Questions tagged [browser-extensions]
Browser extensions are additions to a web browser that provide extra functionality.
175 questions
173
votes
9
answers
246k
views
Is Adblock (Plus) a security risk?
My email-provider's website (http://www.gmx.de) recently started linking to the (German) site http://www.browsersicherheit.info/ which basically claims that due to its capabilities to modify a site's ...
- 7,988
84
votes
2
answers
28k
views
Worst case scenario, what can a Chrome extension do with "Your data on all websites" and "Your tabs and browsing activity"?
Chrome extensions, and just like other browsers, appear to often get quite some extensive access to your browser data. In fact, most extensions I've installed require access to:
Your data on all ...
- 1,285
70
votes
8
answers
18k
views
Why use HTTPS Everywhere when we have HSTS supported browsers?
I know that the browser's default protocol to access any site is http:// when https:// is explicitly not mentioned, but even then if we browse to a website say www.facebook.com, the response header ...
- 882
64
votes
6
answers
13k
views
Are there objective reasons to not allow Google Chrome extensions, but to allow Firefox extensions?
Recently, the company I work for has forbidden usage of any extensions in Chrome. They also do not allow account sync. This affected virtually all Web developers since they use Chrome to test their ...
- 2,193
38
votes
1
answer
7k
views
Can a browser extension (Chrome, Firefox, etc.) read the web console log?
I realized that my bank handles sensitive information in the web console log, so my concern is if any browser extension could read the log?
- 499
32
votes
3
answers
5k
views
Are official browser add-ons really safe?
Almost any browser addon/extension that I install on my Chrome or Firefox (be it Firebug, RESTClient, ...) warns me, saying:
It [the add-on] can:
Access your data on all website
Access ...
- 841
32
votes
5
answers
7k
views
How do I know if a Google Chrome extension is leaking data?
Many Google Chrome extensions require permissions to read the contents of webpages the user visits. How can the user verify whether and to what extent a certain Chrome extension leaks data?
- 1,680
29
votes
3
answers
20k
views
Is Firefox Password Manager less secure than LastPass?
After installing the LastPass password manager, I am presented with a login dialog including the option to "Disable Insecure Firefox Password Manager".
(This option appears as long as the Firefox ...
- 3,610
24
votes
2
answers
4k
views
Why do Chrome extensions need access to 'all my data' and 'browsing activity'?
Often I install simple add-ons for Google Chrome. However, they almost all need what appears to me as excessive access to my data. For instance, I install an extension that allows me to click on any ...
user5672
23
votes
2
answers
19k
views
Is Stylish safe to use again?
Stylish is/was a very popular extension for the Chrome and Firefox web browsers, which let users add custom styles to certain websites. I was using it myself, until a helpful fellow told me it was ...
- 2,285
21
votes
2
answers
4k
views
Could a Google Chrome extension read my password?
I am concerned about the security of my passwords while using Google Chrome extensions. Specifically, I'd like to know if it's possible for a Chrome extension to read passwords that I enter on ...
- 321
19
votes
1
answer
11k
views
Is Vimium (Chrome extension) really safe?
I really like the Chrome extension Vimium. It significantly speeds up surfing for power users. However, when you install it, Chrome warns you because this extension injects JS code on every page you ...
- 293
18
votes
5
answers
11k
views
Is using "HTTPS everywhere" extension secure?
I would like to know if one should use 'HTTPS everywhere' extension? Is it secure to use it? Are there any better alternatives?
HTTPS Everywhere is a Firefox and Chrome extension that encrypts ...
- 283
17
votes
6
answers
4k
views
Is privacy compromised when sharing SHA-1 hashed URLs?
I'm working on a small side project which involves a browser add-on and a backend service. The service is pretty simple. Give it a URL and it will check if the URL exists in a database. If the URL is ...
- 273
17
votes
6
answers
129k
views
How to prevent installation of Google Chrome extensions
How can I prevent the installation of Chrome extensions on desktop?
- 319
14
votes
1
answer
3k
views
Firefox password manager and Firefox Sync
I have just migrated from LastPass to default Firefox Password Manager and Firefox Sync.
I have some doubts about using Firefox Password Manager and Firefox Sync.
Let's assume I don't use a master ...
- 467
13
votes
3
answers
4k
views
What bad coding practices makes a browser extension vulnerable?
