Hacker News Reader

Comment by e40 | Hacker News Reader

> Reconsider the risks of browser extensions

This is underrated. There are many, many browser extensions I would love to use, but I will never install. If it's from Google or Apple or a company I pay money to, I will install it. Or if it's uBlock Origin or Privacy Badger. Otherwise, I just don't trust that a future update after the sale of the extension won't turn evil.

View on HN

I think it depends on the permissions the extension asks for at the time of install. If a future update tries to escalate their permissions to access all websites, at the very least you will be notified about that.

But, if you install an extension that from day 1 gets full dom access to all sites, it already has everything it needs to be evil.

Agreed. There are a lot of extensions, tab managers for example, that get to see a LOT. I'm very unhappy with the state of Firefox tab management, but damned if I'm going to install one of those extensions. Who knows what evil deeds they will do now or in the future.

I use Tree Style Tab -- it's actually one of the main reasons I use Firefox -- and this does make me a bit nervous. TST and its competitor Sidebery are both Firefox "Recommended Extensions"[1], which receive extra scrutiny from Firefox staff. I'd like to think that these extensions are as trustworthy as the browser itself, but the Firefox article doesn't go into great detail about how (and how frequently) they review these extensions.

[1] https://support.mozilla.org/en-US/kb/recommended-extensions-...

I did look at that. I guess I just don't/can't trust the Firefox staff to make sure it doesn't turn evil, before doing a lot of damage. I figure if it does turn evil, it will be noticed after a short while, but lots of data could be collected in that short time.

Reply on news.ycombinator.com