Security and Permissions in ‘Missing e’

I think it would be helpful to post about the security and permissions warnings on the Missing e installer pages. To explain them, I’ll use the warnings on the Chrome Store installation page (although a lot of this applies to the Safari and Firefox versions of Missing e)

The warnings say: “This extension can access: * Your data on all websites * Your browsing history * Your list of installed apps, extensions, and themes.”

Your data on all websites

The Chrome Web Store Help says this:

This item can read every page that you visit — your bank, your web email, your Facebook page, and so on. Often, this kind of item needs to see all pages so that it can perform a limited task such as looking for RSS feeds that you might want to subscribe to.

In addition, the Chrome Web Store Help also says this:

Besides seeing all your pages, this item could use your credentials (cookies) to request your data from websites.

What Missing e uses this permission for:

The permissions information on the Chrome Web Store site tells you the most that an extension is capable of doing.

In order to load information from Tumblr pages, Missing e must ask to be able to read information from any web domain. This is because, otherwise, it would not be possible for Missing e to load timestamps for messages in your inbox, a special code for a post needed to reblog yourself and a post’s tags for the Better Reblogs reblog tags option, as well as a number of other things for Tumblr blogs that have custom domains (like this one: http://blog.missinge.infraware.ca).

As for using your credentials (cookies), this means that when Missing e accesses Tumblr in the background, it does so using the same credentials that your browser automatically uses every time you load a Tumblr page. This is automatic. If Missing e did not do so, it would not be able to access anything on your Tumblr. From Missing e’s perspective, it would be as if you were not logged into Tumblr. Let me stress that Missing e does not read your password, it only uses the credentials that tell Tumblr that you are currently logged in.

Just because an extension asks for these permissions does not mean it uses all of it!

Missing e does not access any data outside of www.tumblr.com, EXCEPT to get information from Tumblr-related pages and to check if there’s a new version of Missing e available.

Your browsing history

The Chrome Web Store Help says this:

This item could look at your browsing history. This warning is often a by-product of an item needing to open new tabs or windows.

What Missing e uses this permission for:

Pretty much exactly what that last bit from the Help says. Missing e uses this permission in order to open new tabs in your browser (for the Dash Links To Tabs feature, Reply Replies, Post Crushes, as well as opening the Missing e settings page).

I’m not entirely sure why opening tabs is linked to your browsing history, but that’s the way the browser is coded, I guess.

Your list of installed apps, extensions, and themes

The Chrome Web Store Help says this:

This item can read the list of themes, extensions, and apps that you have installed. It can’t install items, but it might enable, disable, uninstall, or launch items that you’ve installed.

This only applies to the Google Chrome version of Missing e. It checks if you have any of the my old userscripts (that were replaced by Missing e) and asks you if you want to disable them for compatibility. It will not disable anything without your okay.

You don’t have to take my word for it. The Missing e code is open source and freely-available to examine and download for yourself on github.

Source: missinge.infraware.ca

128 Notes/ Hide