Epic Privacy Browser Forums

browserdude

Guest

Bring back extensions for the privacy risk-takers

I was excited to hear about Epic, but if it can't load my Chrome extensions, it's going to be of limited use.  I can live without most of mine, but I do have a password management extension that I rely on.

I understand why you blocked extensions, but for advanced or risk-taking users, I'd like to see Chromium's extension functionality brought back.  In the spirit of Epic, you could disable it by default and put the "click here to enable" button under a glaring privacy warning.

---

FAKE ACCOUNT, PLEASE DELETE

Optimus

Guest

Re: Bring back extensions for the privacy risk-takers

This is the one thing keeping me from using Epic - I use Lastpass to manage my passwords and keep them strong and unique across sites. It's the only extension I use, but without it I just can't function.

alok

Administrator

Re: Bring back extensions for the privacy risk-takers

Hi Browserdude -- do you use Lastpass as well? 

The major problem with extensions is that they represent huge privacy risks -- even so-called privacy extensions often represent huge privacy risks like sending all your browsing through their servers.  So once we allow extensions carte blanche, we really throw the hope of privacy out the window!! 

We are considering allowing certain very secure and private extensions & lastpass may be one such extension -- I believe with LastPass and maybe their Xmarks as well, if you lose your key, then you lose your data?  I.e. they don't even sync data onto their servers -- it's very much local?   

Please keep sharing thoughts on this -- we know there will be a lot of opinions and requests here!

lynxwildcat

Guest

Re: Bring back extensions for the privacy risk-takers

I am another user who requires lastpass extension to be enabled to make use of this browser.

I know you want the browser to be 'epic' and very private - but disabling extensions preclude users from deciding what features they need in the browser.

If you want the browser to make a difference, make it open and extensible, and let people decide how they want to use it.  A tightly locked down browser is not very useful to most people.

my.epic.test

Guest

Re: Bring back extensions for the privacy risk-takers

I use a password manager as well which has an extension.

alok

Administrator

Re: Bring back extensions for the privacy risk-takers

@lynxwildcat -- passwords & bookmark syncing are definitely core so we'll work to bring popular addons into Epic that are highly private.  The problem with opening it up to all addons is we throw privacy pretty much out the window.  We feel Epic at core is for keeping your browsing & searches private even if it means things are a bit bare bones for now at least. 

Just my thoughts...keep sharing yours & hope more join in the discussion.

kittengnu

Guest

Re: Bring back extensions for the privacy risk-takers

I don't think it will add much to the debate, but I'll another voice to that we are indeed in the need of extensions. I can however see where you're coming from, and holding on the ideals is much better then just add a "enable" button and most users will automatically jump to it, hence defeating the purpose of the browser. But there's some features you limits one without extension, and for me as well I'm in need of the history. So for me, once the Linux version comes out I'll use Epic beside Opera Presto, and waiting for you till you've found a suitable solution to bring back extensions (I'm a bit skeptic if adding a white-list solution though, if that is what you hinted) and history.

Also a note/bug is that you can install extensions. I was able to install DuckDuckGo's browser plug-in, but with the plug-in page being blocked, I can't really remove it.

:3

Edit: Yeah it is fully possible to circumvent the block and install from Google's Web Store.

Last edited by kittengnu (2013-09-12 20:30:31)

Optimus

Guest

Re: Bring back extensions for the privacy risk-takers

Lastpass does synchronize data to their servers, however it is all locally encrypted so in that regard you're correct that if you lose your password, it's all gone. However, they do sync that locally encrypted data - again, a feature I enjoy as I can keep my accounts consistent between the multiple devices I use at home and work.

https://lastpass.com/support.php?cmd=showfaq&id=375

Edit to add: If the built in google sync tech is being blocked, then being able to use Xmarks would be important as well.

Last edited by Optimus (2013-09-13 19:38:20)

Gwakamol

Guest

Re: Bring back extensions for the privacy risk-takers

Hello all,

I use keepass. It's similar to Lastpass except it's opensource. Having keepass integrated (as it can be in firefox through extension) would be very nice.

