Educause Security Discussion mailing list archives

Re: Firefox as default browser in labs


From: Jacob <jmlistacct () GMAIL COM>
Date: Wed, 10 May 2006 17:11:30 -0400

However, introducing extensions to the mix increases Firefox's attack
surface.  Since extensions have effectively unfettered access to the
system and can interact with web servers, they must be as well vetted
as the browser itself.  For extensions created by untrusted publishers
and extensions that are unsigned, that means a code review for each
revision.

And that assumes there is no way to trick Firefox's update tool into
"upgrading" a legitimate extension with a compromised version

Current thread: