News for hackers. Stuff that matters.

A comment on Browser extensions are underrated: the promise of hackable software. Parent comment

Re:Browser extensions are underrated: the promise of hackabl... by hota_mazi on Tuesday July 30, 2019 @02:49AM (#20562617)
> Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum.

They already can: extension authors can specify that their extension only operates on specific URL's.

The problem is that most extensions are designed to work on all web sites, so you have to choose between security and convenience.

Most users pick the latter and trust the former.

This model works pretty well overall since harmful extensions never take long before getting flagged by the community.

[ Parent | on HN ]
Re:Browser extensions are underrated: the promise of hackabl... by TuringTest on Tuesday July 30, 2019 @03:29AM (#20562789)
> This model works pretty well overall since harmful extensions never take long before getting flagged by the community.

No, this model works pretty well for stealthy extensions which take malicious actions without getting detected.

[ Parent | on HN ]
Re:Browser extensions are underrated: the promise of hackabl... by jsutton on Tuesday July 30, 2019 @10:20AM (#20565040)
It also works well for normal useful extensions. We can figure out ways to eliminate stealthy malicious extensions without removing the most useful feature of extensions.
[ Parent | on HN ]
Re:Browser extensions are underrated: the promise of hackabl... by lozenge on Tuesday July 30, 2019 @02:45PM (#20567885)
Nacho Analytics just shut down after slurping all full URLs from 2 million extension installs for over six months.
[ Parent | on HN ]