As for the enable button with a privacy warning, I think it's a good idea. Holding on the ideals, as suggest kittengnu, is counterproductive in the long run in my opinion. The person that will use Epic are people already aware of general privacy issues. It's never good to block entirely something just because it's supposed to be better for everybody. People need to be in charge of their privacy. If they want to jump on the button and enable all extension, they should be able to do it, as long as there is a warning sign telling them why they shouldn't. Imposing something mean you take away the possibility for the people to make the choice and understand the implication of that choice.
Now it could be nice to have an indicator of the global privacy settings. Maybe a percentage with 100% being all security option enable and zero being normal internet settings (epic would never go there obviously) ; or Maybe a slider bar with on one side privacy and on the other normal internet experience. This indicator would be a reminder for the average Joe of the implication of his choice on his daily security. But I'm just brainstorming here, I have no idea if it would be easy to implement

Another extensions that I would need in order to make a full switch is DuckDuckGo's browser plug-in. You seem to follow the same kind of values with those guys. Maybe a partnership could be nice because I don't know nothing about the epic search engine and I don't feel like learning about a new one. Duckduckgo suits my needs ; Plus they have !bangs !

The cherry on the cake would be a undo closed tab button like in Opera, but I can wait a little bit more for that

As you can see I'm quite enthusiastic about Epic browser so, please, keep up the good work !

alok

Administrator

Re: Bring back extensions for the privacy risk-takers

Thanks so much for your enthusiasm &  great thoughts!!

Yes, we are leaning towards allowing at least a set of quite private addons with warnings! 

Keepass is nice addon!

We're also exploring adding more default search engines & talking to DuckDuckGo! 

Please keep sending us the requests & thoughts!!

Notso

Guest

Re: Bring back extensions for the privacy risk-takers

I have to concur - people using Epic probably understand the risks to begin with. I think the idea of a 100%-0% slider is a good way to alert people. Also, a massive warning pop-up.

There are several QoL extensions I use which, while I can live without them, I'd like to be able to judge for myself how dangerous they are to my privacy, rather than feel restricted when I use Epic. Rather let us choose than sacrifice freedom of choice in one area for another.

Themes as well? I can't imagine they do much spying...

alok

Administrator

Re: Bring back extensions for the privacy risk-takers

Hehe regarding themes & spying!!  What sort of themes?  Send us your ideas/what you'd like!

What QoL extensions do you use?

Thanks for the feedback & thoughts!

jcmaxuser

Guest

Re: Bring back extensions for the privacy risk-takers

Hello all. i install epic browser and want to use it with my settings and here  is stops me from using it because extensions are disabled. i use adblock plus and no script on firefox and it default browser because it disabling full banners what i want and i use omni box to search. yes my search engine is google because there more results. So why write here ? Big job create and many functions are cutted for privacy and that is good in epic browser but dont you think that setting must be setting up by user for that and created settings page. So i want to use epic B. but some settings is locked and stops me.

Bluesrains

Guest

Re: Bring back extensions for the privacy risk-takers

Yes, Im missing my Chrome Extentions as well. Do you think these are bad?

AddThis
Google Translate 1.2.5
Hover Zoom 4.22
My Chrome Theme 2.0
Scroll To Top 4.3
Xmarks Bookmark Sync 1.0.26

Optimus

Guest

Re: Bring back extensions for the privacy risk-takers

Three months on and no progress on allowing specific extensions? Not even a post in this thread in a month. There seems to have been great progress on this browser in other areas but it simply unusable for me without LastPass (Xmarks would be a strong second requirement).

sai

Guest

Re: Bring back extensions for the privacy risk-takers

Hi Optimus, we are in the process of setting up of our own Webstore, So please bare with us. It should be there in another 3-4 weeks.

---

http://arstechnica.com/tech-policy/2013 … ensorship/

nono95

Guest

Re: Bring back extensions for the privacy risk-takers

Hi,

IMHO it is dangerous to allow the extensions.
I downloaded Firefox latetly, on a normaly trustworthy site, and the browser came with a spying tool bar extension that was impossible to remove.
I think that people that will download epic on an other site than the epic official site will potentialy face this problem.

An other approach would be to include the most interesting feature directly in the browser.

tedward

Guest

Re: Bring back extensions for the privacy risk-takers

With extensions enabled, epic becomes my default browser.

tyilo

Guest

Re: Bring back extensions for the privacy risk-takers

The argument that enabling extensions would be a privacy issue is nonsense, as only SOME extensions increase privacy risks.
This would be the same as saying you should disable keyboard input, because I might just type my bank password in every site I visit. Yes, I might do that, but I won't. I won't install extensions that obviously increase privacy risks.

