Mozilla is miles ahead of chrome with recommended extensions [1]:
> Recommended extensions undergo full code review by staff security experts to provide a strong additional security check.
It has a list of blocked addons [2]. And I believe that is Chrome who turned addons into Wild West, Mozilla had a long review process [3].
[1] https://blog.mozilla.org/firefox/firefox-recommended-extensi...
[2] https://blocked.cdn.mozilla.net/
[3] https://blog.mozilla.org/addons/2010/02/15/the-add-on-review...
> Human Web
> ... turned on by default
> Data Collection: In order for Human Web to function we automatically collect non-private URLs, search queries along with search engine results pages, suspicious URLs that could potentially be phishing websites, information related to safe and unsafe trackers, and information related to the prevalence and performance of Trackers.
So opt out data collection, I thought better of Recommend Extensions. They really should use leverage to make safe defaults and forbid dark patters.
[1] https://addons.mozilla.org/en-US/firefox/addon/ghostery/priv...
What would really be practical were some kind of extension analyzer/profiler that runs newly installed addons in a sandbox and displays attempted connections and payloads. Or a mode where connections need to be whitelisted, to limit the impact of silent addon takeovers.
Too many times I find myself having to download, unpack, and skim through an addon's source to make sure it's not doing anything malicious under the hood.
[1] https://addons.mozilla.org/en-US/firefox/addon/ghostery/
Yes, that would be good. I would love to hear that someone I trust checked latest version. If enough people joined we can make distribution.
And, hey! It is MPL-2 [1], bad defaults can be patched.
I'm a little confused. I used to use ghostery (don't anymore), but there was always an option to have them not collect data. This is even a recommended app! I went to their privacy policy to check
> II. Basis to Collect and Use Personal Data There is no obligation on your part to provide your Personal Data. However, if you do, we have a legitimate interest to collect and use it, namely so we can provide products or services, or complete a transaction with you.
> III. Notion of Personal Data Personal Data means any information concerning the personal or material circumstances of an identified or identifiable individual such as name and age. Non-personal data are all data that cannot be used to identify an individual, such as statistics about usage of a website.
2. Firefox took years and years to lock down extensions like Chrome, and people were legitimately upset that they turned extensions into basically privileged webpages in the name of security. They used to be more like software. It wasn't until what 2017 or 2018 that Firefox truly took security seriously and stopped letting extensions run application code.
3. Chrome didn't turn extensions into the 'wild west'! For the record, Firefox 3.0 had "Add-ons" in 2008 a few months before Google released Chrome 1.0!
2. Sorry, could you please make your point clear (edit)? Firefox third party extensions used to access internal constructs. I think most of what is Firefox on top of Gecko is privileged extensions.
3. Yes, Firefox had addons with review process.
3. Firefox does not manually review every extension, they perform some cursory virus/malware scans, same as Google. I think you're really overplaying the idea that Firefox has some manual review process ensuring only quality and safe extensions are uploaded. The best way to demonstrate this is to point out that Firefox must frequently ban released extensions -- extensions which passed these so called reviews.
3. Today looks like every browsers gallery dropped security. I was talking about days before Chrome and how things changed. I gave a link, there were just several blocked addons in 2008-2010. Something changed and I remember publishing process was different in Firefox and Chrome. Search gives me no complains about long review in 2010 for Chrome.
I am not Mozilla funboy. I do not think that Mozilla actions is enough, Chrome had good things too - reviews without "I like it" and "Works for me". Everyone deploys automatic scan. Manual review is better than no manual review. How many extensions from Recommend list were blocked?
We have to find a way to reduce pressure to buy/sell addon for use as spyware. Someone has to think twice before trying to buy Recommended addon. Or looking on a list of blocked addons. Or maybe someday "Collects data" badge. Today Mozilla is ahead, just copy and move on.
[1] Mike Pinkerton on Mozilla and Camino https://www.youtube.com/watch?v=ttiZevbtvf0
Honestly, uBlock Origin and Privacy Badger are so important at this point they should just become part of the browser itself. They're already in a league of their own.
uBlock Origin just happens to be so important and trusted by the community that it shouldn't be subjected to these restrictions. It's a special case.
I'm not sure if builds are reproducible though. I don't think the author would allow the extensions to be hijacked by malicious actors but it'd still be nice to be able to verify a packaged extension was built from a given git commit.
