Plugins should not be confused with browser add-ons. An add-on is a type of browser extension that you normally download from a place like Chrome store. Add-ons are executed within a browser process. An example of browser add-ons is AdBlock or Ghostery.
In comparison, plugins typically come pre-installed with the browser or downloaded from a 3rd party website. An example of a plugin is Adobe Flash or Widevine. Plugins typically run in a separate process that inherits all rights from the currently active user which leads to all kinds of vulnerabilities.
The danger of leaving plugins enabled
Some plugins like Flash or Widevine have a documented API which allows retrieving various uniquely identifiable data points about the parent machine. Other plugins may also have an API, whether public or private, that may present danger for online privacy. Since plugins are essentially closed-source binary files, there is no sure way to evaluate which security holes a certain plugin may have.
Fingerprinting through enumeration
Another danger comes from browser plugin enumeration. Even if a website is not able or unwilling to retrieve uniquely identifiable data through plugins API, it may still collect uniquely identifiable data in the form of a plugin list. A plugin list that contains a version for each plugin may significantly narrow down the segment a user belongs to. Multiple browsing sessions can be linked together based on this data alone or coupled with other data points.
Default plugins in Firefox and Chrome
By default, Firefox has no plugins installed. Chrome has four plugins bundled in it which are:
- Chrome PDF plugin
- Chrome PDF viewer
- Native client
- Widevine Content Decryption Module
How Multilogin works with plugins
There are two options on the "Plugins" page in the New Browser Profile view:
- Enable potentially vulnerable plugins
- Enable Flash plugin
Both options are disabled by default. The disabled state means in Stealthfox no plugins will be enabled. In Mimic, however, four default plugins will appear as enabled but websites won't be able to actually access them.
There are separate tumblers to enabled Flash plugin and all other Chrome default plugins. This is for two reasons. First, Flash plugin is arguably more dangerous than the rest since it was the first to be exploited by websites for user fingerprinting. Second, Flash is also the most needed plugin from the four in certain cases.
We recommend leaving both options disabled at all times. Should you decided to enable either of two for a good reason, keep in mind that you are exposing yourself to a potential risk of revealing uniquely identifiable data to websites.
Can we alter the data that Flash plugin reveals?
While this is theoretically possible, it makes no sense in real life. In theory, this would require disassembling every version of Flash plugin injecting own binary code in them which is a Sisyphean task. In real life, bundling Flash plugins modified this way would be illegal.
This is also unnecessary since developers of all modern browsers already realized the threat coming from Flash plugin. It is now disabled by default in all popular browsers. By having it disabled you blend in a crowd while enabling it proactively makes you stand out instead.