3 ms·
Well, sure, but any out-of-band communication is potentially a leak. If the extension pulls every logo whenever you run it (notwithstanding whatever caching is
by jzl 10y ago
Well, sure, but any out-of-band communication is potentially a leak. If the extension pulls every logo whenever you run it (notwithstanding whatever caching is used, if any), then every site that has a logo could track when you open the extension at all. There are other potential issues here too ... like if a maliciously formed logo image could be used to crash the extension, etc..
Those aren't great examples, but any out-of-band information leak is a bad thing to have. Even if there are no known exploits now there might be future exploits that haven't been anticipated. A common issue when it comes to security.
- pvg 10y agoHow can the site tell you're using the extension? And so what if it does? The site can guess you're using a password manager by noticing the instant password entry. The malicious logo, that's really a problem for your browser to deal with. Using an extension to help you talk to a site you already talk to is not really a leak, given the purpose of such extensions.
- jzl 10y agoA lone request for the logo image with no other simultaneous requests in the log could probably be gleaned as a lastpass extension lookup. And again in this scenario (which we don't know if it's accurate, yet) it's pulling the image for every site with a logo whenever you browse the vault. So your IP address could be leaked to a site that you don't want to know your whereabouts at that moment. Forensic information is forensic information. A security-conscious tool should not be increasing one's forensic footprint.