Hacker News new | ask | show | jobs
by greenie_beans 2322 days ago
I used to have this exact same fear and never downloaded any extensions bc of that, until I started making browser extensions. Pretty much any useful extension needs the access that prompts that generic message about accessing all the data.

Any extension that's listed on the web stores have to be reviewed for malicious code, and they must do what the listing say they do. So if your browser extension has your passwords, then that extension would be considered a password manager.

The extension probably listens to the IPs of well-known time wasting websites like HN or reddit, then adds a latency to the browsing. Same with an ad blocker -- they know every site you visit but only to compare them with their blacklist of advertising IP addresses.

Of course, you have to trust they aren't doing anything else with that info, which you can probably assume you're mostly safe if you don't need an account to use the extension.

3 comments

I believe only "recommended extensions" for Firefox are tech reviewed, which this one is not.

https://support.mozilla.org/en-US/kb/recommended-extensions-...

According to [0], Mozilla requires all extensions to have a source in human-readable format and runs a test suite on them. They mention "code review" there, but don't say whether it's manual or automatic. I'd love to hear about it from someone who has some experience with the process.

[0] https://extensionworkshop.com/documentation/publish/submitti...

For my extension the review was automatic, and flags things like direct html editing. I only have a few hundred users though, so I'm not sure at what point they decide to do manual reviews.
There's a link to his github in the extension page. You can read his source code: https://github.com/OskarDamkjaer/FirefoxDelayWebpage

most of the relevant code is in https://github.com/OskarDamkjaer/FirefoxDelayWebpage/blob/ma...

It actually matches a regular expression against the URL; I don't think it looks at the IP addresses.