Source
r/software•
ObnoxiousFly

Adblock Plus for Google Chrome - safe?

I know about Chrome's security permissions and all that, and for that reason it's worrying that most extensions require access to "your data on all websites," which means that they could theoretically log your passwords and send them to a central server. I understand why they require it, but of course they could easily be used for other purposes as well.

So my question is - how can we know for sure that an extension is safe? Is the source code for all extensions publicly available, and are they reviewed or monitored by anyone? On a Google discussions post, a Google employee said use extensions that are popular, because if others trust it, then it must be trustworthy! That to me sounds like a logical fallacy without other safeguards in place.

Posted Sep 27, 2011, 4:14 AM UTC · edited

14
ztfee•

how can we know for sure that an extension is safe?

You can't, you have to trust it somehow (large number of users => large number of potential source-code reviews)

Is the source code for all extensions publicly available

I guess so, it should be written in JS after all.

and are they reviewed or monitored by anyone?

They could be, but you can do it too.

2
m3talfingers•

I think adblock (non plus is better) it's a different company. These will not block certain streaming ads like on solomid.net for livestream gaming, for example.

1
TitoDriscollseyJr•

(On each chrome extension page, the download is a CRX file). The CRX file of the Chrome extension is just a renamed ZIP file, which you can download and rename and extract to view the contents. You can then go through the directory looking at the files (source code) and determine if its safe. But as others have said, its often a leap of faith, and you give your trust in them that its on the up-and-up. And the more users, the more you would believe its safe.

How can we know for sure a Firefox extension is safe? Or an Opera extension? Not all places check a script to make sure its not somehow malicious. Certain app stores had some apps removed that were actually malicious (that people had actually downloaded). However, by totally controlling extensions and apps, we would stifle creativity, so there has to be some leeway. And because most of the extensions come with source code, you can check for yourself what each does. And if you really don't feel safe or comfortable, don't use it.

1
CryBabyRape•

Leap of faith...no way to really know. Unless you get a packet sniffer and monitor your traffic closely, which I don't know much about.

On a related note, I'd recommend using both ABP and regular Adblock for Chrome.

-1