Hacker News

points by infwhispers 10 hours ago | 0 comments

You don’t need https for a web running locally; nothing goes into the network. Malicious browser extension can be real, but if that is true, you might have bigger problems than leaking the apple graph

[–] yubblegum 9 hours ago

> if that is true, you might have bigger problems than leaking the apple graph

That is certainly true, and it is equally true that that possibility places a responsibility on you to put that in a section in your readme.

So yeah, I may have a bad extension but that thing never had access to the possibly aptly named 'IntelligencePlatform' that's keeping tabs on my digital activities, until I ran your code. Correct?

[–] thomascountz 8 hours ago

I would go further and suggest that you do not access any website or open any files via your browser while you have malicious browser extensions installed. You do not need this project's README to tell you this.

[–] yubblegum 8 hours ago

That is a categorical error.

My evil extension|browser may know what porn I watch or which sites I am visiting or possibly lift some bits it is not supposed to have. But it does not have access to Apple's comprehensive graph of my digital activities on their devices. Only Apple Inc. has that access.

So in fact the OP needs to put in the readme that "malicious browser extensions are a potential attack surface."

As a matter of fact, one could argue that a posting like this on Hackernews could potentially be a very sophisticated 'human engineering' effort by parties that have backdoors to browsers but have been defeated by Apple's security features.

[–] eks391 7 hours ago

When you install a browser extension, your browser will notify you if it can read or modify page content before you enable it the first time. Using OPs tool is not unique in that it becomes vulnerable when paired with nefarious browser extensions, because all pages are. Https doesn't even solve that.

This is akin to some medicine saying that if paired with another specific medicine, you won't get desired results, and you are upset that it doesn't include a warning against combining the medicine with cyanide because you might die. The pairing with cyanide is irrelevant to the medicine and is just a side effect of cyanide.

[–] thomascountz 7 hours ago

I don't think your request is reasonable because I don't agree with your (or your LLM's) categorical assertion and risk assessment, not because I misunderstand the mechanics of the threat model, as niche as it is.

Also, small correction: any app with Full Disk Access can access this data.