浏览器扩展的安全风险有多大？
现代浏览器更强大的功能之一是软件开发人员能够编写浏览器扩展来增强、修改和调整用户访问的页面。随着我们的生活越来越多地迁移到浏览器上，我们是否有可能面临因安装本质上是恶意的浏览器扩展而造成的巨大隐私和安全漏洞？
我意识到，如果作者没有尝试混淆行为，这些扩展的源代码是可提取和可读的。但这种类型的审查的有效性会受到浏览器鼓励用户保持其扩展程序最新的影响。虽然扩展程序的 1.0 版可能无害，但用户浏览器可能会建议升级到 1.1 版，该版本可能包含恶意代码，可用于从受感染浏览器的屏幕上抓取信息。
作为浏览器扩展的用户和开发者，开发者的声誉是唯一可以向用户保证其浏览活动安全的东西吗？是否有任何机制可以帮助保护用户免受浏览器扩展损坏的影响？
是否有任何最佳实践来开发扩展，以确保用户安装和更新的代码本质上是良性的？
One of the more powerful features of modern day browsers is the ability for software developers to write browser extensions to enhance, modify and tweak the pages visited by the user. As more of our lives migrate onto the browser, aren't we potentially exposing ourselves to a massive privacy and security holes created by the installation of a browser extension that is malicious in nature?
I realize the source code of these extensions is extractable and readable if the author has not made attempts to obfuscate the behavior. But the effectiveness of this type of review is compromised by the browser encouraging users to keep their extensions up to date. While version 1.0 of an extension may be innocuous, a users browser may suggest an upgrade to version 1.1 which could contain malicious code which could be used to scrape information from the screen of the compromised browser.
As both a user and developer of browser extensions, is the developer's reputation the only thing in place to provide assurances to their users that their browsing activity will be secure? Are there any mechanisms in place to help protect users from a compromised browser extension?
Are there any best-practices to develop extensions in a manner that provides users with the assurance that the code they install and update is benign in nature?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
浏览器扩展几乎可以完成用户可以做的任何事情。他们可以发送您的银行密码、读取本地磁盘上的文件、执行命令等。浏览器的安全性不仅取决于浏览器本身，还取决于所有安装的扩展。
Browser extensions can do almost anything user can do. They can send your bank passwords, read files on local disk, execute commands etc. Security of a browser depends not only on browser itself, but also on all installed extensions.
我最近为 Chrome 编写了一些扩展程序，在此之前我不知道扩展程序到底会造成多大的危害。
扩展程序需要权限，但范围非常广泛。任何重要的扩展很可能最终都会请求“完全权限”，而大多数用户只会点击“是”按钮。即使是精通技术的用户也可能会认为这是合法的，我知道我有。
大多数扩展都是免费的。编写代码需要花费时间和金钱，那么开发人员如何收回投资呢？有些人这样做是为了好玩，但 Chrome 网上商店特别询问您是否计划注入添加 - 我只能推断这是扩展开发人员的常见做法。扩展程序还可以充当跟踪 cookie，并将使用统计数据出售给任何人。
编写一个扩展程序来收集您的密码并将其发送给第三方几乎是微不足道的。即使这些密码被“保存”。我的一个扩展有一个合法的用例来修改所有页面上的所有输入字段，我发现 Chrome 会很乐意以纯文本形式粘贴存储的密码。 CC 信息也是如此。
许多扩展包括分析包，以帮助开发人员确定他们的用户是谁、使用了应用程序的哪些部分等等。我认为这是一个合法的用例，但您可能不一定同意。
如果您是开发者，请注意 Chrome 扩展程序可能会显着影响页面加载时间。我自己的扩展程序经过不懈的优化，尽可能做到轻量级，导致所有页面的加载时间增加了 50-200 毫秒。
因此，在我了解了可能发生的情况后，我禁用了 Chrome 中除我自己的扩展程序之外的所有扩展程序。我真的只怀念AdBlock。
I've written a few extensions for Chrome recently, and I had no idea how much harm extensions could really do before that.
Extensions ask for permissions, but these are very broad. Any non-trivial extension would most likely end up asking for "Full Permission", and most users would just bang the "YES" button. Even a tech savvy user may shrug this off as legitimate, I know I have.
Most extensions are free. It costs time and money to code them up, so how are developers getting their investment back? Some do it for fun, but chrome web store specifically asks if you are planning to inject adds - I can only deduce that this is a common practice for extension developers. Extensions could also act as tracking cookies, and sell usage stats to whomever.
It's near trivial to write an extension that would glob up your passwords and send them on to a third party. Even if these passwords are 'saved'. One of my extensions had a legitimate use case to modify all input fields on all pages, and I found out that chrome would just happily paste-in stored passwords in plain text. Same goes for CC information.
Many extensions include analytics packages, to help developers identify who their users are, which parts of the app is used and so forth. I think that this is a legitimate use case, but you may not necessarily agree.
If you are a developer, be advised that Chrome extensions could significantly impact page load times. My own extension, which I tirelessly optimized to be as lightweight as possible, caused all pages to have an additional 50-200ms load time.
So after I've seen what's possible, I've disabled all extensions in Chrome except for my own. I really only miss AdBlock.
Internet Explorer 浏览器帮助程序对象极其不安全。它们基本上允许浏览器运行本机代码，可以是任何东西。我不确定它们现在是否仍然像过去几年一样普遍，但它们是 Internet Explorer 比 Firefox 和其他浏览器安全性低得多的原因之一。
使用 XUL 和 Microsoft 的 Silverlight 插件经过沙盒处理，以尝试防止恶意行为。然而，归根结底，它取决于开发者对任何类型的软件是否被用户认为值得信赖的声誉。即使开发人员没有尝试编写恶意软件，程序中的错误也可能会暴露安全漏洞。
Internet Explorer Browser Helper Objects are extremely unsafe. They basically allow the browser to run native code, which could be anything. I'm not sure if they're still as pervasive now as they were in years past, but they're one of the reasons why Internet Explorer is so much less secure than Firefox and other browsers.
Mozilla style plug-ins using XUL and Microsoft's Silverlight plug-ins are sandboxed to try and prevent malicious behavior. Ultimately it rests on the developer's reputation for any kind of software to be deemed trustworthy by its users, however. Even in cases where the developer is not trying to write malware, bugs in the program may expose security exploits.
这就是为什么您拥有多台机器，如果您买不起新机器，请使用虚拟机来运行大部分内容并监视其行为。这是我至少在做任何事情之前所做的事情。
RnVja3Mgd2l0aCBtZSBmYW0hIGhpdCBtZSB1cCBhdCB0aGVib3NzODkwN0B5YWhv
by5jb20gaWYgeW91IGhhdmUgYW55IHF1ZXN0aW9ucw==
Which is why you have multiple machines, and if you can't afford a new one, use a virtual machine to run most of the stuff and monitor it's behavior. Its what i do atleast before I do anything.
RnVja3Mgd2l0aCBtZSBmYW0hIGhpdCBtZSB1cCBhdCB0aGVib3NzODkwN0B5YWhv
by5jb20gaWYgeW91IGhhdmUgYW55IHF1ZXN0aW9ucw==