220

It is not. This is a FUD (fear, uncertainty, and doubt) campaign by GMX because they want to display their ads. There is absolutely no security risk from the mentioned ad blockers. They added some crapware to the list to make it look more legitimate. Of course such campaigns are very unusual, especially from such a big and well known company like GMX. ...


106

Update After thinking it over, I have to agree with the other answers in that, despite the fact that it CAN access your data, Adblock is more likely to protect your privacy than invade it. The real risk are malicious ads that prompt you to install software on your computer. Adblock prevents these. Below is the original, cautionary answer: Yes, it totally ...


94

HSTS uses a Trust on First Use model. If your first connection to the site was already compromised, you may not receive an HSTS error on subsequent requests. The HTTPS Everywhere plugs this hole, by letting your browser know that the site is an HTTPS only site from the first connection. Also, some websites don't advertise an HSTS header even when they ...


53

This really comes down to an issue of trust. It is true that today, the AdBlock extension is safe. We know that it will not steal your data, even though—as the other answers point out—it has the technical ability to do so. However, Chrome extensions are silently and automatically updated. Do you trust that the developer of the AdBlock ...


50

I cannot answer the asked question, but I hope this could shed some light on your problem. Should corporate security rules forbid usage of some browser extension? IMHO the answer is YES here. Browser extensions can virtually do almost anything on behalf of the regular browser. That means that a local firewall will not detect them. Are there objective ...


49

HTTPS Everywhere is client-side, and HSTS is server-side. So the answer is that HTTPS Everywhere is to defend in cases where the server does not set an HSTS header.


42

All software is a security risk, but in this case their claim is misleading. Just like all advice is potentially bad and and all transactions are potentially fraudulent. "Risk" just means your security isn't guarenteed, with is true in 100% of cases. But in the case of AdBlock Plus, the software is well-understood and developed by a team that has a track ...


41

I suspect that Anders is right, and whoever set up the Chrome extension ban just didn't think about Firefox. If they realized that you were using Firefox to get around the ban, they'd probably forbid that too (or try to, anyway). FWIW, yes, browser extensions can be problematic from a security viewpoint, and I can see reasons for banning or heavily ...


33

You cannot assume that an add-on is safe "because it's hosted in one of the official extension galleries". In this answer, I start with the explanation of how extensions end up in the extension galleries for the popular browsers. At the end, I dedicate an extra section to Chrome. How does an item get listed in the official stores? Anyone with Google ...


27

It's better but not perfect. While it is (currently) impossible to get the URL for a given hash, of course every URL has the same hash. So it is not possible to see all the URLs a user browses, but it is quite likely to get most of them. While it isn’t possible to see user A visits HASH1 and conclude that HASH1 means fancyDomainBelongingToUserA-...


25

Yes Yes Yes Updated, See the comment from George Bailey for this one. No - like you say the sandbox will prevent that. Read (and send) data on all the pages you visit. Some more details on why this is often needed, but not always is discussed in this question Why do Chrome extensions need access to 'all my data' and 'browsing activity'?


22

even then if we browse to a website say www.facebook.com, the response header from the Facebook servers would have HSTS mentioned I made a curl request to http://www.facebook.com and this is what I got: < HTTP/1.1 302 Found < Location: https://www.facebook.com/ < Content-Type: text/html < X-FB-Debug: zgK/A+8XSlghi/vWvAivsZ04gawpdr+...


20

Just an observation - I tend to promote ad blockers especially for my less savvy friends and associates - precisely because it reduces security threats. How? Because much of the most malicious content on the web comes in the form of a misleading advertisement like "click here to make your pc faster"... These largely disappear with an ad blocker.


15

I install a plugin that allows me to click on any part of a page and it gives me the color of the clicked object For this to work, the plugin needs to register a click event handler and it needs to interact with the document object model of the current HTML page. HTML was originally designed to share scientific documents. And while we build complex web ...


14

Firefox: Yes. Sign your .xpi file using xpisign.py (with a certificate from a trusted issuer, such as Verisign). Integrity: Firefox will report a corrupt add-on if the hashes do not match. Verification: The user just needs to see if the add-on installation prompt says "Name of extension (developer name)" instead of "Name of extension (author not verified)" ...


