Re: deleg8, a trip through the chrome extension API and security mechanisms

Hi Dan,

By pure coincidence, Domenic Denicola (a fellow googler and web standards
person) just posted
https://docs.google.com/document/d/1AT5-T0aHGp7Lt29vPWFr2-qG8r3l9CByyvKwEuA8Ec0/edit#
for public commentary. Domenic is now on cap-talk, so we can also discuss
the paper with him here.

To avoid a confusion I just fell into, "v8 extensions" are unrelated to
"Chrome extensions", so these aren't as directly relevant to your post as I
thought at first. Nevertheless, as you'll see in the comment thread on
"private-own symbols", these are similar issues.

Domenic also mentioned to me that:

Regarding Chrome extensions, section 4.3 of
http://www.adambarth.com/papers/2010/barth-felt-saxena-boodman.pdf is
relevant, and perhaps
https://developer.chrome.com/extensions/content_scripts





On Wed, May 20, 2015 at 4:11 PM, Dan Connolly <[email protected]> wrote:

> I'm developing a scripted process that consumes exported Simple.com
> banking transactions. Full account credentials (username and password)
> are more than is needed. Session credentials, which are revokeable and
> in fact revoked as a matter of course, are sufficient.
>
> So I worked up a chrome extension so that when I visit simple.com and
> log in, a button is added to the browser chome, and when I press the
> button, it displays the session credentials so I can copy and paste
> them for use in other tools.
>
> https://github.com/dckc/deleg8
> bb6dfe6224
>
> What a bizzare API chrome extensions have!
>
> // "content scripts ... cannot ... use variables or functions
> // defined by web pages ..." however "DOM injected scripts that
> // would be executed immediately upon injection into the page will
> // execute as you might expect."
>
> It's pretty clearly the result of a long game of security
> whack-a-mole. And yet, despite any number of mechanisms that make it
> inconvenient to get the data I'm after, they don't actually prevent me
> from doing it. They just make the code harder to audit, as far as I
> can tell.
>
> I made some attempt to use object capability style by pushing use of
> ambient authority to the edges. I think this illustrates how much
> simpler things would be if browsers just used ocap for this sort of
> API.
>
>
> README.rst follows:
>
>
> deleg8 -- a Chrome Extension to delegate session access
> =======================================================
>
> by Dan Connolly <http://www.madmode.com/>
>
> Share and Enjoy according to the terms of the MIT Open Source License.
>
> For a scripted process that consumes exported Simple banking
> transactions, full account credentials (username and password) are
> more than is needed. Session credentials, which are revokeable and in
> fact revoked as a matter of course, are sufficient.
>
> This Chrome Extension adds a page action to the Simple account
> activity page. Invoking the action brings up session credentials in
> JSON, suitable for copy-and-paste to scripted processes.
>
> Flow of control and authority
> -----------------------------
>
>  1. When you `load the extension`__, you grant privileges in
> `manifest.json` to the extension.
>  2. `manifest.json` says to grant to `bg.js`:
>        - `onOnstalled`__ via `background: { scripts: ... }`
>        - `pageAction`__ by `page_action: { ... }`
>        - `webNavigation`__, activeTab_, and
>        - `cross-origin access to insert code`__ into simple.com pages
>  3. In `bg.js`, we use webNavigation to listen to onCompleted events
> for the simple.com activity page.
>     When we get such an event,
>      1. We use activeTab.runScript to inject shareToken.js, which gets
>          - the dom of the simple activity page and
>          - a channel to listen for messages from the extension
>      2. shareToken.js
>         1. injects a script that evaluates `_token` in the activity
> page scope and then
>         2. adds a message handler that sends the token to the requestor
>      2. In `bg.js`, we use pageAction to show popup.html
>  4. When the user clicks on the pageAction icon in the toolbar,
> `popup.html` gets
>      - DOM access to the popup,
>      - activeTab_, cookies, and cross-origin access simple.com
>  5. popup.html loads the (powerless) creds.js module and runs
> popup.js, which attenuates its
>     access a bit and then calls creds to
>     handle page onLoaded by sending a "shareToken" message to the
> content page and
>     display the response along with the `_simple_session` cookie.
>
> __ https://developer.chrome.com/extensions/getstarted#unpacked
> __ https://developer.chrome.com/extensions/runtime#event-onInstalled
> __ https://developer.chrome.com/extensions/pageAction
> __ https://developer.chrome.com/extensions/webNavigation
> __ https://developer.chrome.com/extensions/content_scripts#pi
> .. _activeTab: https://developer.chrome.com/extensions/activeTab
>
> I made some attempt to use `object capability style`__ by pushing use
> of ambient authority to the edges.
>
> __ http://www.erights.org/elib/capability/ode/ode-capabilities.html
>
>
> --
> Dan Connolly
> http://www.madmode.com/
> _______________________________________________
> cap-talk mailing list
> [email protected]
> http://www.eros-os.org/mailman/listinfo/cap-talk
>



-- 
Text by me above is hereby placed in the public domain

  Cheers,
  --MarkM

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk