Universal Mode - the boring details: why it matters and how it works

A lot of technical info below, read it only if you are really care.

It answers three questions:

• Why such a big change?

• What about security?

• Chromium warning

Why such a big change?

Our main thing is to keep an eye on WebRTC (Web Real-Time Communication) traffic and show you where the IPs are coming from, so you know who your browser is chatting with. Everything else is just extra.

Extensions have more power than regular websites, but they're still kept separate. To track WebRTC traffic, Videochat Extension had to inject some code into website. We never touched internal scripts, only modified browser's API. Lately, some sites have started abusing our trust in the webpage, like spamming our servers with thousands of fake geolocation requests or detecting our users and treating them differently.

Since we already had to inject detectable code, we figured why not add more cool features to make the extension and chat platform even better for you.

Back in 2021, making a good user interface for the extension was impossible, so we had to tweak how the website looked instead, to add our own things.

Chatruletka never contacted us or complained about what we were doing. We treated their platform how we'd want to be treated ourself, and it worked perfectly fine for over 3 years. But now, things seem to have changed, and they're not ok with us anymore. So, we're not supporting them anymore because it's not safe for you guys.

There are lots of ways to figure out IP locations without websites knowing or changing the data, but the best and easiest way is to let the extension tweak the internal Chromium page.

Chromium has let extensions change internal pages since version 27 (2013), but it's not turned on by default. Just flip the switch, and you can use the extension on any WebRTC site without them knowing. But watch out for some security risks, which you can read about below.

Using the chrome flag will be optional, our plan to to just give a heads-up before using just a usual website-level approach on sites that don't like being monitored.

What about security?

It's not super safe, but it's not super dangerous either.

Enabling the flag causes risks, Videochat Extension itself is not malicious, but YOU could become a problem.

Extensions usually shouldn't mess with the browser's internals because it gives them a LOT more power than they should have. But if they really need to, there's a way by turning on the chrome flag called chrome://extensions-on-chrome-urls.

These settings, or "flags" let you turn on hidden browser features, like letting extensions access the browser internals.

We are using this power very carefully and only when you allow us, and with Google/Microsoft checking every release before delivering it to you.

But if you install a bad extension manually while in developer mode, it WILL become a BIG problem.

This setting is off by default because letting all extensions modify the browser internals could be a big security problem. If a bad extension gets in there, it could mess up your browser or even your computer.

But additional protections are in place: even if an extension declares that it needs to modify every website, it still have NO access to chrome:// pages, even with the setting on, so its all good.

99.9% of extensions don't even declare the need to access the browser internals, so they can't get in there even if the setting is on. If they declare access later, it can only work as an optional permission, so it will be opt-in still.

So, even if some of your extensions go bad, they can't mess with the browser internals. They'd also have to say they need it in their manifest.json file, and Google monitors such extensions much more closely, which is exactly what malicious extensions want to avoid - unwanted attention.

Once again, the biggest risk is YOU installing a bad extension manually while in developer mode, so just don't do anything dumb and you'll be good.

Most bad extensions just want to mess with your search settings to make money. As long as you don't install random stuff from sketchy places in developer mode, you're completely safe. And if you do, you can always use Videochat Extension in a different browser while keeping your main one 100% safe with the flag off.

We're not open source anymore, but Google and Microsoft still check every update before you get it, so if you trust them with your security - you can trust Videochat Extension.

Chromium warning

If you turn on this flag, any Chromium-based browser will pop up a warning saying:

So, what does "Stability and security will suffer" even mean?

Basically, Chromium treats this flag is 'bad' because it gives some extensions more power. If you are worried, read more about security risks above.

tldr: don't install unknown things in developer mode and you will be fine.

You can check this warning in the Chromium source code. But don't worry—it's just a warning, not an error, and it's there for a reason that is explained in great detail above.

What's up with "unsupported"?

It means the flag could be removed someday.

But honestly, that's not likely to happen because it's super useful for accessibility and debugging extensions, and lots of people rely on it.

Some flags are temporary, but 'extensions-on-chrome-urls' is marked to 'never expire' in the Chromium source code, so it's not gonna be a problem.

Even if they remove it in 2059, there will still be an option to use the older browser, and manually creating such a hole in a modern browser would not be a problem.

Unless Google decides to do something crazy like block all visually impaired users from accessibility features, this flag isn't going anywhere.

You can just ignore the warning, or add --test-type to your browser's launch settings to make it go away. But it's a good reminder not to install sketchy extensions in developer mode.

If you check out Chrome from 2013, when this flag was first added, you'll see the same warning. :)

good luck!