Browser extensions are additions to a web browser that provide extra functionality.

learn more… | top users | synonyms

2
votes
1answer
30 views

How to list all the permissions requested by an extension?

To install an extension, the browser (Chromium Web browser) give us an alert "can read all data on your computer and the websites you visit" , Sometimes we need to install an extension at least to ...
3
votes
1answer
78 views

Why browser hijacker changes the homepage to yahoo [closed]

I have seen many browser hijacker like istartsurf, ask.com which changes the victim's search engine to yahoo. Why many(almost all) browser hijacker changes the search engines to yahoo. Is there any ...
1
vote
1answer
52 views

HTTPS Everywhere (Firefox) allows mixed content on pages with images

I use HTTPS Everywhere extension for Firefox, and recently I've started witnessing Mixed Content warnings from time to time, apparently when there are images with http:// prefixes (in particular at SE ...
1
vote
0answers
23 views

Why can't VPN extensions filter everything in the browser?

For example, when I'm using one of this extensions, such as ZenMate or Browsec, I'm not able to watch video streamings. Or another thing that happened is my internet provider detecting me going on a ...
0
votes
2answers
99 views

Internet browsing encryption

I have a shared wifi point with a person who might be interested in knowing what I am browsing, writing and downloading in the internet. This person is the master of this wifi network, only he has an ...
6
votes
1answer
33 views

How to check browser extension behaviour?

I would like to be know which ways are available to check the behaviour of a firefox extension. While wikipedia states that any browser extension can have access to everything done by the browser, I ...
2
votes
1answer
58 views

WebRTC attack surface area?

I'm building an app for browser-to-browser communication. What is the attack surface area for WebRTC in 2015? What kinds of attacks could be done? And more importantly, how do I craft something ...
2
votes
1answer
154 views

Is it possible to feed Firefox Flash plugin with controlled data for privacy reasons?

For privacy and security reasons, it would be strongly recommended to deactivate the Flash plugin in the browser. But I don't want to deactivate it, I want to fake privacy relevant information. ...
1
vote
2answers
55 views

About browsers injectors (Sonic Train)

I know that viruses use some ways to inject some ADs in the browsers web pages like : 1-Inject an extension 2-Inject some codes to the browser process 3-With a proxy server 4-Install an injected ...
1
vote
1answer
72 views

Protecting users with browser extension. Is it possible, if the machine is already infected?

Assume a trojan acquired admin privilege on a Windows 7 machine. How easy is it for the trojan to replace/hijack/modify a browser extension without user knowing it? Is it possible? I am thinking of ...
0
votes
2answers
188 views

Chrome/ Opera continue to save & autofill passwords after installing LastPass? Good or bad? Enable/ Disable?

I moved to lastpass a few months back and imported passwords from all Browsers. Apparently, Chrome & Opera {based on Chromium} still pop-up the option to save passwords and are probably ...
2
votes
3answers
495 views

How to spoof my IP address to JavaScript and other security concerns

Many websites require JavaScript. However, enabling JS means that a website can run a JS snippet to retrieve the user's IP address (even if they are behind a proxy or VPN). So, how can I (the user) ...
1
vote
3answers
112 views

Addons in Chrome

When installing any add on in Chrome, a set of permissions is needed to be granted to the add on. Many addons(including popular ones like Pocket and Adblock) have Read and change all the data on the ...
4
votes
2answers
105 views

apple.com exploit attempt?

I recently browsed to apple.com; and the page crashed a few times, then after I reloaded I was given this alert after my browser attempted to redirect to ...
1
vote
0answers
119 views

How to know which extension or software is causing ads in Chrome? [closed]

Starting yesterday, I noticed that something weird is going on with my laptop. After unlocking my laptop I found that the empty Chrome pages that I opened are getting redirected to ads. I am running ...
1
vote
3answers
410 views

Can a shim (a.k.a. polyfill) be installed in IE, FF, or Chrome without user knowledge, and can it read passwords entered by user on a login page?

