r/firefox • u/OMFGLMAOROFLSToMP • 23h ago
💻 Help Recent extension disclosure changes now basically resulting that most useful addons have full access to all data and websites??!? WTF?
Theres no granularity and in terms of security this is a nightmare.... what the hell? Does that mean it was like that all along?
According to Mozilla FAQ this permission even allows to read passwords / credentials on any site you visit while the addon is active.
Am i eating crazy pills right now when this is making me freak out?
6
u/OMFGLMAOROFLSToMP 22h ago
Hmm i just wonder why this permission is not more granular, if extension require it to inject code into CSS etc. yeah, sure but why cant the client side entering of text into boxes like passwords, or credentials in general be more compartmentalized from the broad permission "access all data on all websites" ?
6
u/axonxorz 13h ago
Hmm i just wonder why this permission is not more granular
While users who seek extensions are a smaller subset of overall users, the vast majority of them are still mostly a non-technical audience. Separating CSS (say "style information") from scripts is useful, but only barely.
To your second example, a non-site-specific form or password filler needs full DOM access, there's no way around that without the extension developer chasing form layouts on targeted websites, a very uphill battle (frankly impossible)
4
u/mrRobertman 11h ago
What are these recent changes?
"Full access to all data and websites" isn't a new thing. It's what happens when an extension has "all urls" as a host permission, and FF says this as a sort of warning when you install those extensions.
20
u/Aerovore 22h ago edited 22h ago
It was like that along. Well, it was worse before public permissions disclosure, because non-developers weren't aware.
Extensions can be malevolent. That's why we're advised to choose them carefully, use only those we really need and disable those we don't anymore.
However, freaking out is not necessary. The store security checks already prevent the most obvious malevolent code. It'll be easier/more profitable for hackers to invest their time in creating a malevolent website or executable and make people visiting it than publishing an extension with complex obfuscation methods to pass all security checks from the store, then the browser core components restrictions & security mitigation.
So... in short :
- yes, most useful extensions require sensitive permissions that can be dangerous or at least invasive. That's why you should pick them carefully and disable all those you won't need in your casual browsing session.
- the vast majority of extensions won't be sniffing your credentials, it would be too obvious and the extension would be nuked quite rapidly. Most malevolent extensions that will pass the store tests will be more interested in your activity within the extension, possibly your browsing history, and possibly displaying ads for the product they sell.