4 ms·
Sometimes popular abandoned browser extensions get bought up by malicious actors that inject malware into your browser without you ever knowing because extensio
by miguelmota 7y ago
Sometimes popular abandoned browser extensions get bought up by malicious actors that inject malware into your browser without you ever knowing because extensions get automatically updated.
- megous 7y agoThat's why you uncheck "update add-ons automatiocally' in the add-on manager.
- paulryanrogers 7y agoThis risks using a known-vulnerable extension unless you monitor releases another way
- megous 7y agoVulnerable extensions are exploited when you access websites that can abuse the holes in the extension (XSS for example). You have to visit the site that the extension targets that has the attack payload for the extension. I think that risking this by updating manually is more acceptable than getting the mallicious code directly auto-installed as soon as it's released by the attacker no matter what you do.
- miguelmota 7y agoStandard users would have no idea they can do that or even bother. Extensions are risky additions to the browser because it's 3rd party code that can read your web pages and local storage values.
- megous 7y agoYes, but I didn't talk about standard users. Also, most of my extensions are not 3rd party code and I want them to have full access. For the rest I update them once in a while and go check ~/.mozilla/**/*.xpi for changes with something like this. find -maxdepth 1 -mindepth 1 -type d ! -name .git -print0 | xargs -0r rm -rf for f in ../extensions/*.xpi ; do unzip "$f" -d "$(basename "${f%.xpi}")" done git add -Af . git commit -m "Changes"