16

It seems every now and again some popular Chrome or Firefox extension decides to "go evil" seemingly out of nowhere.

Stylish got caught logging browser history, The Great Suspender turned out to be spyware, and, in the case of "get cookies.txt", which was endorsed by youtube-dl, apparently the user is not the only one "getting" the cookies.

In most of these cases, it seems that trustworthy extensions get sold off to some shady third parties, or the developers just "turns evil". This got me wondering: would it be an effective security precaution to simply disable updates for browser extensions? i.e. to download the extension manually from the developer, instead of relying on chrome web store / firefox addon catalogue. It wouldn't help much if the extension you're using contains malware now, but it would prevent malware being installed in potential future updates.

So, what do you guys think?

you are viewing a single comment's thread
view the rest of the comments
[-] amanwithausername@vlemmy.net 1 points 1 year ago

My idea is that if I stay on the oldest supported version for as long as possible, that would help me avoid evil changes in new versions, since the news would have gone public before I update. You bring up a good point about security updates tho. How relevant is it to browser extensions? Has there been malware out there that specifically targets vulnerabilities in extensions? Just casually doing git log | grep -E 'vuln|crit|secur|bug' in two extensions that I use quite extensively (pun intended), I don't seem to find any security-related commits.

[-] min_fapper@iusearchlinux.fyi 1 points 1 year ago

Most security fixes come from updating dependencies, which probably wouldn't mention those in the commit messages, since they can be looked up in the release notes of those libraries.

this post was submitted on 19 Jun 2023
16 points (100.0% liked)

Cybersecurity

5410 readers
316 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Community Rules

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !cybersecurity@lemmy.capebreton.social !securitynews@infosec.pub !netsec@links.hackliberty.org !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub

Notable mention to !cybersecuritymemes@lemmy.world

founded 1 year ago
MODERATORS