Most browser extensions these days are just some JS zipped up with some metadata and maybe a few assets, right?
There might be trouble with minified JS, but I'd assume most optimizers/minifiers are either deterministic or could be configured that way.
But I can’t find any other reason why I don’t think that that isn’t the case.
I use uBlock Origin myself but I sometimes question the faith we place on open-source. We assume someone else is looking at the code.
{ "curator": {
name="Alice",
pubkey="...",
url="..."
},
"artifact": {
type="software",
name="Bob's App",
version="1.2.3",
published_file="bobapp-1.2.3.zip",
published_file_sha256="...",
published_file_url="..."
},
"statements": [
{ "type": "member_of_collection",
"name": "Recommended Apps" },
{ "type": "attestation",
"name": "Passed Audit FOO",
...audit info... }
]
}
A key feature is verification. A user should be able to easily inspect the known "curator statements" for an app for the curators the subscribe to, and be able to run a "git fsck"-style validation that proves "this app really is the version that: passed the EFF's 'No Tracking' audit, is on reviewer Carol's 'Recommended' list, was rated "Teen" by the ESRB, and is on my friend Dave's 'Cool stuff you should try' list.
With such a system, anyone can perform an audit, and people can make their own decisions about what they want to trust.
I like this idea and think it would be a great addition to the development world.
[1] https://packages.debian.org/search?suite=default§ion=all...
The "underhanded C contest" [1] is a good example of this and something I like to point people to. From their about page:
>The Underhanded C Contest is an annual contest to write innocent-looking C code implementing malicious behavior. In this contest you must write C code that is as readable, clear, innocent and straightforward as possible, and yet it must fail to perform at its apparent function. To be more specific, it should perform some specific underhanded task that will not be detected by examining the source code.
If you go look around the hall of fame on that site, or just take a look at the contest winners, it's absolutely insane how subtle some of those exploits are. And shockingly (to me anyway) many of the exploits don't require C or use some quirk of C, they would work in many different languages, the first contest winner is a perfect example of that [2].
I can honestly say that for some of them, even if you told me there was an exploit in the code, I wouldn't be able to find them on my own.
And the scariest part is that almost all of the submissions to that contest have plausible deniability. They look like innocent bugs, typos, or small logic mistakes. Some even layer multiple small subtle changes which each on their own are completely fine but when all run together reveal big exploits.
That is an awesome site, thanks. Sadly the contest seems to have stopped in 2014.
https://chrome.google.com/webstore/detail/extension-manager/...
[0]https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium...
[1]https://github.com/gorhill/uBlock/wiki/Blocking-mode:-hard-m...
* * * block
* * frame block
* 1st-party css allow
* 1st-party frame allow
* 1st-party image allowWhat about Ghostery?
As far as I know this changed later on, but still.
[1] http://www.schillmania.com/content/entries/2009/adblock-vs-n...
The only side channel I can then think of is using page rewriting or timing to communicate when the user browses to a page controlled by the extension owner. This would be something that there is at least a hope of spotting?
===
> The host permission in current extension framework does not distinguish between accessing all the data and connecting to any remote server.
>
> The key issue I see is that it also allows uBO to connect to any remote server. I think it would help a lot to have a _separate_ permission for remote server access, since this is the key privacy issue here: user data leaving the browser to be collected by a remote server.
>
> So what about a new permission specifically dedicated to specify where an extension is allowed to connect? Without this permission, an extension wouldn't be allowed to connect to a remote server, i.e. unable to leak user data.
===
As a mental framework, I consider the ability to see the URL of all requests or all the DOM to be a read operation, while extensions making requests to remote server (directly or indirectly) is a write operation (to the wide internet). The latter is where the real privacy concerns are, and this is what should be tackled in some manner. I don't see manifest v3 addressing this[1].
* * *
[1] https://www.eff.org/deeplinks/2019/07/googles-plans-chrome-e...
Web Extensions caused lots of outcry, when it was mostly about making extensions async and better sandboxed.
EME caused similar outcry, when in fact it migrated us away from plugins riddled with security vulnerabilities (hint Flash). Today most DRM crap runs in a sandbox -- DRM still sucks, but it doesn't compromise my browser :)
I'm suspect, extensions will be sandboxed further, but this will take time.
Elements filtered by uBlock origin are typically not even loaded over the net. That means that an outside observer can see what uBlock origin does.
