News for hackers. Stuff that matters.

A comment on Button Stealer. Parent comment

Re:Button Stealer by oneeyedpigeon on Tuesday July 23, 2024 @10:20AM (#41046260)
Right, but Google is surely the one at fault here. There should be absolutely no reason that this extension can "change all my data on all websites", whatever the hell that actually means.
[ Parent | on HN ]
Re:Button Stealer by tetromino_ on Tuesday July 23, 2024 @12:19PM (#41047757)
Not "change all my data on all websites" but "read the content of all websites I visit".

Because an extension that finds all button elements on all websites you visit, must necessarily start by reading the content of all websites you visit.

[ Parent | on HN ]
Re:Button Stealer by oneeyedpigeon on Tuesday July 23, 2024 @01:48PM (#41048834)
Yes, I think that one's acceptable in this case. It's the "change all my data" that is problematic.
[ Parent | on HN ]
Re:Button Stealer by Retr0id on Tuesday July 23, 2024 @12:11PM (#41047632)
I was under the vague impression that Manifest V3 was supposed to prevent this sort of thing. But looking at the extension, it is using MV3. Maybe it really was just about weakening ad blockers.
[ Parent | on HN ]
Re:Button Stealer by skybrian on Tuesday July 23, 2024 @01:31PM (#41048648)
I think both the developer and Google have some control over what appears in the Chrome store.
[ Parent | on HN ]