[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Authenticator

Version 8.0.1 View in Chrome Web Store

Last scanned: about 4 hours ago

Extension Details

Developer: http://authenticator.cc/

Rating: 3.6 ★ (2.5K ratings)

Users: 10,000,000

Context-Aware Verdict

HIGH

Overall Risk

Based on 4 total findings, including 2 high-risk findings.

Findings

HIGH

High-Risk Permission: identity

This extension has the identity permission. Can access your identity information. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe JavaScript Evaluation

This extension's Content Security Policy allows 'unsafe-eval', which permits dynamic JavaScript code execution using eval() and similar functions. This is a significant security risk as it could allow execution of malicious code.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

activeTab
storage
identity
alarms
scripting

Optional Permissions:

clipboardWrite
contextMenus

Content Security Policy:

extension_pages: script-src 'self'; font-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; connect-src https://www.google.com/ https://*.dropboxapi.com https://www.googleapis.com/ https://accounts.google.com/o/oauth2/revoke https://login.microsoftonline.com/common/oauth2/v2.0/token https://graph.microsoft.com/; default-src 'none'
sandbox: sandbox allow-scripts; script-src 'self' 'unsafe-eval';

Embedded URLs (125 total):

https://content.dropboxapi.com/2/files/upload	https://api.dropboxapi.com/2/users/get_current_account
https://www.googleapis.com/drive/v3/files	https://www.googleapis.com/auth/drive.file
https://www.googleapis.com/oauth2/v4/token?client_id=292457304165-v92d8om5dckuu0hk1s4ki3r94muisvsg.apps.googleusercontent.com&client_secret=3tRd4462fbfKjgzHS4CEI_Hh&refresh_token=	https://www.googleapis.com/drive/v3/files/
https://www.googleapis.com/upload/drive/v3/files?uploadType=multipart	https://www.googleapis.com/drive/v2/about?fields=user
https://graph.microsoft.com/v1.0/me/drive/special/approot	https://login.microsoftonline.com/common/oauth2/v2.0/token
https://graph.microsoft.com/v1.0/me/drive/special/approot:/	https://graph.microsoft.com/v1.0/me/
https://www.dropbox.com/oauth2/authorize?response_type=token&client_id=mmx38seexw3tvps&redirect_uri=	https://authenticator.cc/oauth-edge
https://authenticator.cc/oauth	https://accounts.google.com/o/oauth2/v2/auth?response_type=code&access_type=offline&client_id=292457304165-v92d8om5dckuu0hk1s4ki3r94muisvsg.apps.googleusercontent.com&scope=https%3A//www.googleapis.com/auth/drive.file&prompt=consent&redirect_uri=
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=60f5b580-663b-42b2-9026-1862182b5582&response_type=code&redirect_uri=	https://www.googleapis.com/oauth2/v4/token?client_id=292457304165-v92d8om5dckuu0hk1s4ki3r94muisvsg.apps.googleusercontent.com&client_secret=3tRd4462fbfKjgzHS4CEI_Hh&code=
https://otp.ee/chromeissues	http://www.apache.org/licenses/LICENSE-2.0
http://tools.ietf.org/html/rfc5280	http://tools.ietf.org/html/rfc3279
http://tools.ietf.org/html/rfc4357	http://tools.ietf.org/html/rfc2898
http://tools.ietf.org/html/rfc5208	http://base.garant.ru/70133464/#ixzz4KaOTGI1l
http://tools.ietf.org/html/rfc4491	http://tools.ietf.org/html/rfc2986
http://tools.ietf.org/html/rfc5755	http://tools.ietf.org/html/rfc3281
http://tools.ietf.org/html/rfc5652	http://tools.ietf.org/html/rfc4490
http://tools.ietf.org/html/rfc7292	http://tools.ietf.org/html/rfc4211
http://tools.ietf.org/html/rfc5272	http://tools.ietf.org/html/rfc5830
https://tools.ietf.org/html/rfc2268	http://www.w3.org/TR/WebCryptoAPI/#algorithm-dictionary
http://www.w3.org/TR/WebCryptoAPI/#key-algorithm-interface	http://www.w3.org/TR/WebCryptoAPI/#key-interface
http://www.w3.org/TR/WebCryptoAPI/#keypair	http://www.w3.org/TR/WebCryptoAPI/#subtlecrypto-interface
http://www.w3.org/TR/WebCryptoAPI/#SubtleCrypto-method-encrypt	http://www.w3.org/TR/WebCryptoAPI/#SubtleCrypto-method-decrypt
http://www.w3.org/TR/WebCryptoAPI/#SubtleCrypto-method-sign	http://www.w3.org/TR/WebCryptoAPI/#SubtleCrypto-method-verify
http://www.w3.org/TR/WebCryptoAPI/#SubtleCrypto-method-digest	http://www.w3.org/TR/WebCryptoAPI/#SubtleCrypto-method-generateKey
http://www.w3.org/TR/WebCryptoAPI/#SubtleCrypto-method-deriveKey	http://www.w3.org/TR/WebCryptoAPI/#SubtleCrypto-method-deriveBits
http://www.w3.org/TR/WebCryptoAPI/#SubtleCrypto-method-importKey	http://www.w3.org/TR/WebCryptoAPI/#SubtleCrypto-method-exportKey
http://www.w3.org/TR/WebCryptoAPI/#SubtleCrypto-method-wrapKey	http://www.w3.org/TR/WebCryptoAPI/#SubtleCrypto-method-unwrapKey
https://www.streebog.net/	http://tools.ietf.org/html/rfc6986
http://tools.ietf.org/html/rfc5831	https://tools.ietf.org/html/rfc3174
http://tools.ietf.org/html/rfc5832	http://tools.ietf.org/html/rfc7091
http://www-cs-students.stanford.edu/~tjw/jsbn/	http://www-cs-students.stanford.edu/~tjw/jsbn/jsbn.js
http://www-cs-students.stanford.edu/~tjw/jsbn/jsbn2.js	http://www-cs-students.stanford.edu/~tjw/jsbn/ec.js
http://blog.tinisles.com/2011/10/google-authenticator-one-time-password-algorithm-in-javascript/	https://github.com/Sneezry
https://github.com/Authenticator-Extension/Authenticator/issues/412	https://www.googleapis.com/oauth2/v4/token?client_id=
https://stackoverflow.com/a/56483156	https://www.dropbox.com/oauth2/authorize?response_type=token&client_id=
https://accounts.google.com/o/oauth2/v2/auth?response_type=code&access_type=offline&client_id=	https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=
https://github.com/edi9999/jsqrcode/blob/master/test/qrcode.js	http://en.wikipedia.org/wiki/Bresenham
http://www.w3.org/1999/xlink	http://www.w3.org/2000/svg
http://www.w3.org/1998/Math/MathML	https://otp.ee/otpbackup
https://flow.org/blog/2017/05/07/Strict-Function-Call-Arity/	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is#polyfill