However, you could envision a variant of uBlock origin that still loads everything, and only does cosmetic blocking.
But eg an extensions that is supposed to protect your privacy will have to have an influence on your browser's network output.
Still: The bandwidth of the side channel can be dramatically reduced with a combination of a limit on the number of fixed addresses that can be requested and a limit on the rate of URL requests.
If only one fixed URL may be requested, then the only information revealed[1] is the fact of the request (1 bit) and the time of the request. If that URL may only be requested once per day, scheduled at a time of day chosen uniformly at random, then side channel bandwidth is limited to 1 bit / day, so it would take a good chunk of a year to exfiltrate a disk encryption key. If that URL may be requested only once per week, then it would take nearly five years to exfiltrate a 256-bit key.
Configuration data does not need to be updated so frequently, so this seems like a reasonable strategy.
[1]: (except for potential request metadata that you leak across the web anyway, e.g. IP address or browser user agent string)
In the late 90s I read a paper about using page faults to exfiltrate data to a low privilege process on a TCSEC B [1] system. A very low bandwidth, noisy side channel was created by using different amount of memory in a privileged process. The low privilege process received the data by initially allocating a large amount of memory and regularly walking across pages while timing each memory read to detect page faults. It was extremely noisy, but a standard error correction scheme and some clever tuning let them exfiltrate data at "a few hundred bits"/hour.
That might be plenty of bandwidth, if you're trying to send keys, names, ID numbers, etc. As usual, the utility of a very low bandwidth channel depends on your threat model.
> e.g. IP address or browser user agent string)
Or the variations in your OS's IP implementation that allow nmap to guess your OS[2]. Or the various "random" ways[3] different OS generate the TCP ISN (Initial Sequence Number).
Security is hard... ~sigh~
[1] https://en.wikipedia.org/wiki/Trusted_Computer_System_Evalua...
https://blogs.akamai.com/2017/09/introduction-to-dns-data-ex...
DNS tunneling is a well-known exfiltration technique which can place data inside of DNS request packets. There are several methods of placing the data in the request packet. In such a case the DNS query might appear as a benign request for IBM.COM's ip address.
To me there has always been a trusted part of computing which is audited to some extent and marked as trusted. Browser extensions work the same way as software on an operating system. If they blocked all extensions outside trusted ones they would be criticised as well. However the auditing process is very controversial and could become like the Apple’s App Store where the apps/extensions maybe blocked for reasons other than just security to make it anti competitive which is certainly something possible with chrome
If the main selling point of your browser or OS is that you protect the privacy of your users you simply can't act like that, because most users are not aware of the data collection that is happening via these extensions.
With mobile apps we're in a similar situation, companies like X-Mode exfiltrate and sell location data via apps that claim to protect your privacy. Desktop software: Same story. Anti-virus software that is supposed to protect you actually exfiltrates personal data from your computer.
So yeah if you build an open platform there will be such abuse, but if you position yourself as a champion for privacy you simply can't allow that (or at least you should try to make it more difficult).
There are simple counter-measures that browser vendors could employ: Showing users how much data a given extension sends to a backend and ideally making that data transparent would be enough to stop most of these practices, because people would then realize that their free screenshot app somehow sends every single URL they open to a backend service. Right now this can happen entirely without the knowledge of the user. You can't control what you cannot see and understand.
Exactly! I find it abhorrent that not even Firefox has something straightforward like that as a “first-class” feature. Most of the extensions I use shouldn't need to communicate with any server at all to begin with, so having to just trust the author's words or manually audit the code on every update (or stop them altogether) and maybe fork the project (if that's even possible)... Doesn't make sense.
The one thing I'm aware of that these extensions could do to sidestep such a mechanism is to inject scripts on pages that then exfiltrate your data, but injection could also be blocked, and as a last resort I trust uMatrix would have me covered ;)
> Automatically Collected Information
> Internet Protocol Address (trimmed to permanently remove specific location information other than country, city & postal code); device type; operating system and browser; Search engine results page (keyword, order/index of results, link of result, title, description, ads); web pages visited and time stamp of the visit; display ads; and WOT user ID.
That is awful [3] but that's what almost every web page wants to do. Privacy Respecting browser should not run javascript, ignore cookie, and block non 1st party resources. That's what my browser does. But this is not where consensus lies.
