How secure are extensions in browsers?

Good questions Golden!

Golden said:

We know it's good practice to use as few extensions as possible, but even so, a single rogue extension (or a good extension that is hijacked or goes rogue) could make for a bad experience.

Hi Golden. I think that's the best practice of all. In my view, the fewer extensions you install, the safer you are. Most people dont realize that extensions have same rights as the browser and can do everything the browser is allowed to do. It can read your personal files, steal your credentials and phone home your sensitive information and data.

Installing only extensions that have been around for a long time and extensions that have a lot of users are good tell tale signs that an extension can be trusted. I only install NoScript in Firefox, and personally, I would feel restless if I installed a bunch of extensions as some people do.

Other things that are important is also where you get the extension. For Firefox and Chromium browser is best to get them from Mozilla and the Chrome store. I think Mozilla extensions are more trustable than the ones in the Chrome store. For some reason it seems is easier to publish a rogue Chrome extensions at the Chrome store than for Mozilla to approve it.

But regardless of what I just said, it is safer to install extensions that are approved by Mozilla and Google. I would never install any extension that's not approved by Mozilla or Google for their browsers.

And read comments. Extensions that have lot of users, there is a lot to read about. What other users say is helpful. I never used any Chromium based browser before, until now with new Edge. I think I am going to like it, certainly more than the old one as I never used the old one. I never used old Edge because you couldn't run it sandboxed under Sandboxie and you couldn't use NoScript with it. That killed old Edge for me. With the new Edge you can, so the change is a big win for me. But anyway, for Edge, other than installing NoScript, I have the need for a bookmarks sidebar, and found an extension. It took me a few days before I installed it in my real system, but after following the process I wrote here, I installed it and feel confident that is a good extension.The point here is, that I pondered about whether it was safe or not to install this extension. You have to do some thinking before you install anything (whether is an extension or a program), that's the safe and proper thing to do when you install anything in a computer.

Bo

Golden said:

True, but sometimes I wonder if even that is enough.

The safest thing to do is to basically lock down the computer. Thats what I do. When I get a computer, I know what I want, I know the programs well, install them, and don't switch or add programs, unless you have to. Since the day I got my W10 in July 2017, the only extension or new program I installed was the Bookmarks sidebar extension I mentioned in my previous post. To me is easy to lock down the computer because I dont have the urge to try programs or extensions. But most people can not do that. People like that need a process they should follow before installing anything. What I wrote in my previous post is my process, the one I follow and know it works for me. No one should install extensions just because they sound nice or because their cousin told them it works great, etc, in my opinion, this are not good reasons for assuming that installing an extension is safe.

In the past, this is not needed much anymore, and I did this to avoid installing the extension in my real system, when I needed to use Flash, I would install the plugin in a sandbox, and use it only during that browsing session. When I finished, I would delete the sandbox. I still do that with a YouTube video downloader. If I want to download a video from YouTube and cant be done using an Online Video downloader, I install the extension sandboxed, and delete the sandbox when is over. It takes seconds and you avoid installing the extensions in your browser.

Bo

Golden said:

So, how do we go about better evaluating whether to use a particular browser extension or not? Do you have any tips or tricks you can share about mitigating the risk?

Unless I'm wrong, browser extensions unlike desktop apps are not digitally signed (ie. do not include certificate),
the only way we know it's trusted is when installing it from browser store such as google store or MS store.

But that's it, afterwards, later, there is no such thing as right click your extension and check if't still signed and thus trusted because it's not signed, extension could have been tampered at any point. This can't happen to desktop apps because of obvious reasons and that is the signature will no longer be valid.

What can we do about this?
I suppose manually work is needed to implement some checking of extension, but
the easiest way would probably be to reinstall both browser and extension again.
If that's not enough, then making a new windows account, should do the trick to regain trust.
Unless a user works on administrative account, then all bets are off anyway.

Other parts of your post such as, how many extensions to install and whether to install some extension,
the answer is obvious, my rules are as follows:
1. maximum 2-3 extensions
2. extension *must* be open source

I want to see what the extension does, and if I need to troubleshoot anything, it should be easier to point a finger
at some extension if you have only 1 or 2 extensions.

ATM, I use only ublock origin in Edge-Chromium:
GitHub - gorhill/uBlock: uBlock Origin - An efficient blocker for Chromium and Firefox. Fast and lean.
And yes, I regularly delete my Windows account and switch to new account, to eliminate non administrative spyware and
other malware that could expose my data or privacy.

As safe as the developers wanted them to be... They could be pretty safe or they could be REALLY bad. It all comes down to the kind of permissions they need and the reputation and intentions of the developer...

You basically have no control over it.