64

Recently, the company I work for has forbidden usage of any extensions in Chrome. They also do not allow account sync. This affected virtually all Web developers since they use Chrome to test their front-end code and use an extension or two to improve productivity (JSON view, Redux dev tools).

Unfortunately, this has changed overnight without proper communication and there is no clear reason for this change.

However, I have noticed that I am able to use a portable version of Firefox and install all needed extensions.

Currently I am using Chrome 62.0 and Firefox 56.0.2 (portable). I use the portable version because the company officially allows FrontMotion and I do not want to mess with its installation.

This rather old post does not show any serious security problems for Google Chrome (except for privacy).

Question: Are there any objective reasons to forbid Google Chrome's extensions, but allow Firefox extensions?

  • 67
    Are Firefox extensions explicitly allowed? My guess is that nobody thought about blocking them yet, or that it is hard to block peope from doing a portable install if they have admin rights. – Anders Nov 27 '17 at 10:19
  • 3
    A possible reason, or side-effect: Firefox is much slower, as Chrome. So if you write code which performs enough well on FF, it will be surely rocket-wonderful on Chrome. – peterh says reinstate Monica Nov 27 '17 at 12:52
  • 3
    Are they blocking Chrome and allowing Firefox? Or have they simply not figured out how to block portable Firefox and extensions for it? (Or, more probably, do they not know PortableApps exist?) Those are very different scenarios... – WernerCD Nov 27 '17 at 13:28
  • 17
    Tangentially, it is important to note that useful browser extensions with high reputation can be (and have been) hijacked to malicious ends. – Michael Nov 27 '17 at 16:05
  • 23
    @peterh are you sure about that? The latest Firefox outperforms the latest Chrome on most sites. – Stop Harming Monica Nov 28 '17 at 14:49
50

I cannot answer the asked question, but I hope this could shed some light on your problem.

  • Should corporate security rules forbid usage of some browser extension?

    IMHO the answer is YES here. Browser extensions can virtually do almost anything on behalf of the regular browser. That means that a local firewall will not detect them.

  • Are there objective reasons to trust more XXX (put whatever browser of browser extension here) than YYY (another browser or browser extension).

    Well in IT security trust is based on 2 major pieces: audit of code and reputation. The former is objective, while the latter is not, but I must admit that I mainly use the latter because I have neither enough time nor enough knowledge to review everything, so I just rely on external advice from sources that I trust. When I rely on HTTPS to secure a channel, I must trust the certificate owner to not do bad things with the data once it has received it, and I trust the certificate signer. Long story short, it may be possible to say whether an extension has better reputation than another one, but it can only be by extension and not globally by browser.

  • Is usage of a portable Firefox in your use case an acceptable solution?

    Still my opinion, but unless you are in hierarchical place that allows you to ignore a rule from the security team, I want to say a big NO here. My advice is that you should first make a list of the extensions you commonly used, and possible replacement ones. Then you should try to gather as many elements on their objective security and on their reputation (still on a security point of view). Then you should tell your manager that the recent forbidding of Chrome extension leads to a net decrease in productivity, and ask him to propose the security team a list of extensions you need with possible replacements (Firefox for Chrome by example). Then either they agree with an acceptable list, or the question should climb higher in the organization hierarchy, until someone that is accountable for both the global security and the global productivity takes a decision. Silently ignoring corporate rules is always a bad decision because the guy that has global authority has no way to know that some rules are not followed.

And if your boss chooses that security is more important than productivity or the opposite, he has authority for that choice while you may not have.

  • Thank you for the exhaustive answer. Firefox usage is not regulated (at least not explicitly) and I use it only to double check my developments. Also I have a very small of extensions that I use and they are all very popular, so I can theoretically indicate them and ask to be white-listed. – Alexei Nov 27 '17 at 10:03
  • 9
    As a side note, a security policy that forbids all extensions (not just user-installed ones) and doesn't forcibly install UBO on all workstations is hopelessly broken. – R.. Nov 28 '17 at 3:00
  • 7
    @Alexei Very popular does not mean secure. It's often the other way: Very popular extension dev gets an offer from malware makers offering to buy the extension from them for a large sum of money. The best you can do is only use open source extension from devs you know you can trust to not sell out. – Qwertie Nov 28 '17 at 5:16
  • See Ilmari Karonen's answer. There is a big difference in how code is audited for the extensions in each browser. – Stop Harming Monica Nov 28 '17 at 14:52
  • 2
    uBlock Origin. It's a general-purpose ad/content blocker with many powerful features. – SilverWolf - Reinstate Monica Nov 29 '17 at 14:37
41

I suspect that Anders is right, and whoever set up the Chrome extension ban just didn't think about Firefox. If they realized that you were using Firefox to get around the ban, they'd probably forbid that too (or try to, anyway).

