Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Chrome and Firefox have a lot of extensions, some of which are very useful. When you install them, they say they need access to all of the user's web page data.:

(1) Is this a threat to online passwords used on banking sites etc ?

(2) If the website is using HTTPS, then what kind of data is available to the extension, since the login credentials would be encrypted.

(3) Do pop-up/ad windows have browser extensions loaded into them? Many banking sites use these reduced browser windows since they are independent of the main window, and don't have forward and back buttons so their design can prevent the user from interacting with the flow of interaction.

(4) Is it a good idea to keep one browser (like Iron, Chromium or Comodo Dragon) clean and extension-free just for e-banking and online shopping ?

Should add that I'm not very familiar with how exactly the extensions/add-ons get loaded into the browser, and how they work or are developed - so a brief explanation on that too would be nice. Thanks.

share|improve this question
2  
See also: How big of a risk are popular Chrome extensions? –  slhck Aug 12 '13 at 13:35
1  
This might be better off on Information Security. Heck, it's probably already been asked there. –  Al E. Aug 12 '13 at 17:04
    
Oh okay yeah, didnt know about that site. Found it security.stackexchange.com/questions/15259/… –  PKM Aug 13 '13 at 8:10

1 Answer 1

up vote 3 down vote accepted

Q 1 and 2.
Each extension is different and unique, programmed by different people with different morales/abilities etc. The answer is yes, a plug in could potentially read your data (regardless of being HTTPS) or password details etc but whether it does or not is a different matter! It is the same issue really with installing anything (software, plug in, app on your phone etc). It's all software with access to your machine since you put it there.

Q 3
A pop up window is your browser so most likely has the exact same extensions/plug ins (unless any are automatically deactivated on certain criteria).

Q 4
If you are doing online banking then yes, it probably is a good idea to have a vanilla installation or let your AV take care of it!

It is up to the browser what it does in regards to plugins. I'm sure some leave it to the user (you installed it, your risk), others may monitor it... Or, there could be a plugin which monitors plugins which would be helpful (providing it is trustworthy of course :) )

Of course, it's not just plugins in which are a cause of concern, keystroke loggers etc may not even be part of the browser and can capture this information.

I think the general rule I have is, if the extension is well known then it's probably trust worthy... Why would a respected make do something illegally, it will ruin their reputation etc. I have extensions which remember my password details and that doesn't bother me, but when I do online banking, I have Kasperksy running 'Safe Money' to give me more peace of mind.

share|improve this answer
    
Thanks. Is this really the best way to allow for adding 3rd party functionality in browsers - I'm surprised this hasn't become a big deal and been discouraged by banks categorically. I am interested in: (1) Is an extension a program which can generate HTML/CSS/JS/AJAX requests by parsing the DOM ? Is there any secure architecture int the works which adds security to the DOM ? (2) At what point in the TCP/IP stack does the encryption from the HTTPS kick-in? Does it happen in the TCPIP stack or is it's done at the DOM level by the browser itself (which I think would be better). –  PKM Aug 13 '13 at 4:06
1  
That is a new question and my honest answer is, do your own research first and ask questions when you're stuck. Feel free to ask it though as a new post. Also, I know that you're surprised that this isn't a big deal but try to think why it isn't... The answer, IMO, is because most people are trust worthy. But, also, plugins can expose security vulnerabilities as well (which may be worth while investigating). –  Dave Rook Aug 13 '13 at 7:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.