Page 1 of 2

Raw Manifest

{
  "name": "__MSG_extName__",
  "icons": {
    "16": "images/icon16.png",
    "48": "images/icon48.png",
    "128": "images/icon128.png"
  },
  "action": {
    "default_icon": {
      "19": "images/icon19.png",
      "38": "images/icon38.png"
    },
    "default_popup": "view/popup.html",
    "default_title": "__MSG_extShortName__"
  },
  "oauth2": {
    "scopes": [
      "https://www.googleapis.com/auth/drive.file"
    ],
    "client_id": "292457304165-u8ve4j79gag5o231n5u2pdtdrbfdo1hh.apps.googleusercontent.com"
  },
  "sandbox": {
    "pages": [
      "view/argon.html"
    ]
  },
  "storage": {
    "managed_schema": "schema.json"
  },
  "version": "8.0.1",
  "commands": {
    "scan-qr": {
      "description": "Scan a QR code"
    },
    "autofill": {
      "description": "Autofill the matched code"
    },
    "_execute_action": {}
  },
  "background": {
    "service_worker": "dist/background.js"
  },
  "options_ui": {
    "page": "view/options.html",
    "open_in_tab": false
  },
  "short_name": "__MSG_extShortName__",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_extDesc__",
  "permissions": [
    "activeTab",
    "storage",
    "identity",
    "alarms",
    "scripting"
  ],
  "default_locale": "en",
  "manifest_version": 3,
  "optional_permissions": [
    "clipboardWrite",
    "contextMenus"
  ],
  "content_security_policy": {
    "sandbox": "sandbox allow-scripts; script-src 'self' 'unsafe-eval';",
    "extension_pages": "script-src 'self'; font-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; connect-src https://www.google.com/ https://*.dropboxapi.com https://www.googleapis.com/ https://accounts.google.com/o/oauth2/revoke https://login.microsoftonline.com/common/oauth2/v2.0/token https://graph.microsoft.com/; default-src 'none'"
  },
  "optional_host_permissions": [
    "https://www.google.com/",
    "https://*.dropboxapi.com/*",
    "https://www.googleapis.com/*",
    "https://accounts.google.com/o/oauth2/revoke",
    "https://graph.microsoft.com/me/*",
    "https://login.microsoftonline.com/common/oauth2/v2.0/token"
  ]
}

by ✦ Astarte

Authenticator

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Optional Permissions:

Content Security Policy:

Embedded URLs (125 total):

Raw Manifest

Detections

Manifest Findings