. Yes, there are those flashlight apps which require _every_ permission, and those are basically the standard of extensions.
It should be added that UXSS (basically a malicious extension) is basically an RCE in the browser which in some cases is more beneficial than a full RCE, e.g. easier to steal banking creds.
Java applet loading felt like 30 seconds of staring at a gray reactangle while your entire browser ui locks up, sometimes ending in "applet uninited"
Flash game loading was just a few seconds of a black rectangle, browser ui did not lock up, then custom loader, and it usually worked.
No, it hasn't. Almost every single extension I install tells me some variant of "This extension can intercept and modify all of your browsing traffic". That's not "well balanced", it's completely broken. This is happening clearly for extensions by well intentioned people that do not need those permissions. I can't help but cynically interpret the current situation as intentional on Google's part because having the security model be "trust Google to vet the extensions" happens to centralise all the power with them. If you can't trust an extension from the wild then they might as well not exist, right?
People laughed Java out of the browser because it took 500ms to start, but at least it had an actual security model.