Vivaldi's biggest security vulnerability: the Chrome store
-
There is a better way to handle extension stores.
Copy the F-Droid policy.Once you only allow open source to be used and ban any advert systems you have a safer place.
Unlike the google store, F-Droid have not had issues with becoming a malware distributor.
If they had an extension store, I know where all my extensions would be coming from. -
Most extensions I use are Open Source and you can install them directly from GitHub. Download CRX file and drag them to the Extensions Page in developer mode. You don't need the Chrome Store.
-
@luetage Was it? An update containing malicious code made it to the store. There are probably still users running around with this extension installed in their Chromium browser—for my own part, the extension was reinstalled after I 86'd it thanks to Vivaldi's sync.
One could wish that software/extension stores would review updates before they are published, and that did not happen here.
-
@purgat0ri An illusory setup that potentially lets slip malware through still. Totally unworkable for a project the size of chrome web store.
-
@purgat0ri , some time ago I caught a highjacker with one of these New Tab Pages from the Chrome Store. Google does not review the apps and extensions of the Stores, neither in the Chrome Store nor in Google Play and removes them only after complaints from users.
-
@luetage What is the referent for your 'illusory setup'?
@Catweazle Yes. That's why it's a terrible system.
-
@purgat0ri , you can use extensions from the Chrome Store, but you should always check first if it is specified to the developer and that it preferably has a Link that leads to GitHub or at least to a trusted developer.
Ok, if the web is GitHub or SourceforgeA no go
In Android use Apps from F-Drid
-
@purgat0ri said in Vivaldi's biggest security vulnerability: the Chrome store:
@luetage What is the referent for your 'illusory setup'?
The idea that any practical review process could eliminate malware. Such a store would be extremely limited in its offerings, present an enormous workload for its maintainers, create virtually insurmountable barriers to the extension authors because of that workload, exhibit significant delays in any updates being published, and still provide no guarantee that malware wouldn't be published.
@purgat0ri said in Vivaldi's biggest security vulnerability: the Chrome store:
There are probably still users running around with this extension installed in their Chromium browser
Doesn't matter. The remote server is gone. What really matters now is that the horrible decisions by the extensions author, and the manner in which the entire thing was handled caused lots of other lasting problems that will affect all users, not just those who installed the extension. The author is suffering greatly from the effect this has had on his reputation. Other extension authors for similar extensions have also suffered some loss of trust from users, as they see just how easy it is for things to go terribly wrong with them. Google's arguments about the necessity of the Manifest v3 changes to ensure user's security and privacy has been bolstered, as has their confidence to move forward with greater restrictions most likely. Which would cripple these critically useful extensions, to the point that at least some of them will be abandoned altogether, and that would be a major loss for users who actually want to protect their security and privacy.
In the end, if there's one thing users need to learn from this it's that nobody is responsible for your security & privacy but you. Security & privacy require users to extend a level of trust. Regardless of how an extension store is implemented, users still need to do their own due diligence and determine if they're comfortable extending that trust to the authors of any extensions they install. That trust is not a one-time event, and must continually be evaluated for as long as the extension is installed. This wasn't the first time a previously trustworthy extension abused the trust users put in it, and it won't be the last. No practical screening can eliminate that, and any attempt would dramatically reduce the choice and functionality that users want.
-
@BoneTone said in Vivaldi's biggest security vulnerability: the Chrome store:
nobody
is responsible for your security & privacy but youThat damn Linux system user has such a lot for which to answer!
Nice post; sobering reality-check.
This is especially saddening:
Google's arguments about the necessity of the Manifest v3 changes to ensure user's security and privacy has been bolstered, as has their confidence to move forward with greater restrictions most likely
-
@BoneTone said in Vivaldi's biggest security vulnerability: the Chrome store:
The idea that any practical review process could eliminate malware. Such a store would be extremely limited in its offerings, present an enormous workload for its maintainers, create virtually insurmountable barriers to the extension authors because of that workload, exhibit significant delays in any updates being published, and still provide no guarantee that malware wouldn't be published.
Who endorsed that idea? Because it certainly wasn't me. Just because a given measure will only curtail a given undesirable outcome or phenomena, rather than completely eliminating it, does that mean that measure is not worth considering? Sounds like making the perfect the enemy of the good to me.
I'm actually fine with a more curated store with a limited amount range of extensions if it means that I can be more confident that those extensions will be free of malicious code. I understand if others aren't willing to make that sacrifice, but I personally don't think it would be too great a loss if 90% of the cruft currently occupying the store were to disappear.
Besides, as @Catweazle has pointed out, there are other distribution channels for extensions. I'm not sure why he thinks Github, for instance, is safer unless someone has taken the time to audit the code (which is what Google themselves should be doing, in my opinion), but it would remain an option nevertheless.
Chrome seems to have the worst store going in terms of security and privacy (a reflection of the company as a whole, no doubt) practices, so there is clearly more that they could be doing if they cared to.
-
@purgat0ri , I think this, because in general I think that FOSS is more private, because it lacks the commercial interests of large multinationals (Does Google review the extension codes? I doubt it, they put the extension and if users complain they will remove it).
Although yes, you always have to be careful before installing anything. -
@purgat0ri Chrome web store will not change its policies because of a post on Vivaldi Forum and Vivaldi isn’t likely to abandon the store either. Even if someone audits the code, you can never be sure they made a good enough job and didn’t overlook something. The only way to make sure an extension is 100% safe is to audit every bit of code yourself – initially and after every update. Don’t know whether you are capable of that. Anyhow, the only realistic option remaining is to forego the use of extensions and being content with the inbuilt tools Vivaldi provides.
-
@purgat0ri said in Vivaldi's biggest security vulnerability: the Chrome store:
but I personally don't think it would be too great a loss if 90% of the cruft currently occupying the store were to disappear.
And yet, this exact scenario would still have played out. That's the point. Even when you've significantly reduced users choices, and put up barriers to entry, the exact same problem exists, and you still haven't taken away the burden from the user needing to do their own research and determine whom they want to trust. Being open source, being developed by formerly trustworthy developers, etc. malware still creeps in, even in the absence of a change in ownership (see NoScript). Your 90% reduced store being safe is an illusion. The same risks still exist, and users still have to do the same work.
@luetage said in Vivaldi's biggest security vulnerability: the Chrome store:
Even if someone audits the code, you can never be sure they made a good enough job and didn’t overlook something. The only way to make sure an extension is 100% safe is to audit every bit of code yourself – initially and after every update. Don’t know whether you are capable of that. Anyhow, the only realistic option remaining is to forego the use of extensions and being content with the inbuilt tools Vivaldi provides.
Exactly. And nobody is, certainly not while keeping up-to-date. It will always be on users to keep themselves aware of the third-party tools they use and determine their own level of risk vs reward, no matter what controls are put in place. Security & privacy cannot be offloaded.
-
I've been sufficiently inspired by this thread that i finally got up off my lazy big fat donkey & conducted a fastidious audit of my devices here. I'm proud to be able to state that:
- I removed all the red beads from my abacus -- always thought they might have been suss.
- Ripped out, shredded & burnt the natural-log pages from my log-tables book -- they're not fooling me any more with their claims that what they got up to when i wasn't looking was natural.
- Permanently removed the K-scale from my slide-rule. It fooled me once, but will never again pull the wool over my eyes; i know it was passing on secrets to the D-scale.
-
I already made my point about making the perfect the enemy of the good. It's pointless to wear a seatbelt because you could get hit by a train or spontaneously combust. Adios.
-
And I'm saying, it's not even good. There's no benefit but the warm fuzzy feeling, users still have to do the exact same work. This exact scenario would still happen. The difference is less choice for users, and more barriers for authors. Hasta luego.
-
@BoneTone Are you deaf? I said ADIOS
-
@purgat0ri said in Vivaldi's biggest security vulnerability: the Chrome store:
What is the way forward for Vivaldi?
Short term: Just give the user a warning about the dangers of extensions, and the Chrome store's lack of vetting, when he brings up the Chrome store. Or something. Long term: Get a Vivaldi extension store, or collaborate with other browsers (such as Brave and Edge) to make an extension store.
-
@Eggcorn Would the advice differ in the exceptionally unlikely possibility of a female user?
-
@Steffie I say "he" not "he or she". Much as I say "actor" not "actor or actress". And "doctor" not "doctor or doctress".
And no, I'm not making the word "doctress" up. That's actuality the feminine form of the masculine "doctor". But in English, the masculine form usually doubles as the gender-neutral form.