Audit every extension's permissions and rebuild a browser profile deliberately

short · 35 min · Objective 2.1

Task

List every extension in every browser and every profile on a machine, record what each one is permitted to do, and decide about each. The audit is the exercise: extension permissions are granted at a moment when the user has already decided, and reading them afterwards is when the decision is actually made.

Steps

  1. Write lab/browser/extensions.csv with header browser,profile,extension,permissions,justified,decision for every extension in every browser and profile on the machine.
  2. For every extension permitted to read and change data on all websites, write one sentence in lab/browser/allsites.md on whether it needs that and what it would see if it were sold.
  3. Record the browser's security settings in lab/browser/settings.csv with header setting,value,what_it_changes, covering pop-up blocking, tracking protection, password storage, sync and its second factor.
  4. Write lab/browser/certs.md describing what each certificate warning type means and which are never dismissed, and record what your machine's clock says against real time.
  5. Write lab/browser/clearing.csv with header category,what_it_removes,what_it_breaks,what_it_does_not_fix covering cache, cookies, site data, history and saved passwords.

Verify

awk -F, 'NR>1 && NF>=6 {n++} END {print n" extension(s) audited"}' lab/browser/extensions.csv
awk -F, 'NR>1 {print $1}' lab/browser/extensions.csv | sort -u | wc -l
awk -F, 'NR>1 && NF>=3 {n++} END {print n" setting(s)"}' lab/browser/settings.csv
awk -F, 'NR>1 && NF>=4 {n++} END {print n" clearing categor(ies)"}' lab/browser/clearing.csv
grep -Eic 'mismatch|expired|untrusted|revoked' lab/browser/certs.md
grep -Eic 'extension' lab/browser/clearing.csv

Every extension audited with a decision, five settings recorded, five clearing categories, and the certificate note naming the warning types. The clearing table must state that extensions are not removed by it -- which is why "clear your cache" does nothing for a hijacked browser.

Notes

Check every profile, not just the one in front of you. A hijack commonly installs into all of them, and an audit of one profile reports clean while the user's other profile is untouched.

This is an independent study companion for CompTIA A+ Core 2 220-1202 and is not produced by or endorsed by CompTIA.