4

So I'm working on a Chrome extension for someone else. I don't want to give away specific details about the project, so for I'll use an equivalent example: let's assume it's an extension to run on an image/forum board. Imagine I have variables such as userPoints, isBanned etc. The later being fairly self-explanatory, while the former corresponding to points the user acquires as they perform certain actions, hence unlocking additional features etc

Let's imagine I have code like:

if(accountType !== "banned"){
   if(userPoints > 10000) accountType = "gold";
   else if(userPoints > 5000) accountType = "silver";
   else if(userPoints > 2500) accountType = "bronze";
   else if(userPoints <= 0) accountType = "banned";
   else accountType = "standard";
}else{
   alert("Sorry, you're banned");
   stopExtension();
}

Obviously though, it becomes trivial for someone with the knowledge to just browse to the extensions background page and paste chrome.storage.local.set({'userPoints': 99999999}) in the console, hence giving them full access to all the site. And, with the Internet, someone can of course share this 'hack' on Twitter/YouTube/forums or whatever, then suddenly, since all they'd need to do is copy and paste a simple one-liner, you can have 1000s of people, even with no programming experience, all using a compromised version of your extension.

And I realise I could use a database on an external site, but realistically, it would be possible that I would be wanting to get/update these variables such as userPoints 200+ times per hour, if the user was browsing the extentions target site the entire time. So the main issues I have with using an external db are:

  • efficiency: realistically, I don't want every user to be querying the db 200+ times per hour

  • ease-of-getting-started: I want the user to just download the
    extension and go. I certainly don't want them to have to sign up. I
    realise I could create a non-expiring cookie with for the user's ID
    which would be used to access their data in the db, but I don't want to do that, since users can e.g. clear all cookies etc

  • by default, I want all features to be disabled (i.e. effectively
    being considered like a 'banned' user) - if, for some reason, the
    connection with the db on my site fails, then the user wouldn't be
    able to use the extension, which I wouldn't want (and just speaking
    from experience of my parents being with Internet providers whose
    connection could drop 10 times per hour, for some people, failed
    connections could be a real issue) - in contrast, accessing data from the local storage will have like a 99.999% success rate I'd assume,
    so, for non-critical extensions like what I'm creating, that's more
    than good enough

Still, at least from what I've found searching, I've not found any Chrome storage method that doesn't also allow the user to edit the values too. I would have thought there would be a storage method (or at least option with chrome.storage.local.set(...) to specify that the value could only be accessed from within the extension's context pages, but I've not found that option, at least.

Currently I'm thinking of encrypting the value to increment by, then obfuscating the code using a tool like obfuscator.io. With that, I can make a simple, like 30 character js file such as this

userPoints = userPoints + 1000;

become about 80,000...still, among all the junk, if you have the patience to scroll through the nonsense, it's still possible to find what you're looking for:

...[loads of code](_0x241f5c);}}}});_0x5eacdc(),***u=u+parseInt(decrypt('\u2300\u6340'))***;function _0x34ff36(_0x17398d)[loads more code]...

[note that, since it's an extension and the js files will be stored on the user's pc, things like file size/loading times of getting the js files from a server are irrelevant]

Hence meaning a user wouldn't be able to do something like chrome.storage.local.set({'userPoints': 99999999}), they'd instead have to set it to the encrypted version of a number - say, something like chrome.storage.local.set({'userPoints': "✀ເ찀삌ሀ"}) - this is better, but obviously, by no means secure.

So anyway, back to the original question: is there a way to store persistent values for a Chrome extension without the user being able to edit them?

Thanks

ChromeExtentionHelp
  • 41
  • 2

0 Answers0