Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've been reading more and more about just how much access browser extensions can have to your data. This is a little unsettling, so I'm curious if there is a way to Vet these extensions and make sure they're not sending any personal info back to their servers.

Is there a way to check this?

I know there is a Chrome Extension called: Extension Gallery and Web Store Inspector, and it seems that it would give me some good info, but I'm not a code guy so honestly I'm not sure what I'm looking for with this info. Thoughts?

share|improve this question

migrated from superuser.com Jan 23 '12 at 23:42

This question came from our site for computer enthusiasts and power users.

1  
Fiddler can show you any http requests. Wire shark is more advanced. It will take time though –  ppumkin Jan 23 '12 at 22:02

1 Answer 1

up vote 4 down vote accepted

First of all I would pay attention to Permission Warnings.

Performing an analysis of an extension is a game of cat and mouse. You can sniff the network traffic and the attacker can use Stenography. You could unpack the extension and look at the JavaScript code, but the malicious code could be obfuscated or underhanded.

That being said. Chrome runs extensions in a sandbox. These extensions run JavaScript very similarly to JavaScript that run in the context of a website with only a few added permissions. These extensions don't have access to the shell or the file system or even to another extension's data store. They are limited in the number of HTTP requests that they can make to prevent DDoS. Its not a very ripe target.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.