[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

National Internet Observatory

Version 1.1.23.8 View in Chrome Web Store

Last scanned: about 4 hours ago

Extension Details

Developer: nationalinternetobservatory.org

Rating: 4.4 ★ (84 ratings)

Users: 6,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: The extension has a moderate user base of 6,000 users and a solid 4.4-star rating from 84 reviews, suggesting generally positive user experiences. The developer domain "nationalinternetobservatory.org" appears to be research-oriented, which could indicate legitimate academic or monitoring purposes. However, the relatively small user base for such broad permissions raises some concerns about widespread adoption and scrutiny.

Concerns: The combination of webNavigation permissions with broad host access to all websites creates significant privacy risks. The extension can track your complete browsing behavior across the entire internet, not just specific sites. The unlimitedStorage permission allows indefinite data collection, which combined with navigation tracking could build comprehensive user profiles. These permissions seem excessive unless the extension's core function genuinely requires monitoring all web activity. The lack of detailed description makes it difficult to verify if these permissions align with stated functionality.

Recommendations: Given the high-risk permissions, consider running this extension in a separate Chrome profile dedicated to research or monitoring activities if you must use it. Regularly review what data might be collected and stored locally. If the extension's purpose doesn't clearly justify tracking all your web navigation, consider alternatives with more limited permissions. Monitor your browsing performance and data usage, as unlimited storage could impact system resources over time.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

webNavigation
storage
unlimitedStorage
activeTab
scripting
alarms

Host Permissions:

http://*/*
https://*/*

Embedded URLs (64 total):

https://stackoverflow.com/questions/46155/whats-the-best-way-to-validate-an-email-address-in-javascript	https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/webNavigation/TransitionType
https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/webNavigation/TransitionQualifier	https://www.google.com/search?q=hello+world
https://www.amazon.com/s?k=hello+world+socks	https://chromewebstore.google.com
https://developer.chrome.com/docs/extensions/reference/webNavigation/	http://www.apache.org/licenses/LICENSE-2.0
http://code.google.com/p/arc90labs-readability	https://developer.mozilla.org/en-US/docs/Web/API/Node/nodeType
https://en.wikipedia.org/wiki/Comma#Comma_variants	https://schema.org/Article
https://github.com/whatwg/html/issues/4275	http://mobile.slate.com
https://developer.mozilla.org/en-US/docs/Web/Guide/HTML/Content_categories#Phrasing_content	https://searchfox.org/mozilla-central/rev/f82d5c549f046cb64ce5602bfd894b7ae807c8f8/accessible/generic/TableAccessible.cpp#19
https://github.com/jsdom/jsdom/issues/2580	https://drive.google.com/drive/folders/1nWvjYGdvKjDkJpNpZGLZrgKn5Bnq9fRr?usp=sharing
https://drive.google.com/drive/folders/1u94AFbDhtHRK1oCbvQ9t3fHBXFbz0wjq?usp=drive_link	https://www.lowes.com/
https://www.lowes.com/s?searchTerm=...	https://www.lowes.com/search?searchTerm=
https://www.twitch.tv/directory	https://github.com/firebug/firebug/blob/master/extension/content/firebug/lib/xpath.js
https://dom.spec.whatwg.org/#mutation-observers	https://www.target.com/
https://www.target.com/s?searchTerm=...	https://www.target.com/s?searchTerm=
https://drive.google.com/drive/folders/12Ny5qEnVRvnPK2hfWCntHMy_s9c6ekbx?usp=share_link	https://drive.google.com/drive/folders/1rkF0m_vzUlUzGbKn9E_q9WC5j_kO_n_W?usp=share_link
https://drive.google.com/drive/folders/1jLXhCs9tHKvJhcdtpfJKHBwRrT5jY7U4?usp=drive_link	https://drive.google.com/drive/folders/1DzVpN5giYAeZFTiTjbQ0eKv2i5VhhLIx?usp=share_link
https://www.linkedin.com/jobs/collections/recommended/?currentJobId=4195239032&...	https://developers.google.com/privacy-sandbox/relevance/topics/developer-guide
https://developer.mozilla.org/en-US/docs/Web/API/Document/cookie	https://drive.google.com/drive/folders/11Y28AQNf7gqdtHcYRYx2V7bkiOgOfx6q?usp=share_link
https://www.walmart.com/	https://www.walmart.com/search?q=
https://www.walmart.com/search	https://github.com/w3c/IndexedDB/issues/291
https://w3c.github.io/IndexedDB/#transaction-scheduling	https://nationalinternetobservatory.org
https://a8f033f6cc74e1f06979ada7f8118916@sentry.nationalinternetobservatory.org/3	https://nationalinternetobservatory.org/
https://nationalinternetobservatory.org/about-us.html	https://www.nsf.gov/awardsearch/showAward?AWD_ID=2131929
https://nationalinternetobservatory.org/faq.html	https://nationalinternetobservatory.org/privacy-policy.html
https://nationalinternetobservatory.org/terms-of-service.html	https://getbootstrap.com/
https://github.com/twbs/bootstrap/blob/main/LICENSE	http://www.w3.org/2000/svg
https://d3e54v103j8qbb.cloudfront.net/static/custom-checkbox-checkmark.589d534424.svg	http://stackoverflow.com/questions/16092114/background-size-differs-in-internet-explorer
https://nationalinternetobservatory.org/browser-extension-guide.html	https://privacysandbox.com/
https://play.google.com/store/apps/details?id=org.nationalinternetobservatory.mobile&hl=en-US&pli=1	https://testflight.apple.com/join/PjF9xFFs
https://gist.github.com/shinout/1232505	https://stackoverflow.com/questions/38552003/how-to-decode-jwt-token-in-javascript-without-using-a-library
https://clients2.google.com/service/update2/crx	https://neu.co1.qualtrics.com/jfe/form/SV_3X9Gro3xRpcLqR0
https://neu.co1.qualtrics.com/jfe/form/SV_1UqSRAcFytynYPk	https://neu.co1.qualtrics.com/jfe/form/

Raw Manifest

{
  "name": "National Internet Observatory",
  "icons": {
    "16": "icons/National-Internet-Observatory_logo_icon_16x16.png",
    "48": "icons/National-Internet-Observatory_logo_icon_48x48.png",
    "128": "icons/National-Internet-Observatory_logo_icon_128x128.png"
  },
  "action": {
    "default_icon": "icons/National-Internet-Observatory_logo_icon_48x48.png",
    "default_popup": "ui/popup.html",
    "default_title": "National Internet Observatory"
  },
  "author": "The National Internet Observatory Team",
  "version": "1.1.23.8",
  "background": {
    "type": "module",
    "service_worker": "background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "This extension implements a user study. It collects web usage data and snapshots of web pages from your browser.",
  "permissions": [
    "webNavigation",
    "storage",
    "unlimitedStorage",
    "activeTab",
    "scripting",
    "alarms"
  ],
  "homepage_url": "https://nationalinternetobservatory.org",
  "devtools_page": "devtools/index.html",
  "default_locale": "en",
  "host_permissions": [
    "http://*/*",
    "https://*/*"
  ],
  "manifest_version": 3
}

by ✦ Astarte

National Internet Observatory

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (64 total):

Raw Manifest

Detections

Manifest Findings