FWIW, yes, browser extensions can be problematic from a security viewpoint, and I can see reasons for banning or heavily restricting them in some situations. That said, being able to install your own software, including a different browser, is just as problematic for the same reasons, or more so, so allowing that while banning extensions does seem inconsistent.

In any case, the real problem here seems to be the lack of communication. If the extension ban was based on an existing official policy, all employees should have been made aware of the policy; if not, such a policy should have been created and properly announced.


All that said, as the author of a Chrome / Firefox extension (SOUP), let me note that there is, or at least used to be, a real difference in the security review process between Chrome Web Store and Firefox Add-ons. Basically, the difference is that Firefox Add-ons used to have a mandatory manual security review process that all extensions had to pass before being approved, whereas Chrome Web Store only flags extensions for manual review if they fail an automated heuristic check.

Basically, my personal experience with submitting my extension to Firefox Add-ons and Chrome Web Store was more or less as follows:

  • Firefox Add-ons: I signed up for a developer account and submitted the extension. Two weeks later I received an e-mail saying that my extension (which, admittedly, had already grown quite large at that point) had been fully reviewed and approved. The reviewer had clearly gone over the code with a detailed eye, since they had spotted a nontrivial HTML sanitization bug (among just under 2,000 lines of pretty dense JavaScript) that could have led to an XSS vulnerability if, as they also noted in their review, the input hadn't come from a trusted source. Subsequent updates of the extension have generally been approved within a few days at most.

  • Chrome Web Store: To be able to submit an extension, I had to pay a $5 registration fee. This actually ended up taking me a while, since my bank was apparently flagging the charge as potentially fraudulent and refusing to let it through. Eventually I managed to sort it out by calling my bank and having them manually allow the charge. After completing the registration process, I submitted the extension and it was (IIRC) almost immediately published, apparently having passed the automated checks.

Of course, without knowing exactly what Google's automated checks are checking for, I cannot tell for sure how good they are at catching bugs and malware. But I do know that they failed to spot the almost-XSS bug in my own extension that Mozilla's reviewer caught.

More generally, my impression is that Google is more focused on trying to make extension authors traceable and accountable (via the registration fee, which at least means they know my credit card details; although I'm sure a malicious actor could find ways around that) and on detecting deliberate malware. And they don't always seem to catch it, either. The former Firefox Add-ons review process, on the other hand, not only kept out malware but also actually tried to spot potential security holes even in well-intentioned extensions. And by manually reviewing updates to existing extensions, the Firefox Add-ons system would also thwart developer account hijacking attacks like those that have compromised several legitimate Chrome extensions recently.


Unfortunately, as Makyen pointed out in the comments below, this difference no longer exists: as of a few months ago, Firefox Add-ons has moved to a semi-automated extension review process, just like the one Chrome Web Store is using.

In the linked blog post, the change has been motivated by "the new WebExtensions API [being] less likely to cause security or stability problems for users." Unfortunately, that reasoning does not really convince me: WebExtensions — even pure content script extensions like SOUP — can do plenty of damage in the hands of a malicious actor.

Just the content script API basically gives an extension free access to every web page you visit and every password or credit card number that you type in. Sure, when you install the extension, you'll be told about the sites it may run content scripts on — but so many extensions (including ad blockers, privacy extensions, etc.) already require the ability to inject scripts on every site that few users will pay any attention to that warning, even if they understand what it means.

Just a week after the announcement linked above, two extensions with embedded bitcoin miners were already spotted on Firefox Add-ons. So it seems that, when it comes to extensions, the former security advantage of Firefox over Chrome is now just nostalgia. :(

  • 4
    I agree that there used to be a significant difference. Unfortunately, Mozilla's policies for add-on review have changed. The review for listing on AMO is now fully automatic/programmatic, not manual (for WebExtensions based add-ons). Mozilla has stated that some subset of add-ons will be manually reviewed after being listed. They have stated that they are unwilling to expose to users the current state of any add-on having been, or not been, manually reviewed. – Makyen Nov 28 '17 at 19:07
  • 1
    Are WebExtension add-ons safer than the legacy ones? – Ooker Nov 29 '17 at 1:01
  • 1
    Reading this made me so happy that Mozilla actually put so much effort into reviewing extensions. For the first time in years, the thought of donating to them popped up in the back of my mind... then I got to the end of your post and saw that they did away with such a detailed review... For shame, Mozilla. – forest Dec 26 '17 at 12:34
9

Yes.

There can be a legitimate reason:

  • Chrome extensions are always automatically updated.
  • Firefox extensions are not required to be auto-updated.

This means that if the account of the developer of any Chrome extension with "read your information on all websites" permission gets compromised, the thief can push out malicious code around the world very quickly1—and all sorts of accounts, from emails to bank accounts, would be at risk. Allowing the user to update at a slower and less-predictable pace makes it (1) more likely that by the time the update is done, the malicious code will have been spotted and removed, and also (2) that the attack itself would be less likely to be attempted due to the caveat in (1).

