search

davidshq / auto-extension-manager

Disables select browser extensions when specific domains are visited, reenables extensions when specific domains are no longer loaded.
4 stars 2 forks source link

Security Challenge: Other extensions could disable Auto Extension Manager #9

Open davidshq opened 1 year ago

davidshq commented 1 year ago

While AEM is able to disable other extensions it is also true that other extensions can disable AEM. AFAIK this is not something we are seeing in the wild currently BUT it easily could be.

If the extension is installed in an enterprise environment by an admin then it won't be easy to disable/remove - however, if it is a normally installed extension it is quite easy to remove.

What options are available?

  1. Individuals could optionally provide an email address and AEM could ping a server regularly to establish it is still installed. If it fails to do so an email could be sent to provided address notifying them of this.
    • ATM this seems like the best option to me.
  2. An application could run outside the browser which serves a similar pinging function.
    • Unfortunately this would suffer from the same issue as the browser - another application could theoretically uninstall it. This is less likely than a browser extension disabling AEM but still entirely possible.
      1. Other options?
davidshq commented 1 year ago

Unfortunately, 2 is likely not an option for several reasons:

  1. It assumes that the extension is always running which means the browser is always running which means the computer is always running when we know that often the browser will not be open, the computer will not be running.
  2. By setting long limits on extension disabled notifications we could get around most of this issue but at that point how useful is the feature? For example, we might need 1+ days absence before we should trigger a notification.

I do not currently have a better idea on this front.