Keeping clients' computers safe and profitable for over 30 years

Beware of Browser Extensions

Preview: Browser extensions can silently turn malicious even after passing initial review. Discover why extensions are risky, which ones are safe to trust, and practical tips to protect your browser from hidden malware.

Extensions are dangerous, so you should avoid them.

They check the original work, but after it is accepted, they cannot check every update. Perfectly good extensions can turn bad for many different reasons. For example, since most extensions are open source, they can be forked. Recently a bad actor grabbed an excellent ad-blocker and made a few modest changes, renamed it, and put it out as their own. They had a bot network download it many times and give it glowing reviews. Because it was really just the original excellent ad-blocker, it worked very well. Then, after it gained momentum, they added malware to take over your machine or shove ads onto your computer. Besides intentional bad actors, even honest extensions can also have security vulnerabilities that allow them to be misused.

You can understand the difficulty of the task by realizing that Firefox has over 500 thousand themes and 74 thousand extensions, while Chrome probably has over 150 thousand extensions. Each of them removes thousands of extensions every year but cannot keep up with every update to every extension.

General Recommendations

1. Install only extensions you genuinely need, preferably from a known vendor.
2. Be highly skeptical of "free VPN,” coupon, downloader, PDF, shopping-helper, wallpaper, and obscure ad-blocker extensions.
3. Remove extensions you no longer use.

My Specific Extension Recommendations

1. If you use a cloud based password manager, you can use the extension for that manager. I use the Bitwarden extension.
2. uBlock Origin or Ublock Origin Light. This is the one from Raymond Hill. It is the only ad-blocker you need.
3. Eset Antivirus Browser Extension. Your antivirus probably has an browser extension to respond to browser issues quicker. Use it. I currently recommend Eset Smart Security Premium.
4. This is all I recommend. No more!

Additional Extensions I Use!

Despite not recommending other extensions, there are sometimes valid reasons for a few. Here are three more I use.

• I use the note-taking app Joplin, and it has a web clipper. I use it to occasionally grab a news article and save it to my Joplin notes.
• Language tool. I pay for this grammar checker so I don't appear to be an illiterate when I do my newsletter or post on Reddit or a support forum. This is the paid subscription to their open-source application.
• Snowflake. This is from the TOR foundation. It allows people living under despotic governments, that prevent access to TOR for anonymous browsing, to access it through my link. Currently one person is doing so; in the last 24 hours, 7 have used my link.

For each of these three extensions, I know and trust the company that makes it and stands behind it. They are all well-known and well respected.