I can't use Epic browser before I can use these extensions:
4chan X
DuckDuckGo for Chrome
Hover Zoom

sai

Guest

Re: Bring back extensions for the privacy risk-takers

Hi tyilo,

We're going to support some of the extensions imminently.

Thank You
Sai

---

http://arstechnica.com/tech-policy/2013 … ensorship/

dilgreen

Guest

Re: Bring back extensions for the privacy risk-takers

Just to reinforce the request for making it possible to add the lastpass extension. The point of this is that making it easy to use really secure passwords is completely consistent with using epic - better security.

As to technicalities, obviously you don't want to make it easy to add extensions from 3rd parties as these will likely be used to undermine epic's main purpose.

Nevertheless, wouldn't it be possible to allow installations ONLY of approved extensions - validated by the checksum of the supplied code? Chrome knows when certain extensions can't be installed, so there is obviously code there to determine whether a particular extension is permitted, and for handling the situation when it isn't - could this be adapted to allow only approved extensions/versions from approved suppliers/sources?

weathertop

Guest

Re: Bring back extensions for the privacy risk-takers

First of, I work in IT Security so I post this coming from experience. What a lot of people are missing is that Epic should be your BROWSING browser. You know what you're getting into with sites you log in to (and, since you're logged in, they're tracking some information anyway). Chrome or Chromium with all your favorite extensions should be your TRUSTED SITES browser. In other words, checking email or social media? Chrome or Chromium. Performing web-searches, browsing websites, viewing cat-pictures, etc.? Use Epic.

LastPass is not all that secure compared to KeePass, the reason is KeePass saves your password data to a local file: you have to manually schlep it around to get it on your other devices unless you're using an extension to link it to Google Drive or something like that. Even then, you're still determining where your password DB gets sent. LastPass is automatic, syncs your passwords to the cloud. I use LastPass and KeePass, for entirely different sets of passwords, and the last thing I want is either of them touching Epic. It's not that I don't trust Epic, but really, Epic's greatest strength is protecting you against privacy threats from casual browsing. If you're truly paranoid you should probably be using a VPN and TOR, with Epic (as it is) anyway, and not using a password manager (much less a cloud-based one) to store your passwords. Figure out one password and someone has your entire credentials list. And even then, the moment you authenticate into something you've kind of defeated the purpose of private browsing.

Add me to the small informed chorus of folks suggesting that the Epic staff not start adding a bunch of plugins. And to the masses here that seem to insist on plugins, make a choice: Privacy, or Convenience. You cannot have both.

rockman

Guest

Re: Bring back extensions for the privacy risk-takers

Add me to the small informed chorus of folks suggesting that the Epic staff not start adding a bunch of plugins. And to the masses here that seem to insist on plugins, make a choice: Privacy, or Convenience. You cannot have both.

I completely agree with weathertop. Keep Epic's original design goals and do not allow user-installed extensions or plugins. Actually, the first thing I do with a new browser install (Chrome, Chromium, Firefox, etc) is disable all plugins and extensions. Then only enable/add the few that I require.

Actually, perhaps Epic should consider disable everything by default under chrome://plugins be default? e.g. Adobe Flash has been shown to be the worst privacy offender.
http://www.welivesecurity.com/2010/10/0 … er-part-1/

Thank you.

rockman

Guest

Re: Bring back extensions for the privacy risk-takers

Chromium is even killing NPAPI plugins this year. (Re: Adobe Flash NPAPI plugin...)
http://blog.chromium.org/2013/09/saying … npapi.html

keith.greene

Guest

Re: Bring back extensions for the privacy risk-takers

I just want to weigh in on the whole extension issue. I would be using Epic as my main browser if not for the whole "No extensions" thing.
My biggest issue is that I cannot use Adblock with Epic at all. I realize that *some* plugins/extensions track or otherwise violate privacy in some way, but with no way to block ads (some of the absolute worse offenders) I cannot use Epic .
It seems to me that blocking ALL extensions for the sake of a few bad actors is overkill. At the very least, make it an option for power users. Something, maybe a checkbox with a HUGE warning, or an additional module to download that turns on extensions for those that want them. Not giving the user a choice is a show stopper for me, and I'm sure a lot of others.