Preamble: I live in Russia where some web sites (linkedin e. g.) are blocked by government (Roskomnadzor). So I and many citizens use popular free browser-extensions (and mobile apps from same brands) like Hola or FriGate.
As far as I can understand browser plugins use webRequest API (from WebExtensions API) and mobile apps simply install VPN profile to the device.
I see two possible vulnerabilities:
- Reading the whole traffic (MITM)
- Reading DOM (only applies to browser extensions). The extension may read all forms' input and steal your credentials.
There is nothing I can do with DOM reading, but I believe that it is pretty safe to enter your password with this extensions on.
But I fear of MITM attack. Is Hola for example able to read the content of TLS-secured connections in both mobile and web edition? Does browser extension create a tunnel with some point-to-point L2 protocol or redirect http requests? Who is validating the certificates: browser or extension?