224

It is not. This is a FUD (fear, uncertainty, and doubt) campaign by GMX because they want to display their ads. There is absolutely no security risk from the mentioned ad blockers. They added some crapware to the list to make it look more legitimate. Of course such campaigns are very unusual, especially from such a big and well known company like GMX. ...


114

Update After thinking it over, I have to agree with the other answers in that, despite the fact that it CAN access your data, Adblock is more likely to protect your privacy than invade it. The real risk are malicious ads that prompt you to install software on your computer. Adblock prevents these. Below is the original, cautionary answer: Yes, it totally ...


93

HSTS uses a Trust on First Use model. If your first connection to the site was already compromised, you may not receive an HSTS error on subsequent requests. The HTTPS Everywhere plugs this hole, by letting your browser know that the site is an HTTPS only site from the first connection. Also, some websites don't advertise an HSTS header even when they ...


63

Any extension that has access to the DOM can read whatever is written to the console by intercepting calls. The console is a JavaScript object; it is simple to proxy calls to console.log, like this example from zzzzBov on Stack Overflow: (function () { var log = console.log; console.log = function () { log.call(this, 'My Console!!!'); log.apply(...


55

This really comes down to an issue of trust. It is true that today, the AdBlock extension is safe. We know that it will not steal your data, even though—as the other answers point out—it has the technical ability to do so. However, Chrome extensions are silently and automatically updated. Do you trust that the developer of the AdBlock ...


50

I cannot answer the asked question, but I hope this could shed some light on your problem. Should corporate security rules forbid usage of some browser extension? IMHO the answer is YES here. Browser extensions can virtually do almost anything on behalf of the regular browser. That means that a local firewall will not detect them. Are there objective ...


48

HTTPS Everywhere is client-side, and HSTS is server-side. So the answer is that HTTPS Everywhere is to defend in cases where the server does not set an HSTS header.


43

All software is a security risk, but in this case their claim is misleading. Just like all advice is potentially bad and and all transactions are potentially fraudulent. "Risk" just means your security isn't guarenteed, with is true in 100% of cases. But in the case of AdBlock Plus, the software is well-understood and developed by a team that has a track ...


41

I suspect that Anders is right, and whoever set up the Chrome extension ban just didn't think about Firefox. If they realized that you were using Firefox to get around the ban, they'd probably forbid that too (or try to, anyway). FWIW, yes, browser extensions can be problematic from a security viewpoint, and I can see reasons for banning or heavily ...


35

You cannot assume that an add-on is safe "because it's hosted in one of the official extension galleries". In this answer, I start with the explanation of how extensions end up in the extension galleries for the popular browsers. At the end, I dedicate an extra section to Chrome. How does an item get listed in the official stores? Anyone with ...


27

It's better but not perfect. While it is (currently) impossible to get the URL for a given hash, of course every URL has the same hash. So it is not possible to see all the URLs a user browses, but it is quite likely to get most of them. While it isn’t possible to see user A visits HASH1 and conclude that HASH1 means fancyDomainBelongingToUserA-...


26

According to developer.chrome.com: [Chrome Extensions] are built on web technologies such as HTML, JavaScript, and CSS. This means, anything that could affect the behavior of an extension will exist in a plain-text format (as opposed to a binary). Chrome allows you to debug extensions, giving you a comparatively easy way to see what an extension is doing,...


22

even then if we browse to a website say www.facebook.com, the response header from the Facebook servers would have HSTS mentioned I made a curl request to http://www.facebook.com and this is what I got: < HTTP/1.1 302 Found < Location: https://www.facebook.com/ < Content-Type: text/html < X-FB-Debug: zgK/A+8XSlghi/vWvAivsZ04gawpdr+...


21

Just an observation - I tend to promote ad blockers especially for my less savvy friends and associates - precisely because it reduces security threats. How? Because much of the most malicious content on the web comes in the form of a misleading advertisement like "click here to make your pc faster"... These largely disappear with an ad blocker.


17

https://robertheaton.com/2018/07/02/stylish-browser-extension-steals-your-internet-history/ is the original technical write-up that covered the Stylish ordeal. There was a more recent one posted in August by the same author that covers the updated version of Stylish: https://robertheaton.com/2018/08/16/stylish-is-back-and-you-still-shouldnt-use-it/. The ...


