News for hackers. Stuff that matters.

A comment on It's time to port your extension to Firefox.

Re:It's time to port your extension to Firefox by imiric on Friday February 12, 2021 @06:35PM (#26119865)
I must be in the minority, but I stopped using browser extensions many years ago. The amount of security and privacy issues of allowing 3rd party software to run on pages I visit makes me shudder. It's difficult enough to stop the pages themselves, their analytics and ad partners from tracking me and leaking my data, I don't want to voluntarily add to this problem.

The only extensions I would need are for ad blocking, which is solved with a DNS blocker on my router, avoiding the need to set it up on all my devices separately, and a password manager, which I find I don't actually need since copy/pasting from a terminal with pass works well enough. So now all my browsers run as vanilla as possible, with maybe a built-in dark theme.

In this specific case Keysmith can record any input on any page and play it back. While the functionality is undoubtedly useful, the keylogger aspect sounds like a huge privacy risk. Their privacy policy[1] "promises" they will never collect or sell any sensitive data, but frankly why should I trust it or trust that it won't change without my knowledge? Especially with a proprietary app I can't inspect the source code of.

The Chrome Web Store submission process sounds like a nightmare, but I'm more concerned that such an invasive extension was ultimately allowed on both platforms, and that it was approved on Firefox in just 24h.

[1]: https://www.keysmith.app/privacy-policy

[ Parent | on HN ]
Re:It's time to port your extension to Firefox by franga2000 on Saturday February 13, 2021 @02:54PM (#26126206)
I think there's a big difference between commercial web browser extensions that are basically turning into what toolbars used to be and (usually) open-source extensions that really are what they say - something that extends what your browser can do.

A well-made extension these days with no ulterior motives will be scoped tightly to only the site it's designed for or not even that, if it only modifies the browser chrome. I have like 20-30 extensions currently installed on my workstation, but only three of them have global content access (uBlock, Bitwarden, Dark Reader - all FOSS). The rest are highly site-specific and don't even see any other sites, so I'm not too worried about them.

[ Parent | on HN ]