Extensions are an amazing way to customize your Chrome experience, but some of them ask for a lot of data for no apparent reason. I talked with programmer Joe Flores and Meldium co-founder Boris Jabes to get insight into how permissions work, and see if it’s something you should be worried about or not.
Why Chrome Extensions Need Permissions
Chrome extensions use permissions to tell you exactly what data they’re accessing on web sites you visit. Extensions have 10 different permissions ranging from “your physical location” to “all data on your computer and the websites you visit.” They’re divided into three alert levels: High (access to everything online and on your computer), Medium (access to most data on web sites), and Low (access to very specific things like bookmarks, history, or location).
For example, an extension like Pocket needs access to “Your data on all websites,” and “your tabs and browsing activity.” This sounds like a lot, but since Pocket is a read-it-later service it needs those permissions just to operate. Without them, it couldn’t save the URL link from the site you’re on.
So, why do some extensions need broader access than others? Jabes notes that part of the issue is just the wording Chrome uses:
Chrome’s warnings when you install an extension are overly conservative in their text. For example, one of the extensions I use, ChromeReload, is a very simple tool that asks for “Your data on all websites” and “Your tabs and browsing activity.” All it needs is to attach a marker on each tab that keeps track of when it was last reloaded, but Chrome doesn’t provide a “polite” prompt for this.
Simply put, Chrome doesn’t offer any granularity with permissions requests—it’s an all-or-nothing approach for extension makers, and sometimes the broader permission requests are just easier to program for.
When You Should Be Careful About What Extensions You Install
Chrome’s permissions warning are vague enough to cause alarm when you install pretty much any extension out there, so it’s good to pay attention to what you’re doing. For the most part, common sense rules here: if an extension is asking for unreasonable permissions that don’t make any sense, you probably don’t want to install it.
That said, pretty much any extension that asks for All data on your computer and the websites you visit is probably worth a very close look. These extensions aren’t inherently bad. Any extension, like the screenshot tool Lightshot, that accesses your hard drive needs this permission. But it’s worthwhile to pay closer attention to any extension that asks for data on your computer.
Thankfully, an extension that’s capable of really scraping your data is going to set off alarms. Flores notes:
While an extension might not gun for all your data, it’s certainly possible to grab specific information, like a password, so before you download anything it’s worth looking through an extension’s reviews to see what other people are saying. Chances are someone will notice an overreaching extension pretty quickly.
It’s not a perfect system, but for the most part, even extensions that request access to all your data on web sites are safe to use. It’s unfortunate that Chrome doesn’t allow for more specific permissions, but with a little common sense you shouldn’t run into trouble.
If you want to be extra careful, only install extensions from verified authors. You’ll see a little check mark on the extension’s Chrome Web Store page that verifies it’s official. Not every “good” extension has this verification though. For example, LastPass doesn’t have a verification, even though it’s a trustworthy extension. It’s not hard to get verified, but it at leasts helps you separate the official extensions from the unofficial ones.
If you have a little technical knowledge, you can also dig into an extension’s code to see what it’s doing, or install an extension like Extension Gallery to inspect the code easily. You can get a closer look at what code causes Chrome permission warnings on the developer site as well.