The questions here are about shims in the 3 most commonly used browsers. A shim (also known as polyfill) is a piece of code (often JavaScript or Flash) implemented to augment the native API in a web ...
2
votes
3answers
220 views

Browser as Honey-Pot, is there?

I'm watching all this movement around Metasploit project, the great number of different exploitation plugins, and thousands of exploit packs. Now, it is real truth, anyone could configure his own ...
0
votes
0answers
76 views

Why malicious browser extensions along with API hooking

Most malware steals financial data by hooking to browser APIs like PR_Read, PR_write etc.. Also I see some malware like Sinowal use browser extensions along with these API hooks. I believe a user ...
0
votes
0answers
2k views

Does this list every Chrome extension/addin that may leak privacy?

I am looking for a simple list of all extensions, preference, custom processes, and "flags" that may disclose a user's privacy or other details to a 3rd party. To that end, I discovered: ...
3
votes
1answer
92 views

Bing bar without admin rights

I know viruses uses exploits to gain admin rights to install software. My question is here at work, we have people end up with the Bing Bar installed from time to time on their machines. It is listed ...
5
votes
3answers
910 views

What are NoScript surrogates and should one disable them for more privacy in browsing?

NoScript has a feature of supplying its own "surrogate" scripts instead of well-known tracking/ad scripts (Google Analytics, for one). Does it matter for my privacy if I do not change the factory ...
6
votes
3answers
264 views

How to add certificate pinning for a certain domain to my web browser?

There is HPKP (HTTP Public Key Pinning) which servers use to tell the client's web browser which certificates to trust (in the future) for the domain that is being contacted. Google's Chrome and ...
10
votes
2answers
2k views

How to improve the security and privacy of Firefox

What would be a sensible approach to enhance the security and privacy of Firefox? I did not find a question about this and I feel that some guidelines for casual web users would be handy. Currently ...
4
votes
1answer
271 views

Use of JavaScript by LastPass to encrypt & decrypt the password database a secure approach?

LastPass is a top-rated password manager that comes as a browser extension and uses a master password to encrypt and decrypt the password database using the JavaScript. Is this a secure way of doing? ...
11
votes
3answers
7k views

Is Firefox Password Manager less secure than LastPass?

After installing the LastPass password manager, I am presented with a login dialog including the option to "Disable Insecure Firefox Password Manager". (This option appears as long as the Firefox ...
1
vote
2answers
1k views

Are Chrome extensions like Advanced REST Client safe to use?

I'm just getting into learning REST and came across this great application that instantly lets me test out requests (Advanced Rest Client). The question arose that since it is an extension to the ...
4
votes
3answers
13k views

How to prevent installation of Google Chrome extensions

You can prevent the installation of Google chrome extensions on a Desktop?
2
votes
0answers
6k views

Chrome opening and immediately closing a tab after clicking SOME links [closed]

A few days ago I installed OSX 10.8 on a clean disk, and moved some of the old apps and data form the old to the new one. I've noticed that Chrome exibited an odd behaviour: when clicking some links, ...
0
votes
2answers
1k views

Firefox vs. Chrome extensions: Which are---ceteris paribus---more secure?

As an 'extension' to earlier questions on this topic (for instance here and here), What makes Firefox extensions (appear) more secure than Chrome extensions? Do they just appear to be more secure, ...
3
votes
0answers
258 views

Some http requests are not send encrypted by vpn! Why?

I subscribed to a VPN service recently, and installed wireshark to take a look at the traffic sent from my computer. Practically all of it goes through UDP protocol, encrypted. But there are two HTTP ...
-2
votes
1answer
73 views

Can OCSP stapling reduce or eliminate the weaknesses inherrent with OCSP? [closed]

Specifically, the problems with OCSP that Adam Langley talks about here?
3
votes
2answers
27k views

Browsec - VPN and anonymizer

According to Browsec's website this application can be used to Bypass firewalls. So in countries like Iran it seems a useful tool to bypass censorship and filtering. For start using this application ...
1
vote
1answer
107 views

Simple protection against reflected XSS

I was going through some CLIENT side defenses against reflected XSS e.g. XSS auditor(chrome), IE8 XSS Filters, Noscript. They use regular expression and other sophisticated techniques. My question ...
2
votes
1answer
1k views

Is Google Chrome Extension access to SSL certificate validation output possible?

