5

According to Browsec's website this application can be used to Bypass firewalls. So in countries like Iran it seems a useful tool to bypass censorship and filtering.

For start using this application there are two version available, A "Chrome extension" and a "Portable Firefox" version.

My question is that is it safe to use Chrome extension of this software? can it cause security problem when i log in to Gmail and other password protected websites when i use this extension?

For example can this application secretly steal my passwords?

  • What do you define as «safe»? what do you call «security problem»? – K-Yo Jul 28 '14 at 14:33
  • Your question really seems to be about the security of browser plug-ins. If this is true, can you suggest an edit to the title? – schroeder Jul 28 '14 at 15:03
  • @K-Yo I now that there is ambiguity about what is called "safety" and "security problem", but i meant overall meaning of them. For example by Application analysis and Reverse engineering this app, is there any known problem that can cause security issue or not. – Mohammad ali baghershemirani Jul 28 '14 at 15:31
  • @schroeder I think my question has two aspect. first,security of plugin itself. And second, security of using this system in overall, for example maybe this application is not safe at all and in server side stores my information. In this case if i use the "Portable Firefox version" of this application instead of "Chrome extension" the problem still exist. So i think it's about Browsec itself not browser plug-ins. – Mohammad ali baghershemirani Jul 28 '14 at 15:37
  • To review this specific browser extension, we would need to do a code review. We can't do that for you. We can, instead, talk about the risks in general for browser extensions. – schroeder Jul 28 '14 at 15:42
6

You are mentionning two Privacy issues here: Circumvention of censorship & password protection.

When it comes to government firewalls, it is wise to use widely spread softwares, as they have been tested a lot and are known to work as safely as you can find. The reference here is Tor and is used daily by insurgents in countries famous for their restricted internet access like Syria or China.

For your password privacy, this is not a topic I am very knowledgeable in, but I would advise you to not use any extension on your browser when typing a password. I would not even trust the browser itself. If whatever you are doing is highly sensitive, I would suggest using Tails that comes bundled with… Tor!

For your specific application (Browsec), there are several signs that you shouldn't trust it:

  • it is closed source (debatable, but you don't know what happens behind)
  • has very little review online (drawbacks of not being famous)
  • says they collect your data and may transmit it to a government
  • state that the traffic goes through their network, hence any access to an unencrypted website, they can read it all. possibly SSL protected ones aswell depending on implementation.
  • The reason i preferred not to use Tor is that using it causes more attentions. For example this article.So i was looking for a alternative for Tor. What i'm doing is not sensitive, but i rather not tracked by everyone and have as more privacy as i could have. Because my only reason for using Tor was bypassing filtering, my question was about is it safe to use Browsec as an alternative and still having privacy or not. – Mohammad ali baghershemirani Jul 28 '14 at 15:18
  • 1
    If some agencies are targetting people being "TOR curious" as the article you linked states, they most probably do for all similar reliable services (and probably unreliable ones aswell). You will not be tracked by everyone, maybe some government agencies, but you could already be just by posting here for all we know. – K-Yo Jul 28 '14 at 15:28
3

The main risk of using a proxy solution such as Browsec or any of the TOR clients is that they push your trust from your local network neighborhood (your employer, your ISP, your government) to an unknown remote network neighborhood (Russia? Finland? Black hats? GCHQ?). The exit node effectively controls how your browser (or other client) sees the network, so a variety of code insertion attacks and monitoring become feasible. For example, the malicious exit node can substitute one page for another, a script for another, or a download for another.

This is called the untrusted network threat model. In order to mitigate such a risk, ALL traffic sent over the untrusted network needs to be authenticated and encrypted.

protected by Community Aug 23 '14 at 8:45

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.