I'm trying to scan JavaScript files for vulnerabilities using JSHint. Specifically, I'm scanning the JavaScript files of browser extensions. To look for possible vulnerabilities I'm looking for bad ...
- 4,372
13
votes
2
answers
2k
views
Can a Firefox add-on or plug-in access the user's websites' saved passwords in decrypted mode?
Going deeper into the previous question on Firefox plugins and add-ons malware risks: Could a Firefox add-on potentially decode and capture the encrypted websites' passwords saved in the browser?
- 139
12
votes
2
answers
1k
views
What should I look for when auditing a Firefox extension / plugin?
I've been asked to do a security audit on a Firefox add-on developed by a third party. I am a web developer with a reasonable grasp of JavaScript but am not a browser security expert.
What kinds of ...
- 222
12
votes
3
answers
5k
views
Any tool for scanning vulnerabilities in browser extensions? [closed]
I am scanning browser extensions of Chrome and Firefox for vulnerabilities. Is there any tool which would help me do this?
- 4,372
11
votes
1
answer
4k
views
Chrome/ Opera: How to trace and single out this Malware in Browser Extensions? caused by Tab Manager
There have been lot of articles about legitimate chrome/ opera extensions that get sold out to malicious parties that end up pushing the wrong kind of code down the pipe, since by default these ...
- 381
11
votes
1
answer
1k
views
Danger of browser extension without any permissions?
Assuming that an extension for Firefox or Chrome does not request any WebExtensions permission, what harm could this extension do?
Or put another way: What (potentially malicious) actions can an ...
- 29.8k
11
votes
1
answer
3k
views
Is NoScript bad? [closed]
I just came to know about NoScript, but after installing it opened the author's homepage with an advert for 'SpeedUpMyPC' that pointed to a UniBlue website, which I found fishy. Googling turned up ...
- 612
10
votes
2
answers
5k
views
How to improve the security and privacy of Firefox
What would be a sensible approach to enhance the security and privacy of Firefox?
I did not find a question about this and I feel that some guidelines for casual web users would be handy.
Currently ...
- 709
10
votes
1
answer
2k
views
How do I check the code of a Chrome extension to make sure it's not stealing my info?
I've been reading more and more about just how much access browser extensions can have to your data. This is a little unsettling, so I'm curious if there is a way to Vet these extensions and make sure ...
- 1,771
9
votes
3
answers
3k
views
How to view extension privileges in Firefox?
In Google Chrome, I can go to chrome://extensions/ and click "permissions" to view the permissions that an installed extension has been granted. I cannot find an equivalent in Firefox. Is there such ...
- 6,923
9
votes
1
answer
4k
views
Signing a browser extension
I want to make a browser extension available to users. Can I sign my extension so that users can verify it is authentic, without needing to trust the web site where they got the extension from nor ...
- 100k
9
votes
3
answers
5k
views
How to add certificate pinning for a certain domain to my web browser?
There is HPKP (HTTP Public Key Pinning) which servers use to tell the client's web browser which certificates to trust (in the future) for the domain that is being contacted.
Google's Chrome and ...
- 93
8
votes
3
answers
2k
views
Browser setups to stay safe from malware and unwanted stuff
I have to set up a browser to surf the internet. I'm trying to stay safe from malware as much as possible. (I already know that there's no way to stay 100% safe.)
My idea is to use Firefox with these ...
- 83
8
votes
2
answers
746
views
What impact does an installed extension have on the browser fingerprint (uniqueness)?
Motivation
I want to develop a custom, local Firefox extension and investigate, if its installation has any impact on the browser fingerprint.
Background
Some time (years?) ago, there were articles ...
- 183
8
votes
4
answers
1k
views
What are the effects of the Chrome Web Developer extension hijack?
Today, the owner of the rather popular Web Developer toolbar noticed it had been hijacked and replaced with a malicious version. He disabled it, but the malicious version (diff) had been in the wild ...
- 2,993
8
votes
2
answers
5k
views
Is Google Chrome Extension access to SSL certificate validation output possible?
I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My ...
- 1,507
8
votes
2
answers
3k
views
Browser based virtual machines
How would applying hypervisor (e.g. xen) principles in the development of a web browser offering isolated browser tabs (virtual machines) improve or reduce security of existing web applications (good ...
