Re: Extension security?


On Mon, Dec 5, 2011 at 5:23 PM, Milan Bouchet-Valat <nalimilan club fr> wrote:
> Le lundi 05 décembre 2011 à 23:14 +0100, Gabriel a écrit :
>> Hi all,
>> I may be missing something, but the really nifty extensions site
>> prompted me to ask this, are there not potential security issues with
>> extensions being able to be installed by clicking on a webpage? Ans
>> since extensions are able to modify the way the UI behaves, could
>> someone not make one that steals users' info, make screenshots, steal
>> passwords (like emulating the login screen for example), etc?
> (Note this applies to any random third-party package users might install
> by clicking on a link and providing their password.)
>> I'm sure you thought of all this so I be interested in knowing how you
>> protect us (sandboxing, limiting the things API can do, not allowing
>> access to the HD except thought given functions, etc).
> This has been discussed on this list previously. See
> for a summary and links.
> Basically, the Shell ensures the extension comes from
>, which requires a review of the code by other
> hackers; and it will never install/update extensions without user action
> (modal dialog). But once installed, extensions are not sandboxed and can
> do whatever they want to the Shell, or to your files (just like any app
> on the system).
> Cheers
> _______________________________________________
> gnome-shell-list mailing list
> gnome-shell-list gnome org


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]