Questions tagged [browser-extensions]

Browser extensions are additions to a web browser that provide extra functionality.

Filter by
Sorted by
Tagged with
1
vote
0answers
270 views

Check if a Websocket connection origins from a Chrome extension [closed]

I am writing an application that communicates with a Chrome extension via websocket connection. I wonder if there is a way to detect whether the connection actually origins from the extension. The ...
1
vote
0answers
93 views

Can websites collect browser data without using http requests? [closed]

Is it possible for a website to collect data such as the plugins/fonts installed without sending it thought http requests? If so, is there any plugin for any browser that tells the user what type of ...
1
vote
1answer
188 views

How do I tell whether my browser extensions leak personal data?

According to the article Warning: Your Browser Extensions Are Spying On You: Browser add-ons for Chrome, Firefox, and probably other browsers are tracking every single page you visit and sending that ...
1
vote
1answer
1k views

Can my computer be compromised by uBlock/Adblock filter list?

uBlock is open source and suppose I trust the author. But filter lists are something that is maintained by other people. Is it possible to add something to a filter list to compromise computer/browser,...
8
votes
4answers
1k views

What are the effects of the Chrome Web Developer extension hijack?

Today, the owner of the rather popular Web Developer toolbar noticed it had been hijacked and replaced with a malicious version. He disabled it, but the malicious version (diff) had been in the wild ...
2
votes
1answer
72 views

How can I programatically keep track of number of certificate warnings in browser?

I want to keep a count of how many certificate warnings have been made in the browser over a period of several weeks. I also want to keep track of whether the user ignored these warnings and just ...
1
vote
1answer
107 views

Go.redirectro issue [closed]

I have a hijacker problem "Go.redirectro" And it gave ma a horrible headache​ I tried registry editor and take a file by file deep look at my drive and uh god it took me long time Look i am a ...
1
vote
2answers
426 views

Password manager: master password or not?

I use several browsers for several reasons (surfing, downloading files, logging into accounts...) but I prefer Chrome for doing "risky" things like browsing websites which I don't know whether they ...
1
vote
1answer
106 views

Should I use different browsers for surfing and logging into accounts?

I use web in different ways, i.e.: a) to log into my accounts (email, google, social, forums, etc.); b) for downloading softwares; c) for surfing trusted websites; d) for surfing websites which I don'...
2
votes
1answer
588 views

TunnelBear VPN Chrome extension doesn't encrypt DNS Queries

I'm using a VPN provider in occurance TunnelBear and decided today to run Wireshark in parallel and found out that DNS resolutions are happening un-encrypted using OS default name resolution, e.g. ...
0
votes
1answer
272 views

Help! What is this remote takeover / malware from a pop up, and what does it do? [duplicate]

I was recently on yts.pe a torrent distribution site. When I clicked on a torrent, there was a pop up, which Chrome totally didn't block, even though it is set to block all pop-ups. Here are the ...
-1
votes
3answers
131 views

How to protect your web application's data against an injected JavaScript?

I have a web application which interacts with two web servers. The response of the first one is stored temporarily on the browser (window.xyz=response.xyz) and when the user makes the request for ...
4
votes
1answer
263 views

Prevent Chrome extensions from betraying me

As has been discussed in this answer, a flaw with the Chrome Web Store is that an honest-but-naive developer may sell a popular browser extension to someone like Techno SoLotions, assuming that Techno ...
1
vote
2answers
814 views

Block Pop Up window using Javascript code

When a user enters his credentials in the login form of a web application, the credentials can be hacked through a malicious extension (that the user has installed). Now, suppose the malicious ...
3
votes
1answer
118 views

How secure is our privacy when using third party addons and extensions?

I use many addons and extensions in my browsers some of it is for ad blocking, taking screen shots and VPNs. This question came to my mind while using free VPN addons. I usually uses VPN addons for ...
68
votes
8answers
18k views

Why use HTTPS Everywhere when we have HSTS supported browsers?

I know that the browser's default protocol to access any site is http:// when https:// is explicitly not mentioned, but even then if we browse to a website say www.facebook.com, the response header ...
5
votes
2answers
591 views

LastPass vulnerability: Should LastPass users change all their passwords?

