3 ms·
And both Grammarly and LastPass have had security bugs that let any website worm their way into the extension and access all the data from the extension (anythi
by geofft 6y ago
And both Grammarly and LastPass have had security bugs that let any website worm their way into the extension and access all the data from the extension (anything you've ever typed, for Grammarly, and all your passwords, for LastPass). Extensions with wide-ranging access are useful, and there's a reason Chrome has support for it, but they're also very very hard to get right, even if your entire business is writing a security-focused browser extension.
You could go the approach Firefox is going on mobile where there are currently six vetted extensions. As it turns out, they all need access to every website (or fine-grained APIs, perhaps). But... there are six of them. https://blog.mozilla.org/addons/2020/04/14/april-extensions-for-firefox-preview/ https://blog.mozilla.org/addons/2020/04/14/april-extensions-...
- FillardMillmore 6y agoDo you have a link for that claim on LastPass? I use the extension and am wondering if I shouldn't use an PM extension thats more reliable in terms of security. Any recommendations obviously welcome.
- geofft 6y agoSee my podcast's episode on this :) https://looseleafsecurity.com/episodes/password-manager-security-model.html https://looseleafsecurity.com/episodes/password-manager-secu... (there's a full transcript in there if audio isn't your thing) The LastPass issues are all pretty old at this point - I mostly mention it to drive in the point that getting this stuff right is hard. (For what it's worth, the researcher who found those issues has good things to say about LastPass: https://twitter.com/taviso/status/1167311357957435392 https://twitter.com/taviso/status/1167311357957435392 and also fairly negative things to say about 1Password, which is what I happen to use.)
- Filligree 6y agoAny opinion on Bitwarden?
- heleninboodler 6y agoIMO a password manager is an extremely critical piece of software that I'm ok with if I trust its security model. There are a couple whose security models I do trust. However, merging those security models with random extensions that may or may not have full run of all code executing in the same context as my password manager is a hard no. It's baffling to me that any legit password managers go to the trouble to write and support browser extensions, given the risk. It's betting your reputation for security on a very small amount of user convenience.
- singron 6y agoBTW the 6 extension whitelist is for Firefox Preview. The normal firefox app doesn't have a whitelist.