1

Surely (or at least hopefully) I'm not the first to wonder about this (but a search on "StackEye security" gets me nothing).

All I really want to do is follow users on StackExchange and so I followed my nose to a ~10 year old canonical answer for doing so. So far so good, let's install the StackEye extension in Chrome then.

But what I see there makes my blood run cold. Can it really, truly Read and change all your data on all websites? And which should worry me more? Read and Change or ALL?

screenshot

So my question is what is the basic tenet of RSS security that applies here because I can't imagine that things are as bad as this makes it sound.

For example:

  • Are there any permanent risks to my device or would the "worst that could happen" still be ephemeral, affecting only the current view of the page?
  • Can the extension change modify unrelated cookies or install tracking?
  • What am I really giving up (if anything) if I go ahead and click [Add Extension]?

1 Answer 1

3

Given that what you're asking about is a browser extension and you're showing the confirmation dialog for installing the extension into your Chrome browser, I'd suggest that you investigate security issues for browser extensions in general and the permission this browser extension is asking for that maps to the browser asking you to confirm "Read and change all your data on all websites".

To talk about the issues for the specific browser extension which you're asking about, "StackEye", would require detailed examination of the code for that browser extension. I'm not going to do that here for multiple reasons.

Installing a browser extension asking for that permission is VERY insecure

The short answer is that the permission which that dialog is asking for gives the browser extension the ability to "read and change all your data on all websites", which really means what it says, and, yes, should be considered a massive security issue. It, effectively, allows the browser extension to do anything it wants to do with respect to the data sent and received from all websites (except some browser-specific sites which the browser itself excludes from being modified). That, effectively, means that if it's possible for you to browse to a site, then the browser extension can do anything on that site that you could do. The browser extension doesn't require you to actually browse to the site, nor display to you what it's doing.

Note: there are still some limitations as to what it can do, but most of those effectively don't really matter for most people.

Are there any permanent risks to my device or would the "worst that could happen" still be ephemeral, affecting only the current view of the page?

Yes, there are permanent risks, if you consider anything you could do on any site to be permanent. On the other hand, the extension shouldn't be able to make permanent changes to your browser (i.e. changes which you can't change back), but may make changes which you don't know you should change back or cause you to do something on your system which does make permanent changes to your system (e.g. change a download that you later install to something else).

No, it doesn't mean that it's only the current view of the page.

What am I really giving up (if anything) if I go ahead and click [Add Extension]?

You're giving up everything that most people care about with respect to the security of their browsing experience. There are things that the browser extension still won't be able to do, but those are mostly browser-internal things. The browser extension won't be able to make changes directly to your system outside your browser, but could change the contents of something you later choose to download and install on your machine.

What I do with such extensions

I do one of the following (when it's not an extension I wrote):

  1. Not install the extension
  2. Download the extension's source code and take a detailed look at what it's actually doing to see if I want to allow it, and then not auto-update. All browser extensions are primarily JavaScript, HTML, and CSS, which is delivered to the browser as source code in a compressed archive, so you can look at the source code for almost everything. If the browser extension makes it hard for you to do so (e.g. minimizing, obfuscation, and/or dynamically loading additional code from the web into sites), then that's usually a big red flag.
  3. Install it in a dedicated browser profile (called "person" in Chrome) with which I've only ever accessed sites for which I don't care if the browser extension has complete access. [Note: if it's a site on which you pay for anything, then the browser extension has access to your payment method and could use that payment method anywhere else that it wanted to. Depending on the site, the browser extension might be able to get the payment method details from the site, even if you've never entered them in that browser profile.]
  4. Hope that the person/people who wrote the extension can be trusted with access to everything.
1
  • Thank you that's exactly what I wanted to know and in my experience "hoping" is a pretty terrible option.
    – IV.
    Commented Feb 8, 2023 at 17:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .