8

I wanted to install this extension, but I have security concerns.

The extension needs permission to "Access your data on all websites". This makes sense, but I presume this includes password and credit card fields, bank routing numbers etc.

This page says that certain permissions require a warning shown to the user, but certain permissions don't trigger warnings. Among the permissions that don't trigger warnings is 'webRequest'.

How can I be sure that this extension (or any) isn't reading my sensitive data and writing it back to a db via an invisible web request?

  • It would be nice if Chrome extensions had more fine-grained security controls, like Greasemonkey scripts do these days. For example "cannot upload data" and "cannot store data locally" could be reassuring constraints. – joeytwiddle Nov 30 '15 at 15:17
3

Adblock extensions require ability to access and modify the full HTML content of pages you visit, in order for element-blocking rules to work (e.g. to hide all <div id="advert"> elements). So of course they could abuse this access, and it is very hard to determine it programmatically.

In the case of Adblock Plus, you could examine the publicly available source code; but other than that, you'll just have to trust it. The extension has been around since 2006 for Firefox and 2010 for Chrome, and hasn't caused security issues since then nor has been ever removed from either program's extension store. It is reasonable to assume that it is trustworthy.

2

The best way is to look at the source code if it's available. You can also do a bit of investigating yourself.

You can view the network traffic of the Chrome extension by first enabling developer mode by ticking the checkbox you find at chrome://extensions/.

After this, under each extension you should see an option to inspect the extension.

enter image description here

Clicking on the link to inspect the background page brings up a developer tools window. Click on the Network tab, and leave it open as you use the extension while watching the network tab for any traffic.

enter image description here

You can also click on Resources and have a look under Session Storage, Local Storage, to see what data the extension is storing locally (if they are using those specific features).

Further, if you click on the Sources tab, you can click on the little arrow (top left) and see the actual JavaScript files that make up the extension.

enter image description here

  • The source code will change for every version. So this will have to happen before every update. Seems like a lot of work... – pixelearth Aug 7 '14 at 20:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.