6 ms·
On Safari, when you highlight this extension, you get this warning: * Webpage Contents Can read sensitive information from webpages, including passwords, phone
by herodotus 5y ago
On Safari, when you highlight this extension, you get this warning:
* Webpage Contents
Can read sensitive information from webpages, including passwords, phone numbers, and credit cards .....
* Can see when you visit all webpages
Is the cure worse than the disease? Analytics might be an invasion of my privacy, but it is benign compared with seeing my password. I am not saying that the extension steals my passwords, but how do I know it does not?
- mdavidn 5y agoThird-party JavaScript running on a domain could similarly steal passwords typed into that domain.
- herodotus 5y agoTrue, but if I activate the extension, can it steal passwords from any domain I visit?
- lrem 5y agoThe permission this warning is for is "inject arbitrary code into any site", so yes.
- hmottestad 5y agoWould your bank add third party js to their site without vetting it and locking it down? Also, please don’t answer that honestly because lots of banks actually had vulnerabilities that allowed hackers to inject js into their sites to steal login info.
- tgsovlerkhgsel 5y agoYou'd basically have to read the code every single time it updates, or at least hope someone does that and would publicly raise the issue (and that you're getting the same version as everyone else). That said, the analytics scripts can also do all of that. They can only do it on pages where they're embedded, of course, but especially for Google's scripts, that's probably most (not all) web sites (either in the form of Analytics, Tag Manager, or Ads).
- GeekyBear 5y ago>You'd basically have to read the code every single time it updates, or at least hope someone does that Firefox now has a program where they go through a vetting process for a subset of the available extensions. >Recommended extensions differ from other extensions that are regularly reviewed by Firefox staff in that they are curated extensions that meet the highest standards of security, functionality, and user experience. Firefox staff thoroughly evaluate each extension before it receives Recommended status. https://support.mozilla.org/en-US/kb/recommended-extensions-program https://support.mozilla.org/en-US/kb/recommended-extensions-...
- deleted 5y ago[deleted]
- gruez 5y agothat's just the generic warning that they have for most extensions, because the webextension security model doesn't allow for granular permissions.
- lrem 5y agoThere are about 60: https://developer.chrome.com/docs/extensions/mv3/declare_permissions/ https://developer.chrome.com/docs/extensions/mv3/declare_per... The warning is for the "inject arbitrary code into any page" one.
- gruez 5y agoRight, that's why I said "most", not all. There might be 60 separate permissions, but to do most non-trivial things you need the "inject arbitrary code into any page" permission.
- hmottestad 5y agoThis was one of the issues with ad-blockers. They would start of legit and say that they needed all this access in order to efficiently block everything. Then a few years down the line they would sell out to a company that would use this access to mine information about you and sell it to the highest bidder. They would obviously not go as far as to mine your credit card info, because that would get them banned I’m sure. So then Apple made a sandboxed ad-block extension point which would take a list of rules and apply them directly. This wasn’t flexible enough for everyone, so now we are back to square one again.
- snowwrestler 5y agoBrowser extensions seem like a security nightmare in general.
- ronsor 5y agoThey used to be much worse. People ended up with a dozen toolbars, plugins, and extensions that hijacked their search to sketchy sites like "Internet Web Search" and injected random ads into the page.
- kevin_thibedeau 5y agoAs opposed to running scripts from random websites with zero oversight.
- thehappypm 5y agoBrowsers have the sandbox. Extensions are outside of it, within a different one, but the further up you go the more vulnerabilities there are.
- Volker_W 5y agoYou know how many right the average windows/linux/macos desktop application has?
- ashtonkem 5y agoDNS level blocking with a Pihole is much safer in this regard, but also less capable, since it only works on anything that uses a dedicated domain that can be identified. In this case, google analytics only goes through analytics.google.com, so it’s easy to block at a DNS level.