Browser extensions are additions to a web browser that provide extra functionality.

learn more… | top users | synonyms

4
votes
1answer
65 views

How to prevent installation of Google Chrome extensions

You can prevent the installation of Google chrome extensions on a Desktop?
2
votes
0answers
46 views

Chrome opening and immediately closing a tab after clicking SOME links [closed]

A few days ago I installed OSX 10.8 on a clean disk, and moved some of the old apps and data form the old to the new one. I've noticed that Chrome exibited an odd behaviour: when clicking some links, ...
0
votes
1answer
104 views

Firefox vs. Chrome extensions: Which are---ceteris paribus---more secure?

As an 'extension' to earlier questions on this topic (for instance here and here), What makes Firefox extensions (appear) more secure than Chrome extensions? Do they just appear to be more secure, ...
2
votes
0answers
150 views

Some http requests are not send encrypted by vpn! Why?

I subscribed to a VPN service recently, and installed wireshark to take a look at the traffic sent from my computer. Practically all of it goes through UDP protocol, encrypted. But there are two HTTP ...
-2
votes
1answer
48 views

Can OCSP stapling reduce or eliminate the weaknesses inherrent with OCSP? [closed]

Specifically, the problems with OCSP that Adam Langley talks about here?
1
vote
2answers
5k views

Browsec - VPN and anonymizer

According to Browsec's website this application can be used to Bypass firewalls. So in countries like Iran it seems a useful tool to bypass censorship and filtering. For start using this application ...
1
vote
1answer
69 views

Simple protection against reflected XSS

I was going through some CLIENT side defenses against reflected XSS e.g. XSS auditor(chrome), IE8 XSS Filters, Noscript. They use regular expression and other sophisticated techniques. My question ...
1
vote
0answers
359 views

Is Google Chrome Extension access to SSL certificate validation output possible?

I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My ...
1
vote
0answers
35 views

What part of the browser is typically attacked? [closed]

Pretty sure that browsers are compromised most often through their plugins, at least, that's what I keep reading. So, then, does that mean the browser itself has vulnerabilities, and the plugins are ...
1
vote
0answers
30 views

Question about the Perspectives add-on, is this dangerous?

When I visited Google and Facebook, and then clicked on the Perspectives add-on button to check the certificate information, I saw this:     What does this mean? Shouldn't it have ...
2
votes
1answer
90 views

Which Browsers support TACK?

TACK is an IETF draft that allows certificate pinning for a TLS web server, provided the clients' bowsers support it. Unlike the certificate pinning feature available with HSTS preloading, the ...
1
vote
2answers
240 views

Do Chrome/browser extensions break the tab sandbox?

So, as far as I know, Chrome and possibly other browsers have a very low privilege process spawned for every tab. How do browser extensions interact in regard to this sandboxing? I'm not talking ...
123
votes
9answers
26k views

Is Adblock (Plus) a security risk?

My email-provider's website (http://www.gmx.de) recently started linking to the (German) site http://www.browsersicherheit.info/ which basically claims that due to its capabilities to modify a site's ...
1
vote
1answer
1k views

Is Vimium (Chrome extension) really safe?

I really like the Chrome extension Vimium. It significantly speeds up surfing for power users. However, when you install it, Chrome warns you because this extension injects JS code on every page you ...
0
votes
1answer
93 views

Browser Extension to show how your session is being shared

A while back I came across a browser extension (was available for Firefox and Chrome, maybe others) that showed you through a graphical 'node' interface how your browser session was shared with so ...
-1
votes
1answer
140 views

Reflected XSS Prevention plugin [closed]

Is there any plugin out there which prevent reflected XSS? Plugin could be either for firefox or chrome. Thanks.
3
votes
2answers
475 views

how to view extension privileges in firefox

In Google Chrome, I can go to chrome://extensions/ and click "permissions" to view the permissions that an installed extension has been granted. I cannot find an equivalent in Firefox. Is there such ...
7
votes
2answers
644 views

Browser based virtual machines

How would applying hypervisor (e.g. xen) principles in the development of a web browser offering isolated browser tabs (virtual machines) improve or reduce security of existing web applications (good ...
2
votes
1answer
220 views

Twitter.com in private browsing leaks data to normal browser. Other sites as well? Bug or feature?

This is the first time I encountered similar thing. When I log into the Twitter web site in Chrome (namely, the Iron version which is said to be security enhanced, but that does not matter here) in ...
1
vote
1answer
205 views

When a browser extension or user script pulls a JS file from Google's CDN, how does this compromise the user's privacy in terms of Google's reach? [duplicate]

The context from which my question has arisen is this user script which locally removes ads from Ixquick.com, which is an anonymizing 'proxy' search engine that gives the results from Google's index ...
3
votes
2answers
281 views

Injecting information in a web page (Gmail). Does it raise security problem?

I am developing a Google Chrome extension which encrypts/decrypts emails for Gmail users. So, I detect encrypted emails when the user opens an email on using tags. Once an encrypted email has been ...
2
votes
2answers
312 views

Ways to obfuscate web browsing habits [duplicate]

Web browsing metadata provides a lot of insight on person's habits. How can I reduce that insight? Is there something like "Detachment 2702" (http://en.wikipedia.org/wiki/Cryptonomicon) plugin for ...
15
votes
3answers
723 views

Are official browser add-ons really safe?

Almost any browser addon/extension that I install on my Chrome or Firefox (be it Firebug, RESTClient, ...) warns me, saying: It [the add-on] can: Access your data on all website Access ...
7
votes
1answer
360 views

Signing a browser extension

I want to make a browser extension available to users. Can I sign my extension so that users can verify it is authentic, without needing to trust the web site where they got the extension from nor ...
12
votes
3answers
1k views

What bad coding practices makes a browser extension vulnerable?

I'm trying to scan JavaScript files for vulnerabilities using JSHint. Specifically, I'm scanning the JavaScript files of browser extensions. To look for possible vulnerabilities I'm looking for bad ...
10
votes
2answers
521 views

Any tool for scanning vulnerabilities in browser extensions?

I am scanning browser extensions of Chrome and Firefox for vulnerabilities. Is there any tool which would help me do this?
11
votes
2answers
396 views

What should I look for when auditing a Firefox extension / plugin?

I've been asked to do a security audit on a Firefox add-on developed by a third party. I am a web developer with a reasonable grasp of JavaScript but am not a browser security expert. What kinds of ...
0
votes
1answer
380 views

How securely use Firefox Add-on to prevent steal data?

Some videos on YouTube demonstrate how a Firefox extension can collect login information used to login to websites such as Facebook. After installing this tool/malware as Firefox Add-on, I observed ...
8
votes
4answers
2k views

Is using “HTTPS everywhere” extension secure?

I would like to know if one should use 'HTTPS everywhere' extension? Is it secure to use it? Are there any better alternatives? HTTPS Everywhere is a Firefox and Chrome extension that encrypts ...
3
votes
1answer
321 views

Find malware in browser extensions

How can I check if an extension/addon consist of malware code? Is it easy to detect if it collects sensitive data (like spyware), logging keystrokes and so on? Can AV recognize malware extension as ...
6
votes
1answer
391 views

How do I check the code of a Chrome extension to make sure it's not stealing my info?

I've been reading more and more about just how much access browser extensions can have to your data. This is a little unsettling, so I'm curious if there is a way to Vet these extensions and make sure ...
14
votes
2answers
1k views

Why do Chrome extensions need access to 'all my data' and 'browsing activity'?

Often I install simple add-ons for Google Chrome. However, they almost all need what appears to me as excessive access to my data. For instance, I install an extension that allows me to click on any ...
1
vote
2answers
781 views

Are Google Chrome Extensions vulnerable?

I've just discovered this: You can create IFRAME pointing to "chrome-extension://" protocol You can access IFRAME content with jQuery Does this mean, I'm able to use badly written Chrome ...
10
votes
2answers
901 views

Can a Firefox add-on or plug-in access the user's websites' saved passwords in decrypted mode?

Going deeper into the previous question on Firefox plugins and add-ons malware risks: Could a Firefox add-on potentially decode and capture the encrypted websites' passwords saved in the browser?