@blackbird71 said in So it is impossible to natively block a malicious website in Opera, right?:
Given that in current chromium rendering engines, extensions potentially have the ability to hook a browser's 'internals' before the browser actually processes the site code, the browser may not be able to "escape" what an extension does. This is how Ublock Origin, Ghostery, and many other similar extensions are able to block sites (or portions thereof) effectively. A malicious extension can use the same hooking mechanisms to inject ad pages into the browser data stream, and there is little that can be done in the browser itself to over-ride the behavior other than disabling/removing the offending extension. There is currently much controversy over chromium developers' recent efforts to reduce the scope of some of the extension hooking since that would also make ad blockers less effective, though it would tend to reduce the attack surface used by rogue extensions.
That is the problem, browser, page code and extensions almost run on the same level.
Obviously, the whole browser-extension architecture (all browsers) is flawed and primitive.
Instead, the user should always have the highest level of control and priority, next should come the browser and last the page code and the "extensions". The page code and the extensions should run completely isolated from the real world and whenever they need to "communicate" they should only be able to request high-level features implemented, provided and supervised by the browser with a safe protocol.
So there will be only one specific entity responsible for the implementation: the browser, and no harm should be possible by any code running inside a web-page or extension.
All data (sensitive or not) should only exit the browser in an encrypted (useless) form and local access should be highly restricted.
The ads should have a specific user-friendly standard. Non-standard ads reported should cause the ban of the website. So if the user doesn't want ads, there will be no ads -no ad-blocker extension required.
If and when a nasty behavior is noticed by the user, both the effect and the cause would be easily identified by the middle guy -the browser and blocked by the user, eg, not just the URL, but also the page or extension that opened it.
That I would call a user-centered browser -just a few ideas.
