Hacker News Reader

Comment by mysterypie | Hacker News Reader

Security question: Is a web extension safe if it is installed but if you're not using it at the moment? For example, if I were logged into my bank's website and I did not click the SingleFile button in the extension toolbar, could it still theoretically collect info from my bank's webpage or do other actions?

I'd like to use SingleFile and have no reason at all to distrust it, but I'd like to understand the security impact of installing lots of web extensions. How do people handle security risks like that? Do you run a separate vanilla browser with no extensions for sensitive tasks?

View on HN

For technical reasons beyond my control, SingleFile injects a (very small) script when the page loads even if you don't click on the button. It could also send any data to a third party server. Unfortunately, it is therefore impossible for me to technically and formally guarantee that SingleFile cannot behave maliciously. Note however that the extension has the status "recommended" on Firefox and that it undergoes a manual code review by Mozilla at each update.

Could you please elaborate what script is injected, that reason and why it is that out of your control? Thank you

I will do it, but it will take me some time to explain it and rather than answering on HN I will integrate it in the FAQ. I created an issue for this here: https://github.com/gildas-lormeau/SingleFile/issues/885.

On Chrome you can go into extension settings and adjust permissions so SingleFile only has permissions “on click”. Then it won’t/can't inject that little JS snippet into a page until you actually want to use the extension. The only downside is that after enabling you then have to refresh the page for the extension to do its work.

I wish this behavior was more well known and encouraged by Google.

You are absolutely right, thanks for the suggestion! I had totally forgotten about this feature.

In Firefox you could run a totally different profile.

I don’t do this myself, I try to research any extension I add and don’t do automatic upgrades. I use as little extensions as possible.

If you care about security, consider using Qubes OS with hardware-virtualized VMs for compartmentalization. Then, you Firefox for banking won't have the same extensions which you use elsewhere. Works for me.

Reply on news.ycombinator.com