How on Earth is "Offered by: Microsoft Corporation" not verified in literally any way whatsoever. That's so poorly vetted it's negligent.

Maybe extensions and apps should be signed by domain ownership?

That one is legit, I'm guessing Chrome requires users to use a gmail account in order to submit an extension to their store.

https://blogs.windows.com/windowsexperience/2021/02/05/simpl...

Talk about training users to fall for phishing schemes. Plus users have been so desensitized to entering 2FA codes they’ll type them in anywhere. I feel like web security is worse than it was 10 years ago.

We need webauthn not just 2FA

Love how the goalposts keep moving.

First arcane password rules so it takes 5 minutes and half a dozen attempts to come up with a password that is accepted. Then force the user to change it often. Then add email verification. Then SMS/phone verification. Still not good enough, now we all need to have a hardware token to buy the counterfeit garbage for sale on Amazon. Fuck that. It's just not worth the trouble. Honestly the world was a lot easier (if a bit slower) when you dealt with businesses in person or via mail. Fraud and identity theft just doesn't scale in meatspace, so it was never a big problem.

I maintain that most of what we get from the Web and computers, as individuals, is barely better than what we had before, and not enough so to justify its costs. Shopping very much included.

For some context, I grew up very much "OMG wire my brain in, let's get this future shit going!" Years of watching that future develop, and some reflection, have almost entirely reversed that sentiment, for me.

For example: are streaming services convenient? Yeah, of course. Am I actually happier with them than I was with the library, rentals, and the occasional purchased movie? Marginally, if at all. (but I have Internet service for the handful of things it actually is highly beneficial for, so, may as well use streaming, too)

Is shopping online convenient? Yes. Am I happier than when I just had way less idea what was available to buy, and there was more friction to indulging every little purchase-whim? I really wonder. This one may not just be marginally better, but net-harmful.

I can consume an order of magnitude more diverse and interesting media than I could without the internet. I can order exactly the right thing from the internet instead of making do with a kind-of solution from the store.

I think you're remembering what it was like pre-internet with rose-colored glasses.

The internet is great.

We definitely have more of everything data-related and have a much better idea of all the stuff we can buy. I'm skeptical how far that's actually moved the happiness and life-satisfaction needles, in general.

[EDIT] specifically, I think some of our "satisfaction" from this sort of consumption is itch-scratching generated by the possibility of doing it, in the same way that pre-Internet one rarely felt bothered by not knowing some piece of trivia, if no-one around happened to know either. Now it itches until someone looks it up, because you know you can find out quickly. Now if I'm not watching the best possible thing, for example, it itches, but I don't think it would have before. I think to some extent the level of choice available, aside from famously causing analysis-paralysis ("browsing Netflix" is famously an activity all its own, that may or may not end up in ever actually watching anything) also generates the very desire that it's satiating. I'm not sure I was actually less happy watching the best thing I could find at the video store, versus the best thing I can find on streaming services.

I don't know about you, but for me having access to youtube means that I can do things like fix my car, learn about medieval hats, see what kinds of weird animals exist, etc.

These sorts of things improve my life immeasurably and definitely give me a sense of 'satisfaction' that I would not otherwise have been able to achieve paying someone to fix my car, watching a reality show on TLC, or going to the library and reading a book about ducks for the 50th time.

If you were wearing a size 13 (EU 48) shoes, walking into a store and asking for what they have in your size was exclusively met with "but which do you like". It turns out none of the top 10 choices I asked about would be available, and we'd eventually retreat to "which do you have that I dislike the least?"

With online shopping, I think the biggest wins are for anyone not being in the "common" category (be it the 5-95% size, fashion, usefulness etc): if what you generally need is suitably common, you might miss the physical shopping (try-ons/try-outs for wearables/tools are very useful).

This also means that there is more incentive for non-common products to be produced because the market is larger.

Your problem isn't the Internet, it's the lack of trust busting in the tech space that prevents e.g. Disney from being able to launch its own streaming service or Amazon from promoting its own Basics products. The reason why everything sucks is because big players have zero incentive to change when they aren't punished for favoring themselves. Instagram doesn't even allow you to copy and paste photos anymore.

Note that current best practice is simple password rules, with password expiry only when there is reason to do so.

Generally the suggested rules are: be at least 12 characters long, check the password against lists of known passwords.

The Chrome Web Store does not require using a GMail address, for example, I don't have a GMail address and have items on the Chrome Web Store [0].

[0] https://chrome.google.com/webstore/detail/cackey/lpimdiknnpi...

Loved the BeOS theme!

Most of the other big extensions have their own domain email. Like Grammarly, 1Password, Zoom, Pocket.

