Reply to thread

Message

<blockquote data-quote="Vitali Ortzi" data-source="post: 1113890" data-attributes="member: 57714">That&#039;s correct but specifically attacks coming from sites against extensions are much much harder with changes in mv3 and I will be more concerned about the credentials of the developer being pished like&nbsp; <a href="https://www.bankinfosecurity.com/36-chrome-extensions-compromised-in-supply-chain-attack-a-27207" target="_blank">https://www.bankinfosecurity.com/36-chrome-extensions-compromised-in-supply-chain-attack-a-27207</a>Rather then an attacker exploiting vulnerabilities In an extension used by enterprisesFor further reading about the attack surface extensions&nbsp; have and mitigations that are included in mv3[URL unfurl=&quot;true&quot;]https://github.blog/security/vulnerability-research/attacking-browser-extensions/[/URL]Note attack vector of a grandma or majority of the population isn&#039;t an apt that knows how to attack mv3 extensions built by the&nbsp; top security companies rather&nbsp; more basic pishing , payloads , fake stores etcAbout DNS no they aren&#039;t good enough but they are highly recommended and I will specifically encourage Dns.eu/nextdns or alternatively quad9 for less false positives , better practices</blockquote>

[QUOTE="Vitali Ortzi, post: 1113890, member: 57714"] That's correct but specifically attacks coming from sites against extensions are much much harder with changes in mv3 and I will be more concerned about the credentials of the developer being pished like [URL]https://www.bankinfosecurity.com/36-chrome-extensions-compromised-in-supply-chain-attack-a-27207[/URL] Rather then an attacker exploiting vulnerabilities In an extension used by enterprises For further reading about the attack surface extensions have and mitigations that are included in mv3 [URL unfurl="true"]https://github.blog/security/vulnerability-research/attacking-browser-extensions/[/URL] Note attack vector of a grandma or majority of the population isn't an apt that knows how to attack mv3 extensions built by the top security companies rather more basic pishing , payloads , fake stores etc About DNS no they aren't good enough but they are highly recommended and I will specifically encourage Dns.eu/nextdns or alternatively quad9 for less false positives , better practices [/QUOTE]

Verification