Authenticator
🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Overview
Authenticator generates two-factor authentication (2FA) codes in your browser. Use it to add an extra layer of security to your online accounts.
Always keep a backup of your secrets in a safe location.
Encrypting your secrets is strongly recommended, especially if you are logged into a Google account.
Features:
- Add accounts by scanning QR codes
- Search your accounts by pressing "/"
- Translated into more than ten languages
- Encrypt your secrets with a password
- Backup your secrets to a file, Google Drive, Microsoft OneDrive, or Dropbox
- Sync your secrets with your Google Account
- Import data from Google Authenticator offical mobile App
- Open source
Supports:
TOTP
HOTP
Steam Guard
Blizzard Authenticator
Tags
Privacy Practices
Security Analysis — Authenticator
Permissions
Code Patterns Detected
External Connections
Package Contents 96 files · 11MB
What This Extension Does
Authenticator generates two-factor authentication codes in your browser, adding an extra layer of security to online accounts. It supports various protocols (TOTP, HOTP, Steam Guard, Blizzard Authenticator) and allows users to backup secrets securely. With over 8 million users, it's a popular extension for those seeking enhanced account protection.
Permissions Explained
- activeTabexpected: Allows the extension to access the current webpage and interact with its content.
Technical: Grants access to the active tab's DOM, allowing the extension to inject scripts, read page content, and modify the UI. This permission is necessary for the extension to function correctly but poses a risk if exploited by malicious code. - storageexpected: Enables the extension to store data locally on your device, such as account secrets and settings.
Technical: Provides access to local storage, allowing the extension to save and retrieve sensitive information. This permission is necessary for the extension's core functionality but raises concerns if compromised by unauthorized parties. - identityexpected: Allows the extension to access your Google account credentials, enabling sync and backup features.
Technical: Grants access to your Google account identity, allowing the extension to authenticate with Google services. This permission is necessary for syncing secrets but poses a risk if exploited by malicious code. - alarmsexpected: Enables the extension to schedule and manage alarms, which are used for notifications and reminders.
Technical: Provides access to alarm management APIs, allowing the extension to create and manage scheduled events. This permission is not directly related to security but may be used for malicious purposes if exploited. - scriptingexpected: Allows the extension to execute scripts in the context of web pages, enabling features like code injection and UI modification.
Technical: Grants access to scripting APIs, allowing the extension to inject scripts into web pages. This permission is necessary for some features but poses a significant risk if exploited by malicious code. ⚠ 1 - clipboardWriteexpected: Enables the extension to write data to your clipboard, which can be used for various purposes like copying codes or credentials.
Technical: Provides access to clipboard writing APIs, allowing the extension to copy and paste sensitive information. This permission is not directly related to security but may be used for malicious purposes if exploited. - contextMenusexpected: Allows the extension to create custom context menus, enabling users to access specific features and options.
Technical: Grants access to context menu management APIs, allowing the extension to create custom menus. This permission is necessary for some features but poses a risk if exploited by malicious code.
Your Data
Authenticator accesses various domains and services, including Google, Dropbox, Microsoft, and more. It stores sensitive information locally on your device and sends data to these external services for backup and sync purposes.
Technical Details
Code Findings
The extension uses the function constructor to execute dynamic code, which can lead to security vulnerabilities and potential exploits.
Technical: The extension uses the Function constructor to create new functions dynamically, allowing for code injection and execution. This pattern is commonly used in legitimate extensions but poses a significant risk if exploited by malicious code.
💡 Legitimate use: Creating dynamic functions for complex calculations or data processing.
The extension assigns innerHTML values to elements, which can lead to cross-site scripting (XSS) vulnerabilities if exploited by malicious code.
Technical: The extension uses the innerHTML property to assign values to elements, allowing for XSS attacks. This pattern is commonly used in legitimate extensions but poses a risk if exploited by unauthorized parties.
💡 Legitimate use: Dynamically updating page content with user-input data.
The extension uses obfuscation techniques to hide code, which can make it harder for users to understand the extension's behavior.
Technical: The extension uses String.fromCharCode and charCodeAt to encode and decode strings, making it difficult to read the code. This pattern is commonly used in legitimate extensions but poses a risk if exploited by malicious code.
💡 Legitimate use: Encoding sensitive information for storage or transmission.
The extension uses deprecated obfuscation techniques, which can lead to security vulnerabilities and potential exploits.
Technical: The extension uses the unescape function to decode strings, which is a deprecated method. This pattern poses a risk if exploited by malicious code.
💡 Legitimate use: None (deprecated).
The extension makes HTTP requests to various domains, which is a normal behavior for extensions that require data exchange with external services.
Technical: The extension uses the XMLHttpRequest object and the Fetch API to make XHR requests to various domains. This pattern is commonly used in legitimate extensions and does not pose a significant risk.
💡 Legitimate use: Exchanging data with external services for backup, sync, or other purposes.
The extension uses the postMessage API to communicate with web pages from different origins, which can lead to security vulnerabilities and potential exploits.
Technical: The extension uses the postMessage API to send messages between web pages from different origins. This pattern is commonly used in legitimate extensions but poses a risk if exploited by malicious code.
💡 Legitimate use: Communicating with web pages for authentication or other purposes.
The extension sets up event listeners to respond to user interactions, which is a normal behavior for extensions that require user input.
Technical: The extension uses the addEventListener method to set up event listeners for various events. This pattern is commonly used in legitimate extensions and does not pose a significant risk.
💡 Legitimate use: Responding to user interactions, such as button clicks or keyboard input.
Authenticator is a popular extension that provides two-factor authentication codes in your browser. While it has some security concerns related to dynamic code execution and potential XSS vectors, these issues can be mitigated by following best practices for coding and testing. Users should exercise caution when granting permissions and regularly review the extension's behavior to ensure it aligns with their expectations.
