Many Google Chrome extensions require permissions to read the contents of webpages the user visits. How can the user verify whether and to what extent a certain Chrome extension leaks data?
12
-
2Aside from my answer, you basically treat a Chrome Extension like any other binary. Ask yourself who made it, how trustworthy they are, and if the risk outweighs the benefits.– user163495Commented Apr 2, 2020 at 14:52
-
1@MechMK1 I see, this is fair enough, and thanks for your answer! I guess I was hoping that Chrome implements some kind of extension containerization that requires an explicit permission for extensions that want to talk to the outside world...– genCommented Apr 2, 2020 at 14:57
-
5You may find this an interesting read: In terms of protecting your privacy, Google Chrome is somewhere between horrible and dreadful. quora.com/How-safe-is-Google-chrome-in-terms-of-privacy?share=1– user10216038Commented Apr 2, 2020 at 17:03
-
1@user10216038 All of this sounds really nice, but it's not really feasible to do - especially the "don't use Android" part.– user163495Commented Apr 3, 2020 at 6:21
-
3The answer on Quora quotes: "And finally, don't use any flavor of Android device (I know, not so easy, but there you have it)." - This is the same level of advice as "To avoid skiing accidents, don't ski. It's the only way to be sure", which is technically correct, but not useful at all.– user163495Commented Apr 3, 2020 at 7:54
|
Show 7 more comments
5 Answers
According to developer.chrome.com:
[Chrome Extensions] are built on web technologies such as HTML, JavaScript, and CSS.
This means, anything that could affect the behavior of an extension will exist in a plain-text format (as opposed to a binary). Chrome allows you to debug extensions, giving you a comparatively easy way to see what an extension is doing, and whether or not some behavior of an extension is potentially malicious.
This requires the user to be somewhat fluent in the above-mentioned technologies. There are certain attacks, purely using CSS, which can be used to exfiltrate data. Without knowledge of CSS or understanding of these attacks, it would be hard to identify them among megabytes of auto-generated CSS code.
A non-technical user will likely not be able to carry out such an analysis. In this case, it helps to follow typical security advice:
- Only install extensions from credible sources (i.e. the Chrome Web Store)
- Popular extensions are more likely to get audited than unknown extension
- Only install extensions where the benefit greatly outweighs the risk
- Pay attention to the permissions required by the extensions and if it makes sense that those permissions are requested
-
5I think Web Extensions can now load WebAssembly, which is a binary. Commented Apr 15, 2020 at 15:31
-
> Only install extensions from credible sources (i.e. the Chrome Web Store) - but you cannot install extensions from non-store websites. Commented Apr 16, 2020 at 16:44
-
2@VitalyZdanevich You can install extensions in developer mode as package.– user163495Commented Apr 16, 2020 at 16:47
Tracing your browser traffic using a free proxy like fiddler can show some eye opening things. I could see an outbound request to an unfamiliar domain after every page I visited. Looking at the headers of the unfamiliar requests in Fiddler, i could see the URL of the page i visited! I disabled my chrome extensions one by one until I found the culprit. Turns out developer was monetizing - see git issue report. ... Further, he was injecting the code into the store manifest so it wasn't visible in git repo. This is a rather large "supply-chain" style attack vector where a 3rd party maintainer gives up rights to code or even gets breached and malicious code is introduced to existing packages/extensions.
-
1At least, if I read the GitHub issue correctly, it was now removed?– user163495Commented Apr 10, 2020 at 7:36
-
The developer mentioned starting his own ad network... I can only imagine.– felickzCommented Apr 11, 2020 at 4:42
-
1
I was developing extension for Chrome working with network of browser (not only current window). And I was surpriset how many data are transfered even when I don't do any actions.
There was communication of:
- inactive tabs
- closed tabs (through service worker)
- extensions
but it's hard to determine what is leaking of data and what is communication necessary for extension working. Because there's so much traffic.
-
2For this reason I'd recommend a browser that cares more about privacy, like Firefox.– LionCommented Apr 15, 2020 at 14:17
The team at Duo Security has a project out called https://crxcavator.io/. They are scanning everything in the Chrome Web Store on a regular basis and giving a "risk score" to all extensions based on both code analysis and things like having a privacy policy link in the store listing.
Can go a long way towards picking trusted extensions without having a know how to evaluate them yourself.
In Firefox store they have Recommended badge - it increases safety (and quality).
Also Editors Picks in Chrome Web Store:
-
2This does not answer the question at all.– user163495Commented Apr 17, 2020 at 14:27
-
@MechMK1 I think he tries to say, that more stars in the Chrome Web Store decreases the probability of data leak. Thus, there is the attempt to reply the question -> it should survive the VLQ review.– peterhCommented Apr 17, 2020 at 20:34
-
@peterh-ReinstateMonica The question is "How do I know if an extension is leaking data?". "Stores have extensions that they recommend" does not answer this question is the slightest. Using only "reputable" extensions is something that other answers address as well.– user163495Commented Apr 20, 2020 at 10:33
-
1