As I understand Mozilla allows to collect information if it is defined in Privacy Policy. It would be great to have badge "Collects Information".
[1] https://addons.mozilla.org/en-US/firefox/addon/wot-safe-brow...
[2] https://www.mywot.com/privacy
[3] https://www.pcmag.com/news/web-of-trust-browser-extension-ca...
The data under "web pages visited and time stamp of the visit" is your clickstream data (you can check which data the extension sends using the network tab in the extension developer tools, though some extensions go to great lenghts to obfuscate it).
Most of the users live in Privacy Nightmare and accept it. They also run closed source OS and applications. The truth is privacy has a cost - monetary (Apple ecosystem) or time/experience (Linux etc).
Apple can hire maintainers, Linux users can become maintainers. Those who live in free as beer land has free as beer support.
https://support.google.com/chrome/a/answer/9296680?hl=en
I wonder if there could be a community pseudo-enterprise that could eg have a reasonable whitelist of extensions...
edit: whoops, that was a windows-only guide despite the title, here are linux / mac links: https://support.google.com/chrome/a/answer/7517525#permissio... https://support.google.com/chrome/a/answer/7517624?hl=en&ref...
It's super easy to blame some semi-known Israeli company where in fact it's a way for companies like Google to bypass their own security policy and restrictions.
- Google does not collect all website data
- Google creates an extension model that allows a third-party to collect all analytics data
- Google buys said analytics data and has access to it.
It's done in a somewhat semi-regulated way, but the whole thing is a regulation bypass companies like Google do that will (hopefully) eventually be plugged.
This is similar to the toolbar and installer industry of 5-10 years ago.
> We do not want ...
does not mean we do not do
> any data collected from you simply by your use of our product will never be used to figure out who you are or to send you targeted ads, and will not be shared with any other parties for those purposes.
does not mean impossible, yes, that's was not on purpose (like facebook cambridge analytica)
> Standard web server log information (i.e., page views)...
> ... browser type, operating system, device model name, device screen size, time and date. We further collect IP Address (trimmed for anonymization).
I can't process this.
Compared with Stylus [3]:
> Privacy Policy
> Unlike other similar extensions, we don't find you to be all that interesting. Your questionable browsing history should remain between you and the NSA. Stylus collects nothing. Period.
[1] https://robertheaton.com/2018/07/02/stylish-browser-extensio...
[2] https://userstyles.org/login/policy
[3] https://chrome.google.com/webstore/detail/stylus/clngdbkpkpe...
I look at the 20 I've got installed and wonder which are using the "Access to every website" permission for their own ends.
For example at the extension I help maintain (Testim Editor) we literally do test automation which requires elevated permissions.
Check Privacy Policy, if none exists it is either clear or non conformant. Extensions which states they collect data are not removed - for example Stylish, Web of Trust.
- Ad blocking - Reporting analytics to home base for product feedback - Mocking network requests to make certain pages load faster. - Performance analytics for the page's network (like the devtools).
Please remember that some extensions are not free, we companies like Microsoft paying a substantial amount of money for the extension we develop (Testim Editor) for example.
That's not generally true. It depends on the permissions. If you grant an extension permission to access every page then yes it can do that. That's not bypassing all security measures.
Companies like SimilarWeb and Alexa (not Israeli) do the thing OP describes.
It feels very unfair to malign Israel here when the majority of surveillance on the web for money is happening in other countries.
But yes, saying Isreal does undermine privacy to a disproportionate amount is probably false.
Not only sigint, weapons tests in general are also conveniently outsourced.
I have an open mind about whether any particular allegation against Israel (or any other country) is true, but if people won't make the allegation specific it is impossible to judge.
As an American I feel Israel is only an ally like Saudi Arabia is an ally in that it's a country doing terrible shit I disagree with that dislikes other countries politicians I dislike hate.
(I do not really think the US - or Isreal for that matter - is like Saudi Arabia AT ALL, Saudi Arabia is a horrific place and that comparison is pure madness by OP - but the "doing terrible shit" part is very true.)
Extensions are ideal to exfiltrate data from browsers as they bypass all security measures and can literally see everything you do on every single page you visit. It still boggles my mind how you can call a browser secure and privacy-friendly (in the case of Firefox) and at the same time allow such blatant abuse for years and years. Me and other people have been pointing this out since at least 2016 and demanded better security controls for plugins / extensions but I’m getting really tired of it.