Chrome extensions are tampering with security headers

Re:Chrome extensions are tampering with security headers by zo1 on Wednesday May 26, 2021 @02:21AM (#27287050)

You could say the same thing about almost anything: browsers, new root certificates, firewall software, antivirus software, anything you install on your own device, etc. Essentially, they're saying "anything you want to execute on your machine is a potential attack vector", and the only way to solve it is: "your browser is now your dumb-terminal into the mainframe (website), and we won't let you the device owner install anything that may potentially tamper with the data coming from our safe mainframe to your screen".

This is not where I want computing to go, and we're all just playing cat-and-mouse games feigning "security" when really "we" just don't trust the "plebs" to administer their own machines and keep themselves safe. This is arguably where Android is already, so one need only look there to see the future of computing and how the browser and "security" is being used as a trojan horse to get there.

[ Parent | on HN ]

Re:Chrome extensions are tampering with security headers by ocdtrekkie on Wednesday May 26, 2021 @10:31AM (#27290940)

This is an absurdist point of view.

If you go to the average non-technical user's Chrome extensions tab, they have 10-12 extensions. 7 of them are actively malicious.

This isn't like a "hey, freedom allows you the freedom to make mistakes" thing. This is a "good practice hasn't even been attempted here, and it's the top vector of all bad things ever" thing.

It's fine for browser extensions to exist, they serve a purpose. However, all existing extension stores should probably delist the entirety of their collection, solely re-accept extensions which an actual software engineer has reviewed, and make it much harder than one click to inadvertently install one when a website asks you to.

[ Parent | on HN ]