[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Random Student Generator for Google Classroom

Version 0.0.19 View in Chrome Web Store

Last scanned: about 2 months ago | force re-scan

Extension Details

Rating: 3.2 ★ (10 ratings)

Users: 2,000

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors:

The extension has a relatively small user base of 2,000 users and a modest 3.2-star rating from only 10 reviews, which suggests limited adoption and mixed user satisfaction. The lack of clear author and developer information raises transparency concerns. The educational purpose of randomly selecting students in Google Classroom appears legitimate, but the implementation raises security questions.

Concerns:

The most significant concern is the identity permission, which allows access to your Google account information - this seems excessive for a simple student selection tool. The broad host permissions (http://*/* and https://*/*) grant access to all websites, which is unnecessary for a Google Classroom-specific extension. The combination of identity access with broad web permissions creates potential for data harvesting or account compromise. The extension uses the older Manifest V2, which has weaker security protections than the current V3 standard.

Recommendations:

Consider running this extension in a separate Chrome profile to isolate it from your main browsing and Google accounts. Look for alternative student selection tools that require fewer permissions or are built directly into Google Classroom. If you must use this extension, regularly review your Google account permissions and monitor for any suspicious activity. Consider switching to a more established extension with better ratings and clearer developer credentials once available.

Findings

HIGH

High-Risk Permission: identity

This extension has the identity permission. Can access your identity information. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Older Manifest Version

This extension uses Manifest Version 2, which has fewer security restrictions than Manifest V3. Consider using extensions that have upgraded to V3.

Security Analysis Details

Required Permissions:

identity
activeTab
storage
http://*/*
http://*/
https://*/

Content Security Policy:

script-src 'self' https://ssl.google-analytics.com; object-src 'self'

Embedded URLs (31 total):

https://fonts.googleapis.com/icon?family=Material+Icons	https://classroom.googleapis.com/v1/courses?courseStates=ACTIVE&teacherId=me
https://classroom.googleapis.com/v1/courses/	http://materializecss.com
https://raw.githubusercontent.com/Dogfalo/materialize/master/LICENSE	http://fian.my.id/Waves
https://github.com/fians/Waves/blob/master/LICENSE	http://polymer.github.io/LICENSE.txt
http://polymer.github.io/AUTHORS.txt	http://polymer.github.io/CONTRIBUTORS.txt
http://polymer.github.io/PATENTS.txt	https://github.com/Polymer/platform/issues/53.
http://amsul.github.io/pickadate.js	http://www.gsuitelikea.pro
http://gsuitelikea.pro/	https://github.com/js-cookie/js-cookie
http://www.w3.org/2000/svg	http://www.sitepoint.com/javascript-generate-lighter-darker-color
https://github.com/limonte/sweetalert2/wiki/Migration-from-SweetAlert-to-SweetAlert2#1-ie-support	https://limonte.github.io/sweetalert2/#ajax-request
http://stackoverflow.com/q/39626302/1331425	https://stackoverflow.com/a/3809435/1331425
http://stackoverflow.com/a/2345915/1331425	https://github.com/twbs/bootstrap/blob/master/js/modal.js#L279-L286
https://clients2.google.com/service/update2/crx	https://ssl.google-analytics.com
https://www.googleapis.com/auth/classroom.courses.readonly	https://www.googleapis.com/auth/classroom.rosters.readonly
https://www.googleapis.com/auth/classroom.profile.photos	https://ssl.google-analytics.com/ga.js
https://robohash.org/

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsL0vr3R7N3GpaNGCUEc45x0neLRrwT0FlTFx4lEx/XQVFOiwvqmtb810sySC7DTEQ5+1cXNOQ30AzUtiUtayVA8+vm1m4G4+eheXNfP0a1oF3gpPIzc+7mUuVGSwTTwqJYZJzL2l32u5azTLhC9/LtDg4IbFvTNAuQXtJ/WXculYFYgC/HRAICvzHiMce1MD6KYc8lPKJO5p2vo3YqKakLfRp8F57hvMfVxtAP9X8Rux+latN3KnqM1WLkfmOSXnbnKVxrs8mcRytoFjQ+U5g3qK7a0+eoPGP6qL7FJL+creqif4mdwWx6CsUAkM/A/mM1PcjlrcHesYyYey9xUJkQIDAQAB",
  "name": "Random Student Generator for Google Classroom",
  "icons": {
    "16": "icons/icon16.png",
    "48": "icons/icon48.png",
    "128": "icons/icon128.png"
  },
  "author": "Tristan Kirkpatrick - #GSuiteLikeAPro",
  "oauth2": {
    "scopes": [
      "profile",
      "https://www.googleapis.com/auth/classroom.courses.readonly",
      "https://www.googleapis.com/auth/classroom.rosters.readonly",
      "https://www.googleapis.com/auth/classroom.profile.photos"
    ],
    "client_id": "324446680830-7e8jeu6vglt2fjkb5337pupqbj58jgrc.apps.googleusercontent.com"
  },
  "version": "0.0.19",
  "background": {
    "scripts": [
      "background.js"
    ]
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Select a random student from your Google Classroom at the click of a button - keeping students engaged in learning.",
  "permissions": [
    "identity",
    "activeTab",
    "storage",
    "http://*/*",
    "http://*/",
    "https://*/"
  ],
  "browser_action": {
    "default_popup": "popup.html",
    "default_title": "Click here to generate a random student!"
  },
  "manifest_version": 2,
  "content_security_policy": "script-src 'self' https://ssl.google-analytics.com; object-src 'self'"
}

by ✦ Astarte

Random Student Generator for Google Classroom

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Content Security Policy:

Embedded URLs (31 total):

Raw Manifest

Detections

Manifest Findings