Re:The Great Suspender: New maintainer is probably malicious
by Triv888 on Sunday January 03, 2021 @11:15AM
(#25622605)
Of course it would not be the only element in the table. But either way, it would at least tell you that an extension is leaking data when it isn't supposed to leak data (for extensions that should not require an Internet connection).
Re:The Great Suspender: New maintainer is probably malicious
by ashtonkem on Sunday January 03, 2021 @11:48AM
(#25622863)
I personally would find such an inscrutable name suspicious.
Re:The Great Suspender: New maintainer is probably malicious
by gruez on Sunday January 03, 2021 @12:03PM
(#25623006)
Why? Would connecting to "api.example.com" be less suspicious? The same issue would still be present (namely, smuggling requests to "shady" domains using a mundane domain), and the only difference would be that it demonstrates the author paid $10/yr for the domain.
Re:The Great Suspender: New maintainer is probably malicious
by ashtonkem on Sunday January 03, 2021 @01:38PM
(#25623869)
I should be able to clearly determine the intention of any domain that an extension is going to call. Anything that tries to obsfucate the actual underlying purpose is a red flag.
One might not like Google analytics, but at least you know exactly what you’re going to get when someone calls analytics.google.com.
It doesn't have to be as overt making it look like a proxy (eg. a endpoint that makes arbitrary http requests on behalf of the caller). It can be as simple as changing the endpoint for the spying service from https://evil.example.com/api/ to https://484044b296.execute-api.us-east-1.amazonaws.com/evil/...
> Some more investigation would be required in some cases.
The point is that the "nutrition facts label" doesn't really do anything because it's trivial to bypass. If it becomes widespread I guarantee every malicious addon maker would adopt this tactic.