Evernote has a normal Gmail account listed. So maybe this goes hand in hand with having a bad product.

Perhaps those orgs use Google apps?

I have a Google account on an email completely unattached to any other Google services (I think it was an originally migrated pre-Google Youtube account), so I am sure you can have a Google account with any external email address.

It does not. It does require a Chrome web store account, but you can use any email address you want for that.

A Google account, which any organization that has its shit together (and uses Google properties) has set up for their domain.

Which Microsoft, ostensibly, wouldn't be doing. Considering the whole Office 365 product exists and is a direct competitor to Google Suite.

And yet here they are.

Microsoft Edge requires a MS Live account.

> I'm guessing Chrome requires users to use a gmail account in order to submit an extension to their store.

Google apps/Gsuite/Google for work (or whatever it’s called now) accounts all work fine.

There’s no requirement to use a gmail.com account.

Source: have published extensions on my own and for my company.

Wow, I looked at the review responses by the developer and assumed from the poor English that it was fake, and reported it.

It could be this MS extension is a companion project to the latest Windows 10 update - the News and Interests taskbar widget.

It might be legit. The Microsoft rewards app uses [email protected]. I’m guessing 1 million installs makes that legit.

There’s no way even for technical people to make a proper assessment of the trustworthiness of the publisher.

Google has ruined the internet because they want Google Search to be the only “trustworthy” source online. Too bad they suck at it and Google search is a steaming pile of shit now.

1 million click farmers in china/India/Nigeria?

In general this is a good idea. But in the case of Microsoft--good luck figuring out which of Microsoft's thousands of domains are legit! :)

Reminds me of Paypal where I'm simply unable to tell whether some mails from them were phishing or not (regardless of time spent investigating these mails), and I believe that virtually no one would be able to tell.

They were even cognizant of the issue to the point where they set up a robo inbox you could forward any suspected phishing emails to and it would reply telling you if it was legit or not. It was something like [email protected]

It still frustrates me that legitimate Paypal e-mails include really big "click here to login" buttons that link you to their website. Such links are considered a hallmark of phishing, and there are many attempts to prevent people from clicking on such links. Many services I use include text like 'we will never send you such a link you know how to get to our website'.

The fact that paypal does not do this normalizes clicking on links in e-mails.

"use email for notifications, but don't trust email content" is not a solution for most users. If you can't trust email, why even have it? Install a secure app and leave email behind, or make email secure by having clients clearly display cryptographically secured provenance info, and flag unknown/untrusted senders.

There is no alternative to e-mail. Except perhaps for SMS. There is no other method for contacting people that is anywhere near as pervasive. It also has the advantage of being federated, not controlled by any specific entity.

Besides that, compared to WhatsApp and signal, email is generally for longer and less urgent messages. Those fit notifications much better.

In that context an email saying "hey this is whats up, login as you normally do if you want to verify or act accordingly".

It's far from ideal. We will probably come to some form of solution at some point. But at this moment it is a clear no-brainer.

It would seem to me that Microsoft would choose to link it to microsoft.com so that customers can easily recognize its authenticity.

Microsoft might, I suppose, have a policy against microsoft.com accounts on other firms infrastructure, and therefore if it needs a Google account uses gmail or other non-microsoft.com domains.

They have already failed this test: they are already publishing extensions using [email protected] and [email protected], doubtless many others!

I believe Google requires you publish Chrome extensions with an @gmail address, in which case MS doesn’t really have a choice.

Absolutely untrue, as mentioned elsewhere in the thread. I have Chrome extensions published under a non-gmail email address.

Any idea what problem Google is solving by requiring the use of gmail?

Naivety on the internet, and people believing what they read on a web page without checking.

Google doesn't require a gmail adresse to publish.

Yeah, I didn't think it made sense.

Good grief--that is so evil (not to mention anticompetitive) that I didn't even consider it!

Not sure what would make using a Gmail account anticompetitive, but it's also not true. You need a chrome web store account (which they amusingly encourage you not to use your personal email for) which can use any email address.

Considering APPLE goes so far to make you confirm DUNS numbers for a company acct. It seems like this would have been a good mitigating practice and already has precedence. While it’s a PITA it makes sense.

The core issue is that Apple uses humans to evaluate these requests and provide a point of contact with businesses. Google believes any process requiring a human is broken.

This is why when setting up my relatives' computer I only install Adblock and then make this directory readonly:

    chmod 444 ~/Library/Application\ Support/Google/Chrome/Default/Extensions

Chrome supports enterprise policies on Windows, Linux, and MacOS that allows you to specify allowed extension IDs via ExtensionInstallAllowlist.

https://support.google.com/chrome/a/answer/7517624?hl=en

https://chromeenterprise.google/policies/#ExtensionInstallAl...

