3

Firefox addons are known to send data (like the URLs visited, location, installed cookies etc.) to their maintainers and (from there) to third parties. See for instance the newest "scandal" about the WebOfTrust addon (link is in German):

https://www.kuketz-blog.de/wot-addon-wie-ein-browser-addon-seine-nutzer-ausspaeht/

Since, on the other hand, addons are also essential to prevent tracking activities (e.g. the well-known NoScript addon), simply disabling all addons does not seem to be a good solution to protect one's privacy.

What I'd like to do is: Keep my privacy protecting addons, but somehow (maybe through Firefox internal settings in the about:config dialog or some hack to Firefox or indeed to the operating system, Debian 8 in my case) prevent all Firefox addons from sending data from my computer to the internet. Obviously, this should not be achieved with yet another addon, then we've come round in a circle. (As a downside I realize that this will also break auto update of these addons, and maybe even their normal functionality. But in the latter case this would be a reason for me not to trust them any more.) In fact, I'm using Iceweasle on Debian 8, but this is synonym with Firefox, I think.

(An alternative would be to review the source code of the addons myself line by line and then - after convincing myself that they do nothing more than I expect them to do - compile them myself. But since I am not an expert in this field (I don't even know how to compile a browser addon) and since some addons try to obscure their activities deep inside the code, see for example:

http://www.howtogeek.com/180175/warning-your-browser-extensions-are-spying-on-you/

the blocking of outgoing traffic initiated by addons is probably more practical in my case.)

  • well the only really safe way (as for every software) is to just install trusted addons (you really need) from trusted sources, and not collecting/installing every software "you come across"... :-/ – DJCrashdummy Nov 11 '16 at 10:28
2

I doubt that this is possible or at least such restrictions could easily be bypassed by add-ons. Many useful add-ons like ad-blockers need to make changes to the site you visit. By doing this they could also inject new code into the original site. This code is then executed in the context of the visited site and not of the add-on and thus any restrictions setup for the add-on itself will not apply, like the restrictions to phone home.

Apart from that in the specific example of the WOT extension (web of trust) you cite the user explicitly installed an extension which sends each URL to some server to get the reputation back. Blocking this communication would effectively cause the extension to stop working since it cannot get a reputation any more. This means simply blocking communication is not an effective way of stopping such privacy problems in all cases.

  • Yes rouge add-ons can use all sorts of tricks. But what I'd want in this line is to force them to use dirtier tricks to get my data, to sort the evil from the naughty. – user123931 Nov 3 '16 at 16:37
  • @notstoreboughtdirt: so you want to protect against extensions which inadvertently send data (which probably do not cause much harm) but not against extensions which knowingly send probably sensitive data and take care to make this as non-obvious as possible? I doubt that such a weak protection is of much use and will probably cause more harm with extensions which need to communicate, like for updating ad-blocking rules etc. – Steffen Ullrich Nov 3 '16 at 16:58
  • 1
    @notstoreboughtdirt: Chrome uses Content Security Policy for their add-ons which kind of does what you want, i.e. limit network access from the add-on itself. But is not designed to protect against malicious add-ons but against bugs in add-ons only, i.e. protect against XSS and similar. Like I said in the previous comment: it helps against mostly harmless inadvertent communication but does not protect against the harmful communication which is explicitly designed to bypass restrictions. – Steffen Ullrich Nov 3 '16 at 17:05
  • I presume there is intentional communication that would get stopped by network access limits and that is what I assumed the question was asking about. These I'd call naughty; they spy, but stop if I know to ask them not to. To list the other kind I would have to reliably detect them being sneaky which may already be in the todo list of Chome. – user123931 Nov 3 '16 at 17:57
  • @notstoreboughtdirt: The question asks how to "prevent all Firefox addons from sending data from my computer to the internet.". For me the intention is clearly to stop leakage of privacy related data caused by an extension. The OP does not know the ways such information can leak so for the OP it does not matter if the extension is doing this a way experts would consider obvious or a more sneaky way. And I also think that this distinction does not matter and that it is only relevant if data get leaked or not and not how the leaking is done exactly. – Steffen Ullrich Nov 3 '16 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.