I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My ...
1
vote
0answers
40 views

What part of the browser is typically attacked? [closed]

Pretty sure that browsers are compromised most often through their plugins, at least, that's what I keep reading. So, then, does that mean the browser itself has vulnerabilities, and the plugins are ...
1
vote
0answers
40 views

Question about the Perspectives add-on, is this dangerous?

When I visited Google and Facebook, and then clicked on the Perspectives add-on button to check the certificate information, I saw this:     What does this mean? Shouldn't it have ...
3
votes
1answer
200 views

Which Browsers support TACK?

TACK is an IETF draft that allows certificate pinning for a TLS web server, provided the clients' browsers support it. Unlike the certificate pinning feature available with HSTS preloading, the ...
2
votes
2answers
868 views

Do Chrome/browser extensions break the tab sandbox?

So, as far as I know, Chrome and possibly other browsers have a very low privilege process spawned for every tab. How do browser extensions interact in regard to this sandboxing? I'm not talking ...
140
votes
9answers
107k views

Is Adblock (Plus) a security risk?

My email-provider's website (http://www.gmx.de) recently started linking to the (German) site http://www.browsersicherheit.info/ which basically claims that due to its capabilities to modify a site's ...
5
votes
1answer
2k views

Is Vimium (Chrome extension) really safe?

I really like the Chrome extension Vimium. It significantly speeds up surfing for power users. However, when you install it, Chrome warns you because this extension injects JS code on every page you ...
0
votes
1answer
115 views

Browser Extension to show how your session is being shared

A while back I came across a browser extension (was available for Firefox and Chrome, maybe others) that showed you through a graphical 'node' interface how your browser session was shared with so ...
-1
votes
1answer
199 views

Reflected XSS Prevention plugin [closed]

Is there any plugin out there which prevent reflected XSS? Plugin could be either for firefox or chrome. Thanks.
6
votes
2answers
1k views

how to view extension privileges in firefox

In Google Chrome, I can go to chrome://extensions/ and click "permissions" to view the permissions that an installed extension has been granted. I cannot find an equivalent in Firefox. Is there such ...
7
votes
2answers
1k views

Browser based virtual machines

How would applying hypervisor (e.g. xen) principles in the development of a web browser offering isolated browser tabs (virtual machines) improve or reduce security of existing web applications (good ...
2
votes
1answer
339 views

Twitter.com in private browsing leaks data to normal browser. Other sites as well? Bug or feature?

This is the first time I encountered similar thing. When I log into the Twitter web site in Chrome (namely, the Iron version which is said to be security enhanced, but that does not matter here) in ...
1
vote
1answer
414 views

When a browser extension or user script pulls a JS file from Google's CDN, how does this compromise the user's privacy in terms of Google's reach? [duplicate]

The context from which my question has arisen is this user script which locally removes ads from Ixquick.com, which is an anonymizing 'proxy' search engine that gives the results from Google's index ...
3
votes
2answers
494 views

Injecting information in a web page (Gmail). Does it raise security problem?

I am developing a Google Chrome extension which encrypts/decrypts emails for Gmail users. So, I detect encrypted emails when the user opens an email on using tags. Once an encrypted email has been ...
2
votes
2answers
711 views

Ways to obfuscate web browsing habits [duplicate]

Web browsing metadata provides a lot of insight on person's habits. How can I reduce that insight? Is there something like "Detachment 2702" (http://en.wikipedia.org/wiki/Cryptonomicon) plugin for ...
21
votes
3answers
1k views

Are official browser add-ons really safe?

Almost any browser addon/extension that I install on my Chrome or Firefox (be it Firebug, RESTClient, ...) warns me, saying: It [the add-on] can: Access your data on all website Access ...
8
votes
1answer
1k views

Signing a browser extension

I want to make a browser extension available to users. Can I sign my extension so that users can verify it is authentic, without needing to trust the web site where they got the extension from nor ...