40

I realized that my bank handles sensitive information in the web console log, so my concern is if any browser extension could read the log?

  • 42
    If you have browser extensions that you don't trust, you have way bigger problems than whether they can read the log. – Joseph Sible-Reinstate Monica Dec 31 '19 at 20:32
  • 3
    What do you mean by "handles sensitive information"? – RockPaperLz- Mask it or Casket Jan 1 at 20:30
  • 1
    Some information like login info, accounts number, etc. – Nyan D' Sparkle Jan 2 at 4:00
  • 6
    "my bank handles sensitive information in the web console log" -- Wow. Changing banks may be easier than getting them to change their code. – bishop Jan 2 at 18:11
  • 3
    You should probably be more worried about the code from several other websites that your bank loads to act as intermediaries between you and the bank's forms, as such code can alter and/or duplicate to a third party any information passing between you and your bank. And there's little you can do about it because banks are too stupid to realize that a secure communication should not be a "game of telephone". – Eric Towers Jan 3 at 0:23
62

Any extension that has access to the DOM can read whatever is written to the console by intercepting calls. The console is a JavaScript object; it is simple to proxy calls to console.log, like this example from zzzzBov on Stack Overflow:

(function () {
  var log = console.log;
  console.log = function () {
    log.call(this, 'My Console!!!');
    log.apply(this, Array.prototype.slice.call(arguments));
  };
}());

However I should note that intercepting console.log is not necessarily what you should be worried about. If an attacker is able to run their own code within your browser, they can do a lot of bad stuff whether or not the bank uses console.log. For more on that, see this question: Worst case scenario what can a Chrome extension do with "Your data on all websites"

But that said, if they've left console.log statements in their production site, that's a code smell.

| improve this answer | |
  • I would recommend a separate browser profile for banking to keep different trust domains separate. – Tanath Jan 9 at 11:05
  • This example doesn't work alone. Web extension hasn't the same "context" (window) as the page. You need to inject this code into the page and communicate back with the web extension using postMessage. More details here. – Jack NUMBER Oct 9 at 18:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.