If an add-on is modifying contents of pages it shouldn’t or of the clipboard when it shouldn’t, you would have to give it explicit permission at install time, i.e. “This extension can: Read and Modify Data on all sites you visit: Read and Modify contents of the clipboard.”
Obviously a simple URL redirector for wikipedia requesting access to this data is absurd and would be an immediate red flag. The reason this very thing doesn’t happen more often, is because frankly you’d have to be so computer illiterate to get to that stage that it is much easier to just phish you with basic Facebook profile info for much greater gains.
This is also the reason most “hacks” nowadays are either supply-side or phishing, shit is just too secure, no fun. We should bring back ActiveX.
Obviously a simple URL redirector for wikipedia requesting access to this data is absurd and would be an immediate red flag.
To you, yes it should be. But it does require knowledge about how websites and browsers work that most people don’t have. I’d be very surprised if 50% of people have any idea what those permissions actually do and what would be reasonable for different extensions to have.
But installing few extensions doesn’t protect against it if the few extensions you install have scope and permissions to do bad things. It’s all worded in plain English, at some point you gotta just not use computers anymore if you can’t read.
Even if it’s good advice for nan checking emails on IE6 on windows vista, it really shouldn’t be necessary for a Lemmy user.
Of course having fewer extensions installed doesn’t protect you from the ones that you have installed. But the fewer you have the smaller your attack surface is. And as a general tip, I think it’s a good one, even on Lemmy. Because I’m not going to assume people’s understanding of the web, browsers or permissions. And when it comes to the general population, a lack of understanding of an extension’s permissions has very little to do with ones ability to read.
I mean, couldn’t an addon just read the password you put into a login field, or send in a request, and send it off to their servers?
If an add-on is modifying contents of pages it shouldn’t or of the clipboard when it shouldn’t, you would have to give it explicit permission at install time, i.e. “This extension can: Read and Modify Data on all sites you visit: Read and Modify contents of the clipboard.”
Obviously a simple URL redirector for wikipedia requesting access to this data is absurd and would be an immediate red flag. The reason this very thing doesn’t happen more often, is because frankly you’d have to be so computer illiterate to get to that stage that it is much easier to just phish you with basic Facebook profile info for much greater gains.
This is also the reason most “hacks” nowadays are either supply-side or phishing, shit is just too secure, no fun. We should bring back ActiveX.
To you, yes it should be. But it does require knowledge about how websites and browsers work that most people don’t have. I’d be very surprised if 50% of people have any idea what those permissions actually do and what would be reasonable for different extensions to have.
But installing few extensions doesn’t protect against it if the few extensions you install have scope and permissions to do bad things. It’s all worded in plain English, at some point you gotta just not use computers anymore if you can’t read.
Even if it’s good advice for nan checking emails on IE6 on windows vista, it really shouldn’t be necessary for a Lemmy user.
Of course having fewer extensions installed doesn’t protect you from the ones that you have installed. But the fewer you have the smaller your attack surface is. And as a general tip, I think it’s a good one, even on Lemmy. Because I’m not going to assume people’s understanding of the web, browsers or permissions. And when it comes to the general population, a lack of understanding of an extension’s permissions has very little to do with ones ability to read.