8

I find myself more and more in need of using Chrome extensions, but the appallingly broad and intrusive permission requirements prevent me from installing any of them.

Pretty much every extension I see requires a "Read and change all information on all websites you visit" and other unreasonable requests.

  1. Is there a way to install an extension without actually granting everything it wants?
  2. Is there a database of trusted extensions that underwent rigorous auditing? Other ways to identify them?
  3. Any specific protocol I should follow when choosing and installing an extension to ensure security?
  4. Are there extensions that are endorsed by Google and have their seal of approval? How to identify them?
Improve this question

2 Answers 2

Reset to default
3

Is there a way to install an extension without actually granting everything it wants?

Only for optional permissions, but "Read and change all information on all websites you visit" is usually required.

Is there a database of trusted extensions that underwent rigorous auditing? Other ways to identify them?

No, at least none that are advertised by Google.

Any specific protocol I should follow when choosing and installing an extension to ensure security?

"Read and change all information on all websites you visit" is actually common. If it requires other permissions, such as "Capture content of your screen", then you should be more worried. There are some more here: https://developer.chrome.com/apps/permission_warnings

Make sure that the permissions make sense for the extension. Reading all website data probably doesn't make sense for a new tab page. Reading the code is always best.

Are there extensions that are endorsed by Google and have their seal of approval? How to identify them?

Some extensions are published by Google. Those are the only ones they endorse.

Improve this answer
3
  • To elaborate, "read and change all information on all websites" isn't necessarily "unreasonable" as the OP puts it. A great deal of extensions have to modify the site in some way. Eg, an adblocker needs to scan the site for ads and remove it. A deal finder needs to scan the site for price info. A textarea cache needs to scan the site for all <textarea>s and constantly save what you type into them. A password manager needs to scan the site for password prompts and allow you to auto-fill them. A "show images on hover" extension needs to scan for links on a page and add the hover effect...
    – Kat
    Aug 15, 2018 at 16:45
  • 1
    I could go on, but the point is that a lot of extensions need to access data on all sites for a good reason (or at least don't have a good way to limit what sites they apply to). The extensions that don't need to edit the page in some way are frankly ones that aren't even necessary to be part of the browser. They're more like... standalone programs that just so happen to be attached to the browser. It's unfortunate for security, but up to you to decide if the extensions are trustworthy and give a suitable tradeoff.
    – Kat
    Aug 15, 2018 at 16:49
  • @Kat Exactly. The permissions should make sense for the extension. Adblockers should require "Read and change all information on all websites you visit".
    – Anonymous
    Aug 15, 2018 at 22:08
-1

You can always check extensions for github/gitlab links. At least those extensions have some transparency.

Improve this answer
3
  • 4
    This really does not answer the question, and just because source code is posted does not mean that the compiled code that you installed is from the same source.
    – schroeder ♦
    Aug 13, 2018 at 22:36
  • 1
    @schroeder Chrome extensions are not compiled. They're literally zip files of JS code and some metadata. Thus, you wouldn't even need a Github link to audit the extension's code. They might minify/obfusicate the code to make an audit harder, but there's almost no legit reason to do that with an open source extension. So it absolutely should be easy to figure out if the extension is the same as that on a Github (which again isn't really needed). That said, it's pretty easy to hide malicious code in a large extension. Who has time to audit every single extension they use?
    – Kat
    Aug 15, 2018 at 16:54
  • @kat regardless, I have never had a chance to manually interact with the code of an extension, so whether complied or not, the code on a repo is disconnected from the code that's installed from the chrome store
    – schroeder ♦
    Aug 15, 2018 at 17:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .