How unsafe are browser extensions/add-ons/plug-ins?

Question

Chrome and Firefox have a lot of extensions, some of which are very useful. When you install them, they say they need access to all of the user's web page data.:

(1) Is this a threat to online passwords used on banking sites etc ?

(2) If the website is using HTTPS, then what kind of data is available to the extension, since the login credentials would be encrypted.

(3) Do pop-up/ad windows have browser extensions loaded into them? Many banking sites use these reduced browser windows since they are independent of the main window, and don't have forward and back buttons so their design can prevent the user from interacting with the flow of interaction.

(4) Is it a good idea to keep one browser (like Iron, Chromium or Comodo Dragon) clean and extension-free just for e-banking and online shopping ?

Should add that I'm not very familiar with how exactly the extensions/add-ons get loaded into the browser, and how they work or are developed - so a brief explanation on that too would be nice. Thanks.

Answer 1

Q 1 and 2.
Each extension is different and unique, programmed by different people with different morales/abilities etc. The answer is yes, a plug in could potentially read your data (regardless of being HTTPS) or password details etc but whether it does or not is a different matter! It is the same issue really with installing anything (software, plug in, app on your phone etc). It's all software with access to your machine since you put it there.

Q 3
A pop up window is your browser so most likely has the exact same extensions/plug ins (unless any are automatically deactivated on certain criteria).

Q 4
If you are doing online banking then yes, it probably is a good idea to have a vanilla installation or let your AV take care of it!

It is up to the browser what it does in regards to plugins. I'm sure some leave it to the user (you installed it, your risk), others may monitor it... Or, there could be a plugin which monitors plugins which would be helpful (providing it is trustworthy of course :) )

Of course, it's not just plugins in which are a cause of concern, keystroke loggers etc may not even be part of the browser and can capture this information.

I think the general rule I have is, if the extension is well known then it's probably trust worthy... Why would a respected make do something illegally, it will ruin their reputation etc. I have extensions which remember my password details and that doesn't bother me, but when I do online banking, I have Kasperksy running 'Safe Money' to give me more peace of mind.