Security Blog
The latest news and insights from Google on security and safety on the Internet
Improving Security and Privacy for Extensions Users
12 июня 2019 г.
No, Chrome isn’t killing ad blockers -- we’re making them safer
Posted by Devlin Cronin, Chrome Extensions Team
The Chrome Extensions ecosystem has seen incredible advancement, adoption, and growth since its launch over ten years ago. Extensions are a great way for users to customize their experience in Chrome and on the web. As this system grows and expands in both reach and power, user safety and protection remains a core focus of the Chromium project.
In October, we
announced a number of changes
to improve the security, privacy, and performance of Chrome extensions. These changes include increased user options to control extension permissions, changes to the review process and readability requirements, and requiring two-step verification for developers. In addition, we’ve helped curb abuse through
restricting inline installation
on websites,
preventing the use of deceptive installation practices
, and
limiting the data collected by extensions
. We’ve also made changes to the teams themselves — over the last year, we’ve increased the size of the engineering teams that work on extension abuse by over 300% and the number of reviewers by over 400%.
These and other changes have driven down the rate of malicious installations by 89% since early 2018. Today, we block approximately 1,800 malicious uploads a month, preventing them from ever reaching the store. While the Chrome team is proud of these improvements, the review process alone can't catch all abuse. In order to provide better protection to our users, we need to make changes to the platform as well. This is the suite of changes we’re calling Manifest V3.
This effort is motivated by a desire to keep users safe and to give them more visibility and control over the data they’re sharing with extensions. One way we are doing this is by helping users be deliberate in granting access to sensitive data - such as emails, photos, and access to social media accounts. As we make these changes we want to continue to support extensions in empowering users and enhancing their browsing experience.
To help with this balance, we’re reimagining the way a number of powerful APIs work. Instead of a user granting each extension access to all of their sensitive data, we are creating ways for developers to request access to only the data they need to accomplish the same functionality. One example of this is the introduction of the Declarative Net Request API, which is replacing parts of the Web Request API.
At a high level, this change means that an extension does not need access to all a user’s sensitive data in order to block content. With the current Web Request API, users grant permission for Chrome to pass all information about a network request - which can include things like emails, photos, or other private information - to the extension. In contrast, the Declarative Net Request API allows extensions to block content without requiring the user to grant access to any sensitive information. Additionally, because we are able to cut substantial overhead in the browser, the Declarative Net Request API can have significant, system-level performance benefits over Web Request.
This has been a controversial change since the Web Request API is used by many popular extensions, including ad blockers. We are not preventing the development of ad blockers or stopping users from blocking ads. Instead, we want to help developers, including content blockers, write extensions in a way that protects users’ privacy.
You can read more about the Declarative Net Request API and how it compares to the Web Request API
here
.
We understand that these changes will require developers to update the way in which their extensions operate. However, we think it is the right choice to enable users to limit the sensitive data they share with third-parties while giving them the ability to curate their own browsing experience. We are continuing to iterate on many aspects of the Manifest V3 design, and are working with the developer community to find solutions that both solve the use cases extensions have today and keep our users safe and in control.
Комментариев нет :
Отправить комментарий
Ярлыки
#sharethemicincyber
#supplychain #security #opensource
android
android security
android tr
app security
big data
biometrics
blackhat
C++
chrome
chrome enterprise
chrome security
connected devices
CTF
diversity
encryption
federated learning
fuzzing
Gboard
google play
google play protect
hacking
interoperability
iot security
kubernetes
linux kernel
memory safety
Open Source
pha family highlights
pixel
privacy
private compute core
Rowhammer
rust
Security
security rewards program
sigstore
spyware
supply chain
targeted spyware
tensor
Titan M2
VDP
vulnerabilities
workshop
Archive
2025
янв.
2024
дек.
нояб.
окт.
сент.
авг.
июл.
июн.
мая
апр.
мар.
февр.
янв.
2023
дек.
нояб.
окт.
сент.
авг.
июл.
июн.
мая
апр.
мар.
февр.
янв.
2022
дек.
нояб.
окт.
сент.
авг.
июл.
июн.
мая
апр.
мар.
февр.
янв.
2021
дек.
нояб.
окт.
сент.
авг.
июл.
июн.
мая
апр.
мар.
февр.
янв.
2020
дек.
нояб.
окт.
сент.
авг.
июл.
июн.
мая
апр.
мар.
февр.
янв.
2019
дек.
нояб.
окт.
сент.
авг.
июл.
июн.
мая
апр.
мар.
февр.
янв.
2018
дек.
нояб.
окт.
сент.
авг.
июл.
июн.
мая
апр.
мар.
февр.
янв.
2017
дек.
нояб.
окт.
сент.
июл.
июн.
мая
апр.
мар.
февр.
янв.
2016
дек.
нояб.
окт.
сент.
авг.
июл.
июн.
мая
апр.
мар.
февр.
янв.
2015
дек.
нояб.
окт.
сент.
авг.
июл.
июн.
мая
апр.
мар.
февр.
янв.
2014
дек.
нояб.
окт.
сент.
авг.
июл.
июн.
апр.
мар.
февр.
янв.
2013
дек.
нояб.
окт.
авг.
июн.
мая
апр.
мар.
февр.
янв.
2012
дек.
сент.
авг.
июн.
мая
апр.
мар.
февр.
янв.
2011
дек.
нояб.
окт.
сент.
авг.
июл.
июн.
мая
апр.
мар.
февр.
2010
нояб.
окт.
сент.
авг.
июл.
мая
апр.
мар.
2009
нояб.
окт.
авг.
июл.
июн.
мар.
2008
дек.
нояб.
окт.
авг.
июл.
мая
февр.
2007
нояб.
окт.
сент.
июл.
июн.
мая
Feed
Follow @google
Follow
Give us feedback in our
Product Forums
.
Follow
Комментариев нет :
Отправить комментарий