3 ms·

Security question: Is a web extension safe if it is installed but if you're not using it at the moment? For example, if I were logged into my bank's website an

Security question: Is a web extension safe if it is installed but if you're not using it at the moment? For example, if I were logged into my bank's website and I did not click the SingleFile button in the extension toolbar, could it still theoretically collect info from my bank's webpage or do other actions? I'd like to use SingleFile and have no reason at all to distrust it, but I'd like to understand the security impact of installing lots of web extensions. How do people handle security risks like that? Do you run a separate vanilla browser with no extensions for sensitive tasks?

gildas 5y ago
For technical reasons beyond my control, SingleFile injects a (very small) script when the page loads even if you don't click on the button. It could also send any data to a third party server. Unfortunately, it is therefore impossible for me to technically and formally guarantee that SingleFile cannot behave maliciously. Note however that the extension has the status "recommended" on Firefox and that it undergoes a manual code review by Mozilla at each update.
- fmntf 5y ago
  Could you please elaborate what script is injected, that reason and why it is that out of your control? Thank you
  - gildas 5y ago
    I will do it, but it will take me some time to explain it and rather than answering on HN I will integrate it in the FAQ. I created an issue for this here: https://github.com/gildas-lormeau/SingleFile/issues/885 https://github.com/gildas-lormeau/SingleFile/issues/885.
- varenc 5y ago
  On Chrome you can go into extension settings and adjust permissions so SingleFile only has permissions “on click”. Then it won’t/can't inject that little JS snippet into a page until you actually want to use the extension. The only downside is that after enabling you then have to refresh the page for the extension to do its work. I wish this behavior was more well known and encouraged by Google.
  - gildas 5y ago
    You are absolutely right, thanks for the suggestion! I had totally forgotten about this feature.
prox 5y ago
In Firefox you could run a totally different profile. I don’t do this myself, I try to research any extension I add and don’t do automatic upgrades. I use as little extensions as possible.
fsflover 5y ago
If you care about security, consider using Qubes OS with hardware-virtualized VMs for compartmentalization. Then, you Firefox for banking won't have the same extensions which you use elsewhere. Works for me.

gildas 5y ago

For technical reasons beyond my control, SingleFile injects a (very small) script when the page loads even if you don't click on the button. It could also send any data to a third party server. Unfortunately, it is therefore impossible for me to technically and formally guarantee that SingleFile cannot behave maliciously. Note however that the extension has the status "recommended" on Firefox and that it undergoes a manual code review by Mozilla at each update.

fmntf 5y ago
Could you please elaborate what script is injected, that reason and why it is that out of your control? Thank you
- gildas 5y ago
  I will do it, but it will take me some time to explain it and rather than answering on HN I will integrate it in the FAQ. I created an issue for this here: https://github.com/gildas-lormeau/SingleFile/issues/885 https://github.com/gildas-lormeau/SingleFile/issues/885.
varenc 5y ago
On Chrome you can go into extension settings and adjust permissions so SingleFile only has permissions “on click”. Then it won’t/can't inject that little JS snippet into a page until you actually want to use the extension. The only downside is that after enabling you then have to refresh the page for the extension to do its work. I wish this behavior was more well known and encouraged by Google.
- gildas 5y ago
  You are absolutely right, thanks for the suggestion! I had totally forgotten about this feature.

prox 5y ago

In Firefox you could run a totally different profile. I don’t do this myself, I try to research any extension I add and don’t do automatic upgrades. I use as little extensions as possible.

fsflover 5y ago

If you care about security, consider using Qubes OS with hardware-virtualized VMs for compartmentalization. Then, you Firefox for banking won't have the same extensions which you use elsewhere. Works for me.