Vetting an Extension Before You Trust It With Your Keystrokes
A text expander has to watch what you type in order to work. That makes it worth ten minutes of checking before you install one, and the checking method applies to almost anything online.
Why this category deserves extra care
A browser extension is a software module for customising a web browser. To replace an abbreviation as you type, an expander extension must be able to read and change the content of the pages you visit. That is the same capability a malicious tool would want. Keystroke logging is the action of recording the keys struck on a keyboard, typically covertly, and the technical gap between "watches for triggers" and "records everything" is narrower than most people would like.
None of this means expanders are dangerous. It means the publisher's honesty matters more here than it does for, say, a colour theme.
Read the permission prompt
- Access to all sites is common for expanders, since you type everywhere. Prefer tools that let you limit it to chosen sites or to activate on click.
- Clipboard access is reasonable if the tool pastes its expansions.
- Anything unrelated, such as browsing history, downloads or location, should have an explanation. If it has none, walk away.
Check who is behind it
- Is there a named publisher with a website, a privacy policy and a contact address?
- Does the policy say plainly whether your snippets and typed text leave your device?
- Is the tool maintained? Look at the date of the last update.
- Is the source code published? Open-source software can be inspected by anyone, which does not guarantee safety but does make hidden behaviour harder.
- Has it changed owner recently? Extensions are sometimes sold, and the new owner inherits every user's permissions.
Beware of lookalikes
Popular tools attract copies with nearly identical names and icons. Typosquatting is the practice of registering addresses that rely on mistakes such as typing errors, and the same trick appears in extension stores. Reach the store listing from the publisher's own website rather than from a search result or an advertisement.
"Is it a scam?" is a question with a method
The habit underneath all of this is checking public information yourself instead of relying on what a product says about itself. A good illustration of that method being applied step by step, in a completely different field, is a Traditional Chinese page that asks whether one gaming brand is a scam and sets out what public records show and how readers can verify it themselves (KG娛樂城詐騙). Going by its own description, it separates three things: what a government open-data source records, the fact that several different web addresses use the same brand name, and what each of those sites claims about itself. It also states that it is not run by the brand, and gives the date its checks were made.
Those are the right moves for an extension too. Separate the record from the claim. Notice when several publishers share one name. Prefer a source that says who it is and when it looked.
After you install
- Keep sensitive data out of snippets altogether.
- Disable the extension on banking and other sensitive sites if the browser allows it.
- Review your extensions every few months and remove the ones you no longer use.
- If an update suddenly asks for new permissions, read why before accepting.
Because the example above comes from a gambling brand: it is cited for what it shows about the topic of this page, not as a suggestion to play. Gambling is for adults only and is illegal in some places. If it is causing you or someone close to you harm, help is available; in the United States the national helpline is 1-800-MY-RESET.