Re:Massive spying on users of Google's Chrome shows new secu...
by kevingadd on Thursday June 18, 2020 @04:06AM
(#23560877)
It's very possible to solve this but not without completely overhauling WebExtensions. It's a relatively bad, old API that has multiple security problems paired with a distribution platform (the Chrome Web Store) that is severely neglected and also poorly designed for dealing with security threats. Fixing this would basically break every existing extension, and Firefox is living proof that doing this (for basically any benefit) is very expensive.
Unfortunately since the Firefox team gave up and just adopted WebExtensions wholesale and Edge is dead, the only vendor that's likely to do anything about this is Apple, which means you only get to benefit from a better extension security model on OS X (and maybe iOS, one day).
The idea you describe of tagging data from sensitive sources and limiting its flow is something that's been done in production software here and there, but never to the extent necessary here. It's commonly used to mitigate SQL injection attacks [https://en.wikipedia.org/wiki/Taint_checking]. Part of the problem is that the real issue here is not whether the data is privileged, the issue is whether the use of the data is permitted. If I install the 'Google Translate' extension it wants access to all my tabs, which is technically correct - if I ask it to translate some text in a gmail tab, it's going to need to access that gmail tab. But that doesn't mean I also want it to harvest all my emails and POST them to a server somewhere. You can say "well, disable POST requests", but how are the translation API calls going to hit the remote server?
Naturally gtranslate isn't going to exfiltrate my emails, but if the translation extension was maintained by a smaller vendor, some state-level actor could buy them overnight no problem.
Unfortunately since the Firefox team gave up and just adopted WebExtensions wholesale and Edge is dead, the only vendor that's likely to do anything about this is Apple, which means you only get to benefit from a better extension security model on OS X (and maybe iOS, one day).
The idea you describe of tagging data from sensitive sources and limiting its flow is something that's been done in production software here and there, but never to the extent necessary here. It's commonly used to mitigate SQL injection attacks [https://en.wikipedia.org/wiki/Taint_checking]. Part of the problem is that the real issue here is not whether the data is privileged, the issue is whether the use of the data is permitted. If I install the 'Google Translate' extension it wants access to all my tabs, which is technically correct - if I ask it to translate some text in a gmail tab, it's going to need to access that gmail tab. But that doesn't mean I also want it to harvest all my emails and POST them to a server somewhere. You can say "well, disable POST requests", but how are the translation API calls going to hit the remote server?
Naturally gtranslate isn't going to exfiltrate my emails, but if the translation extension was maintained by a smaller vendor, some state-level actor could buy them overnight no problem.