[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

UnDistracted - Hide Facebook, YouTube Feeds

Version 3.6.30 View in Chrome Web Store

Last scanned: about 2 hours ago

Extension Details

Developer: undistracted.app

Rating: 4.7 ★ (596 ratings)

Users: 70,000

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors:

The extension has a solid user base of 70,000 users with a high rating of 4.7 stars from nearly 600 reviews, indicating good user satisfaction. The extension uses Manifest V3, which provides better security controls. The developer maintains a dedicated domain (undistracted.app) and the extension's purpose aligns well with its requested permissions for blocking distracting content on social media platforms.

Concerns:

The webNavigation permission is the primary concern, as it allows comprehensive tracking of your browsing activity across all websites, not just the social media sites the extension claims to target. This creates potential privacy risks if the extension or its servers are compromised. The storage permission, while necessary for saving user preferences, could retain browsing patterns. The Content Security Policy allows connections to an external server (undistracted-server.up.railway.app), creating a dependency on third-party infrastructure.

Recommendations:

Consider running this extension in a separate Chrome profile if you're concerned about privacy, especially given the broad webNavigation access. Monitor the extension's network activity to ensure it only communicates with its declared server. Review the extension's privacy policy to understand what data is collected and stored. Given the high user rating and focused functionality, the risk appears manageable for users comfortable with productivity-focused extensions that require some navigation monitoring to function effectively.

Findings

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

storage
webNavigation

Optional Permissions:

scripting

Content Security Policy:

extension_pages: default-src 'self'; script-src 'self'; object-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; connect-src https://undistracted-server.up.railway.app/

Embedded URLs (32 total):

https://reactjs.org/docs/error-decoder.html?invariant=	http://www.w3.org/1999/xlink
http://www.w3.org/XML/1998/namespace	http://www.w3.org/2000/svg
http://www.w3.org/1998/Math/MathML	http://www.w3.org/1999/xhtml
http://fb.me/use-check-prop-types	https://github.com/theKashey/focus-lock/#focus-fighting
https://fb.me/react-async-component-lifecycle-hooks	http://jedwatson.github.io/classnames
http://momentjs.com/guides/#/warnings/define-locale/	http://momentjs.com/guides/#/warnings/js-date/
http://momentjs.com/guides/#/warnings/min-max/	http://momentjs.com/guides/#/warnings/add-inverted-param/
http://momentjs.com/guides/#/warnings/zone/	http://momentjs.com/guides/#/warnings/dst-shifted/
https://github.com/dcodeIO/bcrypt.js	https://undistracted-server.up.railway.app/getSubscription?email=
https://www.undistracted.app/paddleDirect	https://github.com/cssinjs/jss
https://clients2.google.com/service/update2/crx	https://fonts.googleapis.com
https://fonts.gstatic.com	https://undistracted-server.up.railway.app/
https://www.google.com	https://chrome.google.com/webstore/detail/undistracted/pjjgklgkfeoeiebjogplpnibpfnffkng/reviews
https://www.undistracted.app/notice	https://www.undistracted.app/updated
https://www.facebook.com/?filter=friends&sk=h_chr	https://www.youtube.com/feed/subscriptions
https://undistracted-server.up.railway.app/blocklists	https://www.reddit.com/

Raw Manifest

{
  "name": "UnDistracted - Hide Facebook, YouTube Feeds",
  "icons": {
    "16": "icons/icon16.png",
    "48": "icons/icon48.png",
    "128": "icons/icon128.png"
  },
  "action": {
    "default_icon": {
      "16": "icons/icon16.png",
      "48": "icons/icon48.png",
      "128": "icons/icon128.png"
    },
    "default_popup": "index.html",
    "default_title": "UnDistracted"
  },
  "version": "3.6.30",
  "background": {
    "service_worker": "service_worker.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Rise above the time-sinks",
  "permissions": [
    "storage",
    "webNavigation"
  ],
  "content_scripts": [
    {
      "js": [
        "undistracted-twitter.js"
      ],
      "run_at": "document_start",
      "matches": [
        "*://*.twitter.com/*"
      ]
    },
    {
      "js": [
        "undistracted-youtube.js"
      ],
      "run_at": "document_start",
      "matches": [
        "*://*.youtube.com/*"
      ]
    },
    {
      "js": [
        "undistracted-facebook.js"
      ],
      "run_at": "document_start",
      "matches": [
        "*://*.facebook.com/*"
      ]
    },
    {
      "js": [
        "undistracted-reddit.js"
      ],
      "run_at": "document_start",
      "matches": [
        "*://*.reddit.com/*"
      ]
    },
    {
      "js": [
        "undistracted-netflix.js"
      ],
      "run_at": "document_start",
      "matches": [
        "*://*.netflix.com/*"
      ]
    },
    {
      "js": [
        "undistracted-linkedin.js"
      ],
      "run_at": "document_start",
      "matches": [
        "*://*.linkedin.com/*"
      ]
    }
  ],
  "manifest_version": 3,
  "optional_permissions": [
    "scripting"
  ],
  "externally_connectable": {
    "matches": [
      "https://*.undistracted.app/*"
    ]
  },
  "content_security_policy": {
    "extension_pages": "default-src 'self'; script-src 'self'; object-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; connect-src https://undistracted-server.up.railway.app/"
  },
  "optional_host_permissions": [
    "*://*.instagram.com/*",
    "*://*.x.com/",
    "*://*.pinterest.com/"
  ]
}

by ✦ Astarte