3 ms·
I used to have this exact same fear and never downloaded any extensions bc of that, until I started making browser extensions. Pretty much any useful extension
by greenie_beans 7y ago
I used to have this exact same fear and never downloaded any extensions bc of that, until I started making browser extensions. Pretty much any useful extension needs the access that prompts that generic message about accessing all the data.
Any extension that's listed on the web stores have to be reviewed for malicious code, and they must do what the listing say they do. So if your browser extension has your passwords, then that extension would be considered a password manager.
The extension probably listens to the IPs of well-known time wasting websites like HN or reddit, then adds a latency to the browsing. Same with an ad blocker -- they know every site you visit but only to compare them with their blacklist of advertising IP addresses.
Of course, you have to trust they aren't doing anything else with that info, which you can probably assume you're mostly safe if you don't need an account to use the extension.
- skipants 7y agoI believe only "recommended extensions" for Firefox are tech reviewed, which this one is not. https://support.mozilla.org/en-US/kb/recommended-extensions-program https://support.mozilla.org/en-US/kb/recommended-extensions-...
- pzmarzly 7y agoAccording to [0], Mozilla requires all extensions to have a source in human-readable format and runs a test suite on them. They mention "code review" there, but don't say whether it's manual or automatic. I'd love to hear about it from someone who has some experience with the process. [0] https://extensionworkshop.com/documentation/publish/submitting-an-add-on/ https://extensionworkshop.com/documentation/publish/submitti...
- Anon1096 7y agoFor my extension the review was automatic, and flags things like direct html editing. I only have a few hundred users though, so I'm not sure at what point they decide to do manual reviews.
- dessant 7y agoMozilla runs an automatic check on all extension versions before they get published, and Recommended extensions also go through a manual review before publication. Listings which do not participate in the Recommended extensions program may also get a manual review after they were published, but immediate human review is not guaranteed. If you're a developer, I'd recommend disabling automatic extension updates in Firefox, and configuring a script to get notified about updates, even if you only use Recommended extensions. Extension source viewer is excellent for reviewing updates yourself before installing, and it is maintained by Rob Wu, an engineer at Mozilla. https://addons.mozilla.org/en-US/firefox/addon/crxviewer/ https://addons.mozilla.org/en-US/firefox/addon/crxviewer/
- chadlavi 7y agoThere's a link to his github in the extension page. You can read his source code: https://github.com/OskarDamkjaer/FirefoxDelayWebpage https://github.com/OskarDamkjaer/FirefoxDelayWebpage most of the relevant code is in https://github.com/OskarDamkjaer/FirefoxDelayWebpage/blob/master/delay.js https://github.com/OskarDamkjaer/FirefoxDelayWebpage/blob/ma...
- wizzwizz4 7y agoIt actually matches a regular expression against the URL; I don't think it looks at the IP addresses.