2

I came across several "productivity" extensions (eg. Limit) that can block websites if you enter it into their list. Some desktop/phone apps can also block other apps. I am quite new to information security but I am interested in how this happens.

  • Is the process of blocking websites the same for a chrome extension and a desktop app or phone app?
  • How is the process of blocking apps different from blocking websites?
  • Does the browser matter? (eg. Firefox extensions v Chrome extensions)
  • Is there someplace where I can read up more on this?
  • Is there anything else I should know if I try to recreate this? (eg. prerequisites)
Bob Ortiz
  • 6,665
  • 11
  • 50
  • 96
Junior Hat
  • 23
  • 4

2 Answers2

1

Is the process of blocking websites the same for a chrome extension and a desktop app or phone app?

Not necessarily. A Chrome Extension can only act inside the Chrome sandbox and not act on other apps. But a native application with administrative capabilities could in theory block both applications as a whole and access to specific sites.

How is the process of blocking apps different from blocking websites?

When blocking an app, you basically have to integrate into the operating system somehow. The user tells the OS "I want to open this executable file" and the blocking app needs to "hook" into that before the process launches. How exactly this happens differs between operating systems. This is also how a lot of anti-virus software operates.

Blocking websites is much simpler and can be done in numerous ways, such as an entry into the hosts file, redirecting the request to a non-existant domain. It can also be done through a similar "hooking" process. This is basically how adblocker software works.

Does the browser matter? (eg. Firefox extensions v Chrome extensions)

Yes and no. Blocking on the DNS level is browser-independent, but the "hooking" method requires the browser to offer a hook for an extension to register with, as well as support for extensions to begin with.

Is there someplace where I can read up more on this?

Since the technical process is the same for "productivity" and "ad blocking" apps, I'd suggest find an open-source ad blocking app and see how they do it.

The one who tests
  • 229
  • 2
  • 4
1

1. Is the process of blocking websites the same for a chrome extension and a desktop app or phone app?

I'm going to assume by "blocking websites" you refer to blocking web access altogether (like using the HTTP/HTTPS protocols) either through the use of a URL (containing the host and domain name) or through direct IP (v4/v6) access.

Blocking web access can be done on several levels. For example a specific port (HTTP/80) or (HTTPS/443) can be blocked for an entire local network or local device using a firewall. A firewall can be an hardware appliance as well as software, as simple as "Windows Firewall". Another way of blocking specifically access to hostnames is using DNS, often a blocklist will be used to rewrite those hostnames to a non-existent IP address such as 0.0.0.0 or a local or loopback address such as 127.0.0.1. This could for example be done in the network routing rules (likely used in VPN apps) or the local host file.

Browser extensions are limited and bound to the APIs that the browsers offer them. This could be as simple as accessing the contents from the address bar and the hostnames of all outgoing requests, matching that using a blocklist and blocking those requests before it reaches the internet. The process in theory is likely similar but the exact methods used could differ depending on the platform.

2. How is the process of blocking apps different from blocking websites? Does the browser matter? (eg. Firefox extensions v Chrome extensions)?

The "blocking websites" and the browser part is answered in above question.

The process of blocking apps is an entirely different question. If you mean only that apps web access, all of the above still applies when done on the system. If you refer to authorization of installing or opening that app altogether the developers are entirely depended on what options the platform (for example iOS, Android, Windows) provide the software builder.

3. Is there someplace where I can read up more on this?

I would suggest getting a more basic understanding of how network communication works and specifically in what stages you could intercept or interrupt (block) such connections. Than depending on your use cases you could read up on browser of platform specific documentation such as like for example the with Google Chrome browser extensions, https://developer.chrome.com/docs/extensions/reference/devtools_network/ or something as simple as how to use the local host file or firewall such as described for example here: https://www.alphr.com/block-websites-windows/.

4. Is there anything else I should know if I try to recreate this? (eg. prerequisites)

Google (and StackExchange) is your friend when it comes to finding answers to specific questions. The best bet it to start learning more about network communications in general, take for example an (online) course on The Fundamentals of Network Communications. Check out the OSI model, DNS, TCP/IP model, HTTP protocol et cetera.

Bob Ortiz
  • 6,665
  • 11
  • 50
  • 96