- 187
8
votes
2
answers
394
views
How to choose Chrome extensions with security in mind
I find myself more and more in need of using Chrome extensions, but the appallingly broad and intrusive permission requirements prevent me from installing any of them.
Pretty much every extension I ...
- 83
7
votes
1
answer
2k
views
Can Chrome Extensions Send Data to Remote Servers?
Suppose an extension has a scary list of permissions like that below ("Site access: On all sites"):
Does this also give the extension permission to send my data to the author's servers via ...
- 123
6
votes
1
answer
466
views
Prevent Chrome extensions from betraying me
As has been discussed in this answer, a flaw with the Chrome Web Store is that an honest-but-naive developer may sell a popular browser extension to someone like Techno SoLotions, assuming that Techno ...
- 2,120
6
votes
1
answer
192
views
How to check browser extension behaviour?
I would like to be know which ways are available to check the behaviour of a firefox extension.
While wikipedia states that any browser extension can have access to everything done by the browser, I ...
- 660
5
votes
2
answers
37k
views
Browsec - VPN and anonymizer
According to Browsec's website this application can be used to Bypass firewalls. So in countries like Iran it seems a useful tool to bypass censorship and filtering.
For start using this application ...
5
votes
2
answers
738
views
LastPass vulnerability: Should LastPass users change all their passwords?
Reading about the recent vulnerability in LastPass extensions for FireFox and Chrome. The published exploit allows arbitrary code execution. The vulnerability also allowed access to stored passwords. ...
- 6,923
5
votes
1
answer
2k
views
Prevent all Firefox Addons from sending data
Firefox addons are known to send data (like the URLs visited, location, installed cookies etc.) to their maintainers and (from there) to third parties. See for instance the newest "scandal" about the ...
- 153
5
votes
1
answer
4k
views
Chrome extension: Cross origin request
Can chrome extensions make cross-origin requests by injecting a javascript into the main page? If so, isn't it a security vulnerability?
Google Chrome Content Scripts
Cross Origin Requests
- 193
5
votes
3
answers
2k
views
What are NoScript surrogates and should one disable them for more privacy in browsing?
NoScript has a feature of supplying its own "surrogate" scripts instead of well-known tracking/ad scripts (Google Analytics, for one).
Does it matter for my privacy if I do not change the factory ...
- 5,367
5
votes
0
answers
696
views
Can Chrome extensions access other Chrome extensions' data?
Can the data in a password-manager Chrome extension be accessed by a different Chrome extension? For example, if one were to install a malicious extension, could that extension access the data (i.e., ...
- 51
4
votes
3
answers
369
views
Addons in Chrome
When installing any add on in Chrome, a set of permissions is needed to be granted to the add on. Many addons(including popular ones like Pocket and Adblock) have Read and change all the data on the ...
- 613
4
votes
2
answers
382
views
Can a Firefox extension read preferences or data stored by other extensions?
Is it possible for a Firefox extension to read preferences or data stored by other Firefox extensions?
For example, could Firefox extension A, read any preferences or data stored by Firefox extension ...
- 3,174
4
votes
2
answers
2k
views
Ways to obfuscate web browsing habits [duplicate]
Web browsing metadata provides a lot of insight on person's habits. How can I reduce that insight? Is there something like "Detachment 2702" (http://en.wikipedia.org/wiki/Cryptonomicon) plugin for ...
anon
4
votes
2
answers
247
views
apple.com exploit attempt?
I recently browsed to apple.com; and the page crashed a few times, then after I reloaded I was given this alert after my browser attempted to redirect to res://ieframe.dll/acr_error.htm#apple.com,http:...
- 231
4
votes
1
answer
462
views
Which Browsers support TACK?
TACK is an IETF draft that allows certificate pinning for a TLS web server, provided the clients' browsers support it. Unlike the certificate pinning feature available with HSTS preloading, the server'...
user27909
4
votes
1
answer
2k
views
Is it possible for page to get your installed extensions through javascript?
When you visit a page, could that page tell what extensions you are running
if javascript is enabled?
If so then could we stop them or at least make it extremely difficult to increase our privacy?
4
votes
1
answer
637
views
Use of JavaScript by LastPass to encrypt & decrypt the password database a secure approach?
LastPass is a top-rated password manager that comes as a browser extension and uses a master password to encrypt and decrypt the password database using the JavaScript. Is this a secure way of doing? ...
- 1,452