12

IMPORTANT: This is in noway a full list of the things you should look for, use this answer as an example, a first step in your path and research on your own. I've had a similar task long time ago. I had to security-wise review the code of a Firefox addon, I'm sure you'll easily find Chrome/other browsers' equivalents. Also have in mind the Extensions in ...


12

If you see any activity on the browser that has these show up/ key words that might point to these issue then the following solution may help. Keywords for people to find this answer/ solution: crvlck.com coolbar.pro 33bc39603cbf409986a444d6bb525bf1 The Extension "Tab Manager" was sold to a malicious 3rd party and users were not notified in any ...


10

In Firefox: Yes, absolutely. Nothing about the Firefox architecture prevents them from doing so. While the passwords are in theory "encrypted" while stored on disk, the decryption key is also stored on disk. Therefore, any software with access to the filesystem will find it trivial to decrypt the stored passwords and access them. (If you don't want to ...


9

In browser extensions, the impact of a vulnerability highly depend on the context and the requested permissions. Static tools (JSHint, AMO validator) to check code exist, but none of them are 100% reliable, especially for obfuscated code. So, I'm not going to show a magic regular expression which tells you whether some code is vulnerable or not, but give a ...


9

Adblock (as other extensions and, for that matter, browser developers) has the technical ability to get a lot of your data, and you have all the risks commonly associated with running third-party applications - namely, that the vendor can be malicious, and there may be bugs in their software that break your security. That being said, I'd consider AdBlock as ...


9

You can do this with a GPO. Go to Computer Configuration > Administrative Templates > Google > Google Chrome. Look for a folder named Allowed extensions. There configure a blacklist of *. This will prevent users from installing plugins.


9

I think it's good that you want to protect a user's privacy, but what you're building seems to be opposed to protecting privacy, so I don't think it's possible to do with a simple setup (e.g. client sending url, in whatever form, directly to your backend service). As others have noted, hashing using sha1 is a good first step, but it only achieves privacy ...


9

Yes. There can be a legitimate reason: Chrome extensions are always automatically updated. Firefox extensions are not required to be auto-updated. This means that if the account of the developer of any Chrome extension with "read your information on all websites" permission gets compromised, the thief can push out malicious code around the world very ...


8

It's not malicious. That doesn't mean that it's 100% safe (almost no piece of software is), but if there are any security holes, then they will be bugs, and not something the author has intended to do. It has 67 contributors on github and I'm sure a lot more people have wen't through the code without making any contributions (especially knowing the fact that ...


8

The way this information is spread by United Internet is misleading (I am trying hard to avoid saying "libel"). The allegation as it stands is clearly wrong by all objective means, and the presentation is defamatory. Of course, in principle, one has to admit that Adblock (Plus) is of course a potential security risk. Whether this risk warrants a reasonable ...


8

In my opinion, Lastpass is referring to the Firefox password manager insecure when the user is not using master password for Firefox. Which won't be apples-to-apples comparison. Firefox uses 3DES for storing passwords and in case master password is not set, null ("") is used, which is insecure for sure. To read in detail about how Chrome, IE and Firefox ...


8

Short answer. While you state you are concerned about your end-user’s privacy, it’s not clear who you intend to be “protecting” them from and for what reason? If the core functionality of your application is to—essentially—farm user data from a client, send it to a server and deliver a result, then you as the recipient of that data will always know what ...


8

Perhaps in your company there were users who had malware or stolen data troubles because of Google Chrome extensions. Happened to me so I won't discount it. I don't know about Firefox extensions, but I have found malware in a Chrome extension which was manipulating my browser output. I investigated it on my own and reported it to Google but nothing ...


7

There are two issues here which make me say no you can't trust them 100%. Now the reason being is that you haven't reviewed the code on one side. It might contain some malicious code which was slipped in by a rogue developer or intentionally by the organization. For standard organisations this is normally very uncommon, but there have been cases such as ...


Only top voted, non community-wiki answers of a minimum length are eligible