Reply to thread

Message

<blockquote data-quote="Threadripper" data-source="post: 810510" data-attributes="member: 78223">Thought it would be necessary to mention that lots, and I mean lots of these extensions send every URL you visit straight to the company in plain test (they&#039;ll say it&#039;s &quot;encrypted&quot; because of TLS but to them it&#039;s still plain test) so who knows what they collect and what they do with it - and uselessly if you were the victim of an MiTM attack the attacker would see the URLs you visit twice.The only one I know that doesn&#039;t for sure is Emsisoft Browser Security (<a href="https://blog.emsisoft.com/en/32517/new-in-2018-12-safe-web-browsing-with-emsisoft-browser-security/" target="_blank">source</a>):The image below shows Bitdefender TrafficLight sending a URL in plain text straight to Bitdefender (<a href="https://support.emsisoft.com/topic/30555-my-protection-whats-yours/?do=findComment&amp;comment=190981" target="_blank">source</a>) to highlight the problem, those using these kinds of extensions should check and see if they use hashes or plain text.</blockquote>

[QUOTE="Threadripper, post: 810510, member: 78223"] Thought it would be necessary to mention that lots, and I mean lots of these extensions send every URL you visit straight to the company in plain test (they'll say it's "encrypted" because of TLS but to them it's still plain test) so who knows what they collect and what they do with it - and uselessly if you were the victim of an MiTM attack the attacker would see the URLs you visit twice. The only one I know that doesn't for sure is Emsisoft Browser Security ([URL='https://blog.emsisoft.com/en/32517/new-in-2018-12-safe-web-browsing-with-emsisoft-browser-security/']source[/URL]): The image below shows Bitdefender TrafficLight sending a URL in plain text straight to Bitdefender ([URL='https://support.emsisoft.com/topic/30555-my-protection-whats-yours/?do=findComment&comment=190981']source[/URL]) to highlight the problem, those using these kinds of extensions should check and see if they use hashes or plain text. [/QUOTE]

Verification