<story><title>Let&apos;s build a Chrome extension that steals as much data as possible</title><url>https://mattfrisbie.substack.com/p/spy-chrome-extension</url></story><parent_chain><item><author>metadat</author><text>&amp;gt; Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions.&lt;p&gt;An egregious and nearly unbelievable oversight on Google&amp;#x27;s part. :-\&lt;p&gt;As a developer, it&amp;#x27;s unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure things look and operate as expected.  Especially for a security sensitive UI element.&lt;p&gt;The chain of humans who&amp;#x27;ve been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years.&lt;p&gt;There are so many risk-reduction controls in place; tons of red tape and umpteen security and privacy reviews required to ship even minor features or updates, yet here we are.&lt;p&gt;How many hands have been in the pot and not noticed&amp;#x2F;raised&amp;#x2F;resolved what amounts to a pretty obvious security vulnerability?  And if this kind of issue can fly undetected for so long, what can organizations with drastically less resources than $GOOG do to ensure adequate velocity while not leaving the proverbial barn doors open?&lt;p&gt;The author deserves the highest tier of bug bounty reward for bringing this to light.  What&amp;#x27;s that?  It wasn&amp;#x27;t submitted through the proper channels to be eligible?  Right.&lt;p&gt;&amp;lt;insert relevant Dildbort cartoon&amp;gt;</text></item></parent_chain><comment><author>aboodman</author><text>&amp;gt; The chain of humans who&amp;#x27;ve been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years.&lt;p&gt;As the first in this chain of humans, I can tell you that (a) we obviously considered this in the first version of extensions and did not allow permissions &amp;quot;below&amp;quot; the fold, (b) Chrome&amp;#x27;s extension model dramatically improved on the previous state of the art which was Firefox&amp;#x27;s &amp;quot;every extension can do everything, extensions can&amp;#x27;t be uninstalled completely, and there&amp;#x27;s no review&amp;quot; [1], and (c) the install dialog is just one part in a bigger system which includes the review process.&lt;p&gt;I encourage the author to try and get this onto the store and get meaningful usage, then we can complain about how well the entire system works end to end. Examining just the install dialog alone is missing the point. I&amp;#x27;m not even certain that an extension that requests more than 5 permissions would be approved in the first place.&lt;p&gt;I also encourage readers to remember that generally speaking, you all _want_ extensions. When Chrome didn&amp;#x27;t have them, they were the &lt;i&gt;top&lt;/i&gt; feature request in the bug tracker. Real security is hard. If you don&amp;#x27;t solve user needs, users solve them themselves with solutions that are even worse (ie native code). Managing the browser extension system is a thankless painful job of delicately balancing incentives. Extensions need to work well enough that developers don&amp;#x27;t reach for more powerful and dangerous tools, but have enough controls that the majority of malware can be controlled. It sucks. Trust me you really don&amp;#x27;t want this job. Please spare a bit of empathy for the &amp;quot;chain of humans&amp;quot; that have had it.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;static.googleusercontent.com&amp;#x2F;media&amp;#x2F;research.google.com&amp;#x2F;en&amp;#x2F;&amp;#x2F;pubs&amp;#x2F;archive&amp;#x2F;38394.pdf&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;static.googleusercontent.com&amp;#x2F;media&amp;#x2F;research.google.c...&lt;/a&gt;</text></comment>
<story><title>Let&apos;s build a Chrome extension that steals as much data as possible</title><url>https://mattfrisbie.substack.com/p/spy-chrome-extension</url></story><parent_chain><item><author>metadat</author><text>&amp;gt; Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions.&lt;p&gt;An egregious and nearly unbelievable oversight on Google&amp;#x27;s part. :-\&lt;p&gt;As a developer, it&amp;#x27;s unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure things look and operate as expected.  Especially for a security sensitive UI element.&lt;p&gt;The chain of humans who&amp;#x27;ve been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years.&lt;p&gt;There are so many risk-reduction controls in place; tons of red tape and umpteen security and privacy reviews required to ship even minor features or updates, yet here we are.&lt;p&gt;How many hands have been in the pot and not noticed&amp;#x2F;raised&amp;#x2F;resolved what amounts to a pretty obvious security vulnerability?  And if this kind of issue can fly undetected for so long, what can organizations with drastically less resources than $GOOG do to ensure adequate velocity while not leaving the proverbial barn doors open?&lt;p&gt;The author deserves the highest tier of bug bounty reward for bringing this to light.  What&amp;#x27;s that?  It wasn&amp;#x27;t submitted through the proper channels to be eligible?  Right.&lt;p&gt;&amp;lt;insert relevant Dildbort cartoon&amp;gt;</text></item></parent_chain><comment><author>crazygringo</author><text>&amp;gt; &lt;i&gt;An egregious and nearly unbelievable oversight on Google&amp;#x27;s part. :-\ &lt;/i&gt;&lt;p&gt;I agree it&amp;#x27;s egregious, but it&amp;#x27;s quite easy to believe.&lt;p&gt;It&amp;#x27;s surely just using a standard modal and passing a string. The thing is, this is on a Mac that has scroll bars that are invisible until you scroll. It&amp;#x27;s easy to imagine testing was done other OS&amp;#x27;s where the scroll bars are obvious and the bottom line might be only partially hidden which makes it even clearer. And&amp;#x2F;or that testers never caught it on a Mac because they themselves never realized there were more.&lt;p&gt;I would &lt;i&gt;hope&lt;/i&gt; somebody sees this now and prioritzes a Chromium bug for it. Because on a Mac at least, this is pretty serious.&lt;p&gt;(And I&amp;#x27;m well aware this is a good example of a negative side effect of Apple&amp;#x27;s choice to make scroll bars visible by default only while scrolling.)</text></comment>