Reading about the recent vulnerability in LastPass extensions for FireFox and Chrome. The published exploit allows arbitrary code execution. The vulnerability also allowed access to stored passwords. ...
1
vote
4answers
104 views

To plugin or not to plugin?

Recently I did quite a research about internet browser related privacy. It hit me hard in the flesh myself, since I was part of the victims in the [WOT fiasco]1]. So I found out that usually way over ...
1
vote
1answer
1k views

Chrome users and malicious extensions

I have 2 users in Chrome. One is used for personal purposes has gmail box, google disk, etc. The second one is "business" user who has another configuration, it's own gmail, google disk, etc. Let's ...
2
votes
1answer
185 views

Plugins to increase security of Chrome? [closed]

What plugins are there for Chrome, that would increase security while browsing the web? For Firefox I have used NoScript, Flashblock, and AdBlock Plus, are there equivalents to these plugins for ...
1
vote
1answer
224 views

Browser custom protocol handlers

The possibility of running a shell command from an extension (NPAPI) has been phased out, but custom protocol handlers are still supported. What is the practical difference if an extension can still ...
2
votes
1answer
76 views

Malicious script compromising browser extensions

In Firefox or Chrome, is it possible for a web page script to compromise a user installed extension? This might involve access to extension private data or obtain the same execution privileges as ...
2
votes
2answers
1k views

Is Chromebleed still needed?

I've been running 'Chromebleed' for years now ... is it still needed? The latest advice I've found on various sites is now over 18 months old.
2
votes
4answers
77 views

Plugin / extension security practices

What kind of common security practices do software developers apply when allowing extensions or plugins to be added to their software, like e.g. Firefox, Photoshop and GIMP do? It can be either on ...
2
votes
4answers
333 views

Does blocking ads and deleting cookies improve privacy online?

I'm not sure if this is the right community for this kind of question, but here goes. When I browse the web, here is what I do: I always use uBlock I usually use Self-Destructing Cookies to delete ...
5
votes
1answer
4k views

Chrome extension: Cross origin request

Can chrome extensions make cross-origin requests by injecting a javascript into the main page? If so, isn't it a security vulnerability? Google Chrome Content Scripts Cross Origin Requests
2
votes
5answers
4k views

How to be safe from browser-based key loggers?

A browser-based keylogger usually comes in the form of a browser extension. It logs any or specific data entered anywhere in the browser. The problem is that they do not get caught by the system's ...
1
vote
1answer
77 views

How secure is the CDM design?

A followup to How secure will EME be? What I don't understand is how the CDM prevents key leakage. Is it not enough to "simply"[*] inspect the browser's memory and derive keys? In other words - ...
1
vote
1answer
152 views

What threat does the 1Password Browser authentication mitigate?

The latest 1Password browser update for Firefox includes an authorization between the plugin, and the browser itself. This is documented on the vendors website: https://support.1password.com/browser-...
1
vote
1answer
126 views

Know LastPass fishing apps? Ways to protect?

I am a LastPass user, which I use with the browser extensions. Lately it occurred to me that it should not be too hard to create a fishing browser extension that would replace LastPass upon install,...
17
votes
6answers
4k views

Is privacy compromised when sharing SHA-1 hashed URLs?

I'm working on a small side project which involves a browser add-on and a backend service. The service is pretty simple. Give it a URL and it will check if the URL exists in a database. If the URL is ...
3
votes
1answer
944 views

Prevent all Firefox Addons from sending data

Firefox addons are known to send data (like the URLs visited, location, installed cookies etc.) to their maintainers and (from there) to third parties. See for instance the newest "scandal" about the ...
1
vote
0answers
73 views

How does bulk Advertisement opt-out work? What services exist? [closed]

There are a few online advertisement opt-out services such as: http://www.aboutads.info/choices/#completed http://www.networkadvertising.org/choices/#completed http://www.youronlinechoices.com/uk/...
1
vote
3answers
763 views

Why use HTTPS Everywhere instead of going to the HTTPS site directly?