Now, I have no idea if this is your company's reason. In my experience, people (and even Google) seem to forget about this threat and/or brush this threat of developer compromise under the rug (and in my opinion, dangerously incorrectly so). However, it is a legitimate concern, and I believe it is only a matter of time before dangerous malware spreads globally via forced auto-update.

1Don't be too naive in how you think about this. If you're thinking "but they run automated tests" or "but they stagger the updates" or [whatever], realize that malicious code need not show signs of malicious activity immediately, especially not network activity. It can simply lie dormant while the update is being pushed out, then set to activate sometime later, and after the simultaneous global activation, it can send credentials from a ton of users and websites back to its mother ship before it is caught and disabled.

  • 1
    More importantly, every Firefox extension update is manually reviewed before being published. – Stop Harming Monica Nov 28 '17 at 14:51
  • This is an interesting answer. However, there seem to be ways to disable update of extensions. – Alexei Nov 28 '17 at 19:05
  • @Alexei: The point is not just disabling updates entirely, the point is being able to choose when to update each extension. If you go through the trouble of cloning the extension and disable updating in the manifest of your local clone (mind you, this is too painful to be practical for those not already familiar with Chrome extensions, or for anyone who doesn't feel like doing it over and over again for each of their 20 extensions), then you'll have to reinstall the extension to update it, which is hardly something users will want to go through (especially not if it erases their settings). – Mehrdad Nov 28 '17 at 19:12
  • 2
    @OrangeDog Mozilla changed their add-on review procedure in September. Firefox add-ons are now listed after only an automatic/programmatic review (for WebExtensions based add-ons; i.e. compatible with FF57+). A manual review will be performed on only a subset of of all new add-on versions, but only after the add-on has been listed on AMO. – Makyen Nov 28 '17 at 19:16
8

Perhaps in your company there were users who had malware or stolen data troubles because of Google Chrome extensions.

Happened to me so I won't discount it.

I don't know about Firefox extensions, but I have found malware in a Chrome extension which was manipulating my browser output. I investigated it on my own and reported it to Google but nothing happened. On the surface it was a very useful plugin that allowed me to have a separate session in each tab for the same domain.

So in my personal experience, Google is bad at monitoring / moderating apps / extensions. Every single plugin you have in your Chrome is capable of many dangerous things.

  • Just to let you know, Firefox has had a built-in feature (enabled via the Multi-Account Containers add-on which adds a GUI to it) to do that. – wizzwizz4 Nov 28 '17 at 17:59
  • Firefox was really hogging my memory the last time I used it ~3 years back. Is that still the case? Chrome has managed to find a pretty decent niche in my workflow so I'm be very reluctant to move from it. – a20 Nov 29 '17 at 5:00
  • You've caught it at a great time; they've recently completely reprogrammed the majority of the code (including ~95% of the backend, the whole rendering engine etc.) to be faster and have a lower memory footprint. They've also rolled out features such as es10 to the main branch. Basically, there's now a process for the UI (one for each window?) and one for each tab, and very little code bloat. – wizzwizz4 Nov 29 '17 at 16:37
  • For most non-Google sites (which Chrome beats it at for obvious reasons) Firefox is faster. In fact, there is one Google site (I'm not certain which, but Gmail comes to mind) which Firefox is faster at. Plus, the multi-process thing means you can set the process priority of individual tabs, which is nice. – wizzwizz4 Nov 29 '17 at 16:39
1

It is possible it relates to the tooling available to the security team. A team may have access to tools to manage and vet or even just report on extensions for one of the browsers but not the other at this time.

I don't think that's likely to be your situation, but it is a legitimate reason for a policy that seems to discriminate against a particular browser for no other apparent reason. I know Chrome, in particular, does have an administration package available for Windows Domain administrators that allows admins to see and set a number of security options, but that doesn't mean the security team has been able to set up these tools. I suspect Firefox has something similar, but I'm not up on Mozilla's tooling for this at the moment.

1

Are there objective reasons to not allow Google Chrome extensions, but to allow Firefox extensions?

Objectively, Mozilla has a more sturdy process for deploying an add-on than chrome.

Objectively, Chrome extensions got breached recently (social engineering is platform independent, though).

Objectively, Chrome has a way higher usage share. Wanna target a popular OS? Target Windows. Wanna target a popular browser? Target chrome

You probably shouldn't keep using those add-ons without explicit permission but I do believe Chrome extensions are, in a way, less secure than Mozilla add-ons.

  • Social engineering is platform-independent, but it's less of an issue if Firefox accounts get breached as every single add-on (every add-on without exception now, though there was a time where there was a trusted list for updated versions of certain add-ons) goes through a mandatory fine-toothed-comb review process that catches innocent mistakes, not to mention blatant malware (obfuscated or no). – wizzwizz4 Nov 29 '17 at 16:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.