Can browser extensions see my bank account?
Hi everyone, Leo Notenboom here
for Askleo.com. If you're not already a subscriber to my weekly newsletter,
you might want to head over to newsletter.askleo.com and sign up today.
You'll get useful articles every week in your inbox every Tuesday.
So the question here is very simple.
"I read an article on How to Geek and I am
somewhat alarmed that my few browser extensions may pose a security risk.
I currently use Adblock, https everywhere.
Chrome audio capture. Go full page,
full page, screen capture, Last Pass and Adobe Acrobat."
So I think it's one of the most important
things that we so frequently fail to consider whenever we install
anything on our machine that goes for browser extensions as well
as every application you choose to install.
By and large, they can do a lot.
We're basically trusting them not to do more than they say they will.
Browser extensions, also called add ins or plug ins, are basically pieces of code
software that you can install into your browser that provide additional
functionality, that your browser may not have, or extend some of the functionality
that it does have. Lastpass is a great example.
Lastpass is the browser extension I have installed that automatically both captures
usernames and passwords, but also fills them in for me.
When I come to a site that I've been to before and it's saved my password
from a previous visit, it makes life a lot easier.
It, of course, enables safe, secure, long, strong and unique passwords.
But when you think about it,
what Lastpass had to be able to do is kind of scary.
A browser extension was able to see the password that I supplied to a website.
It had to in order to capture it, but it was able to see it. An extension,
a Browser extension was able to see
my password, even if it was all asterisks on the screen
and there's nothing special about Lastpass,
any browser extension could potentially, if they choose to, see what you're typing.
See what the page looks like.
See what the password is, even if all you see are asterisks.
That's why only installing extensions
from sources that you absolutely trust is critical.
We trust that the browser extensions we
use aren't doing more than they say they are.
And the reason we have to trust them is
because in many cases they could do just about anything.
So to answer your question,
can the browser extensions on your machine see your banking?
Sure, absolutely.
Chances are they have required or requested a permission of some sort
in order to do whatever it is they need to do.
Generally, that permission then includes
the ability to see the current Web page, whatever the current Web page might be.
Visiting your bank online is nothing more
than visiting some Web pages provided by your bank.
There's a very good chance that most of the extensions you have installed
on your PC have the ability to watch your banking.
Now, the question, of course, is do they?
And the answer there is: I don't know. The answer
there really is: only install extensions from places you trust.
So given that browser extensions have so
much opportunity to at least look at the various things that are happening
in our browser, it's critical
that you only install browser extensions from sources you trust.
If you're not sure, don't install it.
It's that simple.
And to be clear, we're talking here about browser extensions because they are a very
lightweight thing that you can add to almost any browser to provide actually
some very interesting and useful functionality from time to time.
But the same thing really applies to any software you install on your machine.
You, by definition, are trusting whoever is providing you
with that software that they are going to do only what they say they're going
to do and they're not going to have the opportunity or rather take
the opportunity to poke around where they shouldn't.
And when you think about it, that's the nature of using computers.
By definition, we must trust the operating system.
If you can't trust the operating system, you're done.
There's nothing you can do.
You need another operating system that you
can trust. Your browser, the programs you have installed,
they all have access to a tremendous amount of information on your computer.
If they are not trustworthy, then you shouldn't have to.
It really is that simple.
And it applies particularly to browser
extensions where perhaps we're not always thinking with that same security mindset.
I hope that was helpful.
Shouldn't scare you too much.
You should already be installing only things from sources that you trust.
But it's a good reminder.
For updates, links, comments and more, visit askleo.com/131915.
I'm Leo Notenboom.
This is Askleo.com.