My understanding is that HTTPS Everywhere redirects websites to an https:// version if they support it. My question is, if websites do have an https:// supported version why aren't they using them in ...
2
votes
2answers
297 views

Are popular browser extensions for anonymity as safe as Tor?

There are many different browser extensions that people use in order to hide their IP addresses and protect their anonymity. Can the reliability of these proxy extensions be considered as being on the ...
11
votes
1answer
3k views

Firefox password manager and Firefox Sync

I have just migrated from LastPass to default Firefox Password Manager and Firefox Sync. I have some doubts about using Firefox Password Manager and Firefox Sync. Let's assume I don't use a master ...
4
votes
2answers
129 views

Can a Firefox extension read preferences or data stored by other extensions?

Is it possible for a Firefox extension to read preferences or data stored by other Firefox extensions? For example, could Firefox extension A, read any preferences or data stored by Firefox extension ...
2
votes
2answers
820 views

A dedicated browser (profile) for online banking

I have a dedicated browser (Firefox) profile that I use for accessing online banking systems (and only for that). The current setup is (summarising) as follows: I have it set to clear all history and ...
11
votes
1answer
3k views

Chrome/ Opera: How to trace and single out this Malware in Browser Extensions? caused by Tab Manager

There have been lot of articles about legitimate chrome/ opera extensions that get sold out to malicious parties that end up pushing the wrong kind of code down the pipe, since by default these ...
3
votes
0answers
3k views

How to change system fonts list in Firefox to avoid browser fingerprinting? [closed]

I found solution for most of types of browser fingerprints: IP - ZenMate Firefox VPN Add-on Canvas - CanvasBlocker Add-on Timezone - I use AutoIt to change Windows Timezone List of PlugIns - I just ...
2
votes
1answer
398 views

Is it normal for Chrome extensions to demand too many permission?

I tried to install a Chrome extension for downloading Facebook video clips, but it requests too many privileges in my opinion: Read and change all your data on the websites you visit Manage ...
11
votes
1answer
2k views

Is NoScript bad? [closed]

I just came to know about NoScript, but after installing it opened the author's homepage with an advert for 'SpeedUpMyPC' that pointed to a UniBlue website, which I found fishy. Googling turned up ...
2
votes
1answer
47 views

How to list all the permissions requested by an extension?

To install an extension, the browser (Chromium Web browser) give us an alert "can read all data on your computer and the websites you visit" , Sometimes we need to install an extension at least to ...
2
votes
1answer
781 views

Why browser hijacker changes the homepage to yahoo [closed]

I have seen many browser hijacker like istartsurf, ask.com which changes the victim's search engine to yahoo. Why many(almost all) browser hijacker changes the search engines to yahoo. Is there any ...
1
vote
1answer
685 views

HTTPS Everywhere (Firefox) allows mixed content on pages with images

I use HTTPS Everywhere extension for Firefox, and recently I've started witnessing Mixed Content warnings from time to time, apparently when there are images with http:// prefixes (in particular at SE ...
1
vote
0answers
38 views

Why can't VPN extensions filter everything in the browser?

For example, when I'm using one of this extensions, such as ZenMate or Browsec, I'm not able to watch video streamings. Or another thing that happened is my internet provider detecting me going on a ...
0
votes
2answers
127 views

Internet browsing encryption

I have a shared wifi point with a person who might be interested in knowing what I am browsing, writing and downloading in the internet. This person is the master of this wifi network, only he has an ...
6
votes
1answer
95 views

How to check browser extension behaviour?

I would like to be know which ways are available to check the behaviour of a firefox extension. While wikipedia states that any browser extension can have access to everything done by the browser, I ...
2
votes
1answer
271 views

WebRTC attack surface area?

I'm building an app for browser-to-browser communication. What is the attack surface area for WebRTC in 2015? What kinds of attacks could be done? And more importantly, how do I craft something ...
3
votes
2answers
541 views

Is it possible to feed Firefox Flash plugin with controlled data for privacy reasons?

For privacy and security reasons, it would be strongly recommended to deactivate the Flash plugin in the browser. But I don't want to deactivate it, I want to fake privacy relevant information. ...