Can content inside a sandboxed iframe be read/spied by browser extensions? if not should I use iframe to secure user credentials?

Question

Apart from all the other typical security best practices I'm wondering about this, since I lately read some articles talking about how browser extensions can spy anything their user does. So that we shouldn't trust them.

Therefore in order to give users and additional layer of protection should I process all users credential and sensitive info inside an iframe inside my webpages?

Answer 1

Can content inside a sandboxed iframe be read/spied by browser extensions?

Yes

Could I use iframe to secure user credentials?

Quick answer, no.

When a user installs a chrome extension the extension can do basically anything in the website to access the user credentials. The extension has also access to the iframes that the page generates.

My proposed solutions to overcome this two issues and keep the website feel "secure" are the following:

If the end goal is to secure the content that your user will put in the website, and by no mean you want to let the user put content if there are other kind of extensions running in the page, what you can put is some kind of pop up in the page blocking the access to the user until he is accessing the website without extensions.

Another solution you could propose to the user is to go incognito mode, as there are many options to disallow extensions in incognito without having to force him to uninstall all of the extensions that he has on his browser. This could also make less users leave your page, as if you force him to uninstall of the extensions on his browser it might make him leave your page if it's not a clear enough reason for him.

If you do know which are the extensions that shouldn't be blocked or prevented because they are harmful or known to have some kind of shady behaviour, what you can do is checkout if the user has them installed with this solution Checking if user has a certain extension installed and then print a message to him saying he can't continue until he uninstalls those extensions.