6

I would like to be know which ways are available to check the behaviour of a firefox extension.

While wikipedia states that any browser extension can have access to everything done by the browser, I would like to assure myself that an extension isn't making background HTTP requests and/or looks for everything I do on a webpage (while the second point is close to that question).

I am not talking about open source / verified add-ons.

Improve this question
3

You could run Wireshark to check for such background activity while using the add-on.

Alternatively you can forward your traffic through a proxy like Burp or Fiddler and analyse it there.

Improve this answer
4
  • I thought of wireshark, but haven't yet dig in to it and thus don't know how I can see which software makes each request.
    – Lich4r
    Nov 8 '15 at 17:25
  • 1
    Wireshark runs at the interface level so it does not know which application up the stack has made the call. A proxy will be more fine grained in the sense that you will know that this is the browser which makes the call (but not which component).
    – WoJ
    Nov 8 '15 at 17:29
  • So I'll set up an empty firefox profile and only install the extension. Should be good while not perfect. Thanks
    – Lich4r
    Nov 8 '15 at 17:31
  • This will only catch network activity. If the addin records activity for awhile before phoning home, you may miss it. Firefox's security model relies on manual review. They are moving to a more automated model blog.mozilla.org/addons/2015/08/21/…
    – Neil Smithline
    Nov 8 '15 at 18:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.