Google's Browser Interception Plugin For Chrome

An anonymous reader writes "Google has released a passive in-the-browser reconnaissance plugin, called the 'DOM Snitch'. By intercepting JavaScript calls to the browser infrastructure, it detects common cross-site scripting, mixed content and insecure DOM changes. The plugin displays the DOM modifications in real time so developers don't have to pause the application to run an outside debugger. It exports traces for easier collaboration and analysis."

Re:

[Shikaku]

Herp derp. I don't understand DOM debugging tools so I am gonna assume it is malicious.

Protip: if you're so concerned about Chrome(ium) having backdoors for Google, don't use it. There are many other browsers to choose from.

Hint: this is a service similar to what Noscript provides, except Noscript stops them while this feature highlights where it may be possible.

Re:

[bondsbw]

This is the great thing about 2011, after all. Back a decade or so ago, saying "Concerned about IE? Don't use it." was just unrealistic for many web apps.

I, for one, welcome our new open, competitive overlords.

Plug-in is going to be very popular.

[140Mandak262Jamuna]

Plug-in is going to be very popular, among the malware purveyors ! looking for some automated way to find all the holes in the websites. Though this is going to create some new exploits in some pages, it is good in the long run. It is essentially spraying red paint on all unlocked cars in a neighborhood. Some cars will be burgled in the short run. But all car owners will start locking their cars, in the long run.

Re:

[kelemvor4]

A ridiculous concept to be sure, but one that is used in real life. A friend of mine found a note in his car from the local police department asserting that they had burgled his car and that he should lock it. Personally I think he should have gone to the trouble of pressing charges against them, but that's beside the point. It's unfortunate that many people today find this sort of practice acceptable. Neither burglary or website hacking is acceptable regardless of the reason you're doing it. Maybe ne

Re:

[silverglade00]

You can always write a plugin for the plugin. Problem solved!

Please, no.

[Tei]

Writting complex webpages is already complex enough withouth having to check against any type of antivirus, "protection" plugin, etc...

And what protection is a system so one user is not afected, wen all others that use the same page will be afected? Is better to fix the page first.

Re:

[thePowerOfGrayskull]

To be fair the summary is poorly written; the initial description implied that it could be used exactly as GP thought it was intended.

Re:

[Tei]

Oh... you are right. Seems a extension for the existing panels on the browser.

It'd be interesting to have a security audit

[VincenzoRomano]

on the plugin itself.

This is a tool for website designers!

[subanark]

The purpose of this tool is to help make your website not rely on external resources in such a way that it could make your website dangerous if your 3rd party affiliates decide to either exploit your users, or they get their resources hacked into. E.g. you have a form; your form allows custom avatars, someone decides to make a special custom avatar that rewrites the current page to put a custom login area that can steal people's passwords as they log in.

Congrats

[MikePikeFL]

Congrats Radi! Looks awesome, and perchance a suitable replacement for that *other* DOM based testing tool that I still use to this day even though the code base is wicked old and uber-outdated. :-)

Interceptions...

[jkiller]

You can search for this semi-useful extension with keywords: "Brett Favre plug-in"

Only 18 comments?

[Qzukk]

Everyone who uses chrome probably did what I did and ran out to install the extension to see what happens on slashdot.

Answer: it breaks the fuck out of slashdot whether it's in active, passive, or standby mode, pretty much all of the 2.0ish stuff like replies and opening comments ceases to work (everything opens a new page).

Uninstalled it and now slashdot is back to the normal level of brokenness. Apparently whatever it does to "inject" all this stuff needs just a little more work to make sure it doesn't disturb the javascript that is already there.

Re:

[datapharmer]

forget just slashdot and web 2.0 you can't even load google's encrypted search page with this thing enabled in any form. Google: at the very least test with your own site before releasing to the entire friggin' world!