Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I really like the Chrome extension Vimium. It significantly speeds up surfing for power users. However, when you install it, Chrome warns you because this extension injects JS code on every page you visit (which is potentially unsafe).

The author responds to this with "Don't be alarmed. Vimium never talks to any servers and does absolutely nothing with your data. Read the open source code if you're paranoid."

I have no reason to be suspicious except the fact that if there is malicious JS code in this extension, it could really do a lot of damage (steal passwords etc).

One way of verifying that this extension is indeed safe is by monitoring Chrome network communication.

Other would be (as author suggested) to inspect the code. Has anybody already did this, and if yes, what are the findings (preferably published on the web)?

share|improve this question
    
You can use Rob W's Chrome extension source viewer to check the code before installing. It is possible that the source code of an extension does not match the published source repository (example described by Rob). –  Lekensteyn Nov 1 '13 at 14:58

1 Answer 1

up vote 2 down vote accepted

It's not malicious. That doesn't mean that it's 100% safe (almost no piece of software is), but if there are any security holes, then they will be bugs, and not something the author has intended to do. It has 67 contributors on github and I'm sure a lot more people have wen't through the code without making any contributions (especially knowing the fact that it's mostly used by programmers who are used to VIM editor).

There are some 130+ reviews in the chrome webstore too.

share|improve this answer
    
I don't disagree that positive reviews are a good thing but as long as it does what it's supposed to, people will be happy. It's a question of what else it might be doing that's the worry. –  Matt Nov 1 '13 at 16:51
    
To revisit this question. I agree that larger number of contributors to project are some kind of assurance that there is nothing "hidden" inside the code. Of course it is unlikely that they analyzed the entire code, but each of them did analyze a portion of code. On another note though, it seems that you can't disable auto-update for this add-on, so even complete code survey for one version does not mean much.. you'd have to read the diffs after each update –  celicni Mar 13 at 16:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.