Assess safety

[flx2]

Hi all, a question that has not been asked before:
How can I be sure that the extension does not store sensitive data -- such as secret keys, or just usage patterns and stats --
on hosts other than my own? How can I be sure that future versions will be safe as well?
I hope the devs will not take this question as an insult. But I think it is necessary to explain what concepts and procedures are there to make this a trustworthy and privacy aware browser extension.
Thanks,
flx2

[Sneezry]

Hi flx2, Authenticator takes safety very seriously.

1. Authenticator has a strict content security policy (CSP) which limits that the extension can only connect to specific endpoints
   

   Authenticator/manifests/manifest-chrome.json

   Line 68 in 16d6b65

   "content_security_policy": "script-src 'self'; font-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; connect-src https://www.google.com/ https://*.dropboxapi.com https://www.googleapis.com/ https://accounts.google.com/o/oauth2/revoke https://login.microsoftonline.com/common/oauth2/v2.0/token https://graph.microsoft.com/; default-src 'none'"

2. Authenticator sets every connection to external endpoints as optional permission, and when it wants to send data to external endpoints, it must be approved by the user
   

   Authenticator/manifests/manifest-chrome.json

   Lines 60 to 65 in 16d6b65

   	"https://www.google.com/",
   	"https://*.dropboxapi.com/*",
   	"https://www.googleapis.com/*",
   	"https://accounts.google.com/o/oauth2/revoke",
   	"https://graph.microsoft.com/me/*",
   	"https://login.microsoftonline.com/common/oauth2/v2.0/token"

3. The web store has very strict policies to release an extension, every version of the extension must be reviewed by Google, Mozilla and Microsoft before it is available to the public.

4. If the extension changes current permission or security policy in the future, the new version will be disabled by the browser, and its new permission must be reviewed by the user before it is enabled again.

5. Authenticator is an open source project, and its source code can be always reviewed by the community.

[flx2]

Sneezry, thanks! I learn from your reply that, for any browser extension, I must always read the manifest-chrome file first -- rather than rely on user ratings etc. alone. I will make this my routine for all firefox extensions.
I would like to ask you if the plugin uses Google as its oauth2 provider? The presence of a Google hosted oauth2 clientid in said file seemed to indicate that. Now if I want to use 2fa to authenticate, for example, with Github: Would this require some information to flow between Google and Github or my web browser?
Also, I don't understand point 3. of your reply: Compulsory review by Google/Mozilla/Microsoft. The firefox add-ons service (addons.nmozilla.org) marks Authenticator as "not actively reviewed", are you referrring to this or some other review process?
Thanks again,
flx2

[mymindstorm]

Also, I don't understand point 3. of your reply: Compulsory review by Google/Mozilla/Microsoft. The firefox add-ons service (addons.nmozilla.org) marks Authenticator as "not actively reviewed", are you referrring to this or some other review process?

Mozilla does review the extension occasionally to ensure that the extension follows their policies, but provides no guarantee that they will always check new versions immediately. If you are concerned about us hiding malicious code in the published versions of the add-on, I would suggest building it from source.

[Sneezry]

I would like to ask you if the plugin uses Google as its oauth2 provider? The presence of a Google hosted oauth2 clientid in said file seemed to indicate that. Now if I want to use 2fa to authenticate, for example, with Github: Would this require some information to flow between Google and Github or my web browser?

No. Authenticator works offline. It won't connect to any server (event GitHub, though you add it's 2FA secret to the extension) if you do not use 3rd party backup serice or brower built-in sync storage.

The Google oauth2 information you see in manifest is for backing up data to Google Drive service. And you can ignore it if you don't enable Google Drive in backup setting.

Also, I don't understand point 3. of your reply: Compulsory review by Google/Mozilla/Microsoft. The firefox add-ons service (addons.nmozilla.org) marks Authenticator as "not actively reviewed", are you referrring to this or some other review process?

No. I mean reviewed by Google/Mozilla/Microsoft official. They (browser providers) have responsibility to ensure extensions are safe in their extension store.

Here's the example for Chrome:

Also, you can always review extension permissions in extension detail page. Here's an example in Chrome:

[Supreme-SUS]

Does it log anything like usage? I mean does it store the name of website or apps where it's codes were used? And does it save it's generated code?

[Sneezry]

The extension only stores data on your local machine and shares data (for backup purposes) with the websites (Dropbox, Google, and Microsoft) in the above screenshot. No usage data was collected.

[flx2]

Thank you for your answers. Ready to install it in my browser ;)