This, unlike the "chmod 444," solution will let extensions update.

You can also allow safe extensions that aren't currently installed (but may be later) and the user can remove extensions in the Allow list if so desired (although there is a ExtensionInstallForcelist to stop that too).

Thank you for that!

How do I make my copy of Chrome "enterprise" managed?

Sounds like a great way to get your browser to crash unexpectedly.

Even better way to discover which browsers don't handle pretty normal situations (read-only) in a normal way. If Google Chrome is forcing people to allow installation of extensions, it's much better to move to a different browser, than to either live with crashes or live with poor security (in this, parental case).

Yep. I was tired of coming home and seeing a million malware search engines and fake VPNs extensions installed. I'm always puzzled as how they manage to get in there. I'd rather crash the browser than allow this garbage which usually takes a full reinstall to get rid of.

Your comment made me chuckle.

Back in 2008 Chrome was the breath of fresh air, with absolutely spartan look, total lack of extensions and amazing speed, while IE was the opposite. There was good reason for its initial popularity.

And now, looks like Chrome lived long enough to see itself become a villain...

I'm curious which is the new Chrome these days? Personally for me, qutebrowser has taken that spot, but it's a tool geared towards professionals, not exactly for casual users.

I think Firefox. It’s continuously getting faster and uses way fewer resources in my experience. You can make it pretty minimalist like the good old days of Chrome.

Arguably that's better than the alternative, where they get scammed or hacked. I usually edit their desktop shortcut to disable extensions, personally, but I like the parent's solution better.

how about security updates? i would advise against blocking updates. you're fixing an issue and creating another one.

the chmod isn't recursive, so I'm assuming the subdir for uBO is writable.

Just like you, I assume that. I double check [email protected], and guess what, it's legit.

Check this blog: https://blogs.windows.com/windowsexperience/2021/02/05/simpl...

Here is a crazy conspiracy theory: maybe they are both legit and MS used shady-looking e-mail addresses on purpose. Security-minded people will look at them and call them out, thus bringing to light how shitty the Chrome Extension store vetting process is, undermining Google Chrome's credibility in the process, so that users stay on MS Edge.

If you think that it's bad, have a look at https://chrome.google.com/webstore/detail/microsoft-defender.... Over 1 million people are using this crap...

Wait, that is not legit?

How... how can you tell?

edit: it's actually legit

I would try to find a link on a official homepage (MS in this case) which links to this extension. Otherwise I wouldn't trust it.

Links on this site to the extension: https://browserprotection.microsoft.com/learn.html

Extension offering replication of basic browser functionality sends some major red flags, especially around storing passwords.

That top link screams scam. Replies from the "Product team at Microsoft Autofill" on a personal account, reviews about it taking up to 30% CPU all the time (possible crypto miner), and not using assets from the Microsoft brand.

I think those are legit. Guessing you need a gmail or gsuite address to publish?

Too bad Microsoft can’t afford a Google Workspace account and has to rely on the free gmail accounts. Lmfao.

They could, but what sort of service doesn't allow you to sign up with a random domain? It also wouldn't be better if they had: [email protected], or are you suggesting just moving all microsoft.com emails to Google Workspace?

Perhaps it's like YouTube? You cannot buy or use a Youtube Premium subscription with a Google Workspace account. I tried inviting a family member to my Youtube Premium subscription, using her Google Workspace email. It doesn't work, because Youtube doesn't see it as a Gmail account.

@gapps.microsoft.com would be at least better than a random unverifiable @gmail.com address. Google Workspace (is that what we're calling it this week?) lets you use subdomains right?

Let's be real: getting legal and infosec to sign off on that is never going to happen. "We just need to borrow a subdomain of Microsoft.com, give control to our biggest competitor, and sign a contract with them... to get a vanity email address in their store."

It's really not that big of a deal. You can still control the DNS and decide what you set up. And if Google screws you over, they'd be shooting themselves in the face.

All you'd need to actually work would be email, so some MX records on a subdomain. Is it ideal? No. Is it better than all of your users having no way to verify that a Chrome extension is actually you? Infinitely better.

opening a gmail account takes about 30 seconds

vs. months of emails and meetings for something that more or less achieves the same result

Except it doesn't more or less achieve the same result. Also, if it legitimately takes months of meetings to get through something like that, there's a serious issue with your company/process.

> Also, if it legitimately takes months of meetings to get through something like that, there's a serious issue with your company/process.

ever wondered why these large companies end up running things on random domains?

this is why

I wonder whether [email protected] would look more or less legitimate to the untrained eye.