5 ms·
I treat each and every Chrome extension as potentially malware, given that there are plenty of instances of legit extensions being sold and repurposed, and Chro
by facorreia 5y ago
I treat each and every Chrome extension as potentially malware, given that there are plenty of instances of legit extensions being sold and repurposed, and Chrome will silently install malware on my machine because of its auto-update-without-asking-or-verifying policy. I only trust a few, select extensions from large companies that hopefully won't sell them to a shady hacker.
- dataviz1000 5y agoI build my own personal Chrome extensions to be used only by myself and I treat them as potentially malware every single time I type `npm install`. If I built an extension to share, I would likely make it completely with vanilla JavaScript.
- welder 5y agoYes, for open source extensions that don't update often I load them unpacked from my local filesystem.
- trutannus 5y agoOne approach would be to intercept your own traffic with Fiddler as a proxy for a few hours after installing and look for any nefarious requests. This is a pretty effective way to run a basic security audit.
- kortilla 5y agoOnly effective against ones that don’t have activation criteria.
- londons_explore 5y agoUsually the activation criteria will be "Contact this server and see what it tells me to do". An extension developer ought to know the exact purpose of every network request their extension makes, so inspecting network logs is indeed a good plan. Just remember there are ways to detect if the developer tools panel is open...
- ceejayoz 5y ago> Usually the activation criteria will be "Contact this server and see what it tells me to do". Right, but it could be set up to only do that starting six months after installation or something.
- trutannus 5y agoYep, but it's a good start. Why I called it a "basic audit".