14

Firefox: Yes. Sign your .xpi file using xpisign.py (with a certificate from a trusted issuer, such as Verisign). Integrity: Firefox will report a corrupt add-on if the hashes do not match. Verification: The user just needs to see if the add-on installation prompt says "Name of extension (developer name)" instead of "Name of extension (author not verified)" ...


12

It's not malicious. That doesn't mean that it's 100% safe (almost no piece of software is), but if there are any security holes, then they will be bugs, and not something the author has intended to do. It has 67 contributors on github and I'm sure a lot more people have wen't through the code without making any contributions (especially knowing the fact that ...


12

You can do this with a GPO. Go to Computer Configuration > Administrative Templates > Google > Google Chrome. Look for a folder named Allowed extensions. There configure a blacklist of *. This will prevent users from installing plugins.


12

If you see any activity on the browser that has these show up/ key words that might point to these issue then the following solution may help. Keywords for people to find this answer/ solution: crvlck.com coolbar.pro 33bc39603cbf409986a444d6bb525bf1 The Extension "Tab Manager" was sold to a malicious 3rd party and users were not notified in any ...


12

Tracing your browser traffic using a free proxy like fiddler can show some eye opening things. I could see an outbound request to an unfamiliar domain after every page I visited. Looking at the headers of the unfamiliar requests in Fiddler, i could see the URL of the page i visited! I disabled my chrome extensions one by one until I found the culprit. ...


10

In my opinion, Lastpass is referring to the Firefox password manager insecure when the user is not using master password for Firefox. Which won't be apples-to-apples comparison. Firefox uses 3DES for storing passwords and in case master password is not set, null ("") is used, which is insecure for sure. To read in detail about how Chrome, IE and ...


9

In browser extensions, the impact of a vulnerability highly depend on the context and the requested permissions. Static tools (JSHint, AMO validator) to check code exist, but none of them are 100% reliable, especially for obfuscated code. So, I'm not going to show a magic regular expression which tells you whether some code is vulnerable or not, but give a ...


9

Adblock (as other extensions and, for that matter, browser developers) has the technical ability to get a lot of your data, and you have all the risks commonly associated with running third-party applications - namely, that the vendor can be malicious, and there may be bugs in their software that break your security. That being said, I'd consider AdBlock as ...


9

I think it's good that you want to protect a user's privacy, but what you're building seems to be opposed to protecting privacy, so I don't think it's possible to do with a simple setup (e.g. client sending url, in whatever form, directly to your backend service). As others have noted, hashing using sha1 is a good first step, but it only achieves privacy ...


9

Yes. There can be a legitimate reason: Chrome extensions are always automatically updated. Firefox extensions are not required to be auto-updated. This means that if the account of the developer of any Chrome extension with "read your information on all websites" permission gets compromised, the thief can push out malicious code around the world very ...


8

The way this information is spread by United Internet is misleading (I am trying hard to avoid saying "libel"). The allegation as it stands is clearly wrong by all objective means, and the presentation is defamatory. Of course, in principle, one has to admit that Adblock (Plus) is of course a potential security risk. Whether this risk warrants a reasonable ...


8

Short answer. While you state you are concerned about your end-user’s privacy, it’s not clear who you intend to be “protecting” them from and for what reason? If the core functionality of your application is to—essentially—farm user data from a client, send it to a server and deliver a result, then you as the recipient of that data will always know what ...


8

Perhaps in your company there were users who had malware or stolen data troubles because of Google Chrome extensions. Happened to me so I won't discount it. I don't know about Firefox extensions, but I have found malware in a Chrome extension which was manipulating my browser output. I investigated it on my own and reported it to Google but nothing ...


7

Read this document. Relevant excerpt (page 3): The Firefox platform has no mechanisms to restrict the privileges of add-ons. The add-on code is fully trusted by Firefox. The installation of malicious add-ons can result in full system compromise. There is no security measure to restrict the intercommunication between add-ons. As a result an add-on ...


7

There are two issues here which make me say no you can't trust them 100%. Now the reason being is that you haven't reviewed the code on one side. It might contain some malicious code which was slipped in by a rogue developer or intentionally by the organization. For standard organisations this is normally very uncommon, but there have been cases such as ...


Only top voted, non community-wiki answers of a minimum length are eligible