Windows 10: How secure are extensions in browsers?

I'm sure we all use a few (I know I do - BitDefender Traffic Light and Windows Defender Browser Protection), but given the recent news about Avast and AVG hoovering up and on-selling user data without permission, I want to start a discussion about whether, in order to make browsers more usable via extensions, we have no choice but to increase our attack surface exposure.

We know it's good practice to use as few extensions as possible, but even so, a single rogue extension (or a good extension that is hijacked or goes rogue) could make for a bad experience. We are often told to carefully examine the permissions required by extensions in order to use them, but lets be honest, almost every extension (depending on it's purpose) requires your permission to:

- View your browsing history
- Read and modify data you copy and paste (password managers for example)
- Read and change all your data on the websites you visit (adblockers for example)

Judging whether to install extensions based on the above is quite difficult.

So, how do we go about better evaluating whether to use a particular browser extension or not? Do you have any tips or tricks you can share about mitigating the risk?

How can we mitigate against browser AV extensions, that are supposed to provide some security, going rogue?

Given all the work going into browser development to make them more secure, and the ability to use more secure DNS (e.g. quad9), do we even need them?

Lets hear it.

:)

 

TPU 's useful browser extensions

Post your browser and any useful extensions
there is my current daily browser load-out

Browser Chrome
Extensions

• Chrono Download manager

https://chrome.google.com/webstore/...anager/mciiogijehkdemklbdcbfkefimifhecn?hl=en

• Practical start-page

Practical Startpage

• ublock Origin

uBlock Origin

• tampermonkey script manager

Tampermonkey

• TamperMonkey Scripts

youtube control center dev​YePpHa/YouTubeCenter
anti-adblock killer​reek/anti-adblock-killer

 

TPU 's useful browser extensions

Browser: Chrome

Media extensions:

• Floating for YouTube™ + Floating for YouTube™ Extension
• https://chrome.google.com/webstore/detail/hd-for-youtube/akjbfncbadcmnkopckegnmjgihagponf
  
• UltraWide Video
  
• ProxFlow

Productivity extensions:

• Session Buddy
• Reload All Tabs
  
• Speed Dial [FVD]

And of course an adblocker.

 

extension manager

Hi Tony,

A browser extension is a plug-in that extends the functionality of a web browser. If you are referring to extension manager of Microsoft Edge browser. Follow these steps to add an extension for Microsoft Edge:

Note:If you don't have the Windows 10 Anniversary Update or later, this option will not be available.

• Open the Microsoft Edge and type about:flags into the address bar.
• Select the Enable extension developer features checkbox and then
  restart your browser.
• Select More (...) to open the menu.
• Select Extensions from the menu.
• Select the Load extension button.
• Navigate to your extension's folder and select the Select folder button.

Let us know how it goes.