2

Lately, there was a lot of publicity given to such exotic security risks as Spectre and Meltdown, with immediate Pavlov reactions from Microsoft, Mozilla etc. However recently I came upon the (otherwise widely known) curious fact that nearly all browser third party extensions require permissions to access everything on the web pages you access including the data you insert in web forms yourself.

Citing Mozilla:

"There is one permission in particular, “Access your data for all websites”, that we’ve gotten many questions about since the feature launched. The reason why it’s worded this way is because a web page can contain virtually anything, and some extensions need to read everything on it in order to perform an action based on what the page contains. For example, an ad blocker needs to read all web page content to identify and remove ad code. A password manager needs to detect and write to username and password fields. A shopping extension might need to read details of the products you’re searching for. Since these types of extensions wouldn’t know whether any particular web page contains the bit it needs to modify until it’s loaded, and neither does Firefox, it needs access to everything on a page so it can look for and modify the appropriate parts. This means that in theory, while rare, a malicious developer could tell you their extension does one thing while it actually does something else."

But this includes scraping all your passwords, credit card numbers etc. ..

This appears to be not just "a security risk" but "THE security risk". It is insane: cryptography, as I understand, means now nothing and the user, assured by the green "Secure" label in the URL bar, happily inserts his credit card number just to have it sent immediately to some remote server which is not the one he had in mind..

My question is why so relatively little attention is given to what appears to be an enormous security risk? For example, I would expect that as soon as you have any third party browser extensions with the permission to view "all your data", the "Secure" green label for HTTPS sites would be replaced with something else.

And shouldn't third party browser extensions be banned in any organization which treats sensitive personal data?

  • Should javascript be banned as part of HTML? A compromised web server with injected script also able to steal user data. – mootmoot Sep 12 '18 at 10:15
  • @mootmoot I think that going to Google, amazon and my bank online sites I can be reasonably confident that no script injection took place (since it is the responsibility of Google, Amazon and the bank). However if I visit these sites and insert personal data, I cannot be sure that a third party plugin X will not communicate this data outside. – John Donn Sep 12 '18 at 13:17
  • IMHO, browser plugin/extension eco-system is similar to OS, so it will suffer similar fate. Whether like it or not, even people argue that something like MAC is "secure enough" or "windows defender" is good enough, this is something not cover by the OS, but anti-malware software. – mootmoot Sep 12 '18 at 14:50
  • 1
    Google Chrome Group Policy has the ability to block/whitelist extensions specifically for this. You do not want users installing arbitrary extensions. – myron-semack Sep 12 '18 at 22:39
2

Addons can do almost anything in the browser and could be a security risk.

Mozilla has both automated and manual checks in place for addons. Before a addon is placed on addons.mozilla.org the code is first checked by an automated tool and subsequently reviewed by a human.

Chrome only has automated checks, but if you want to publish your addon you need a credit card number. This means they can block you and your creditcard if you do something nasty.

Furthermore, on Chrome on Windows it is particularly hard to install an extension that is not in the webstore. Chrome tries hard to block any malware extensions from installing in the browser.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.