How safe is Greasemonkey?

Question

I've never actually used greasemonkey, but I was considering using it. Considering that GreaseMonkey allows you to let random people on the Internet change the behavior of your favorite websites, how safe can it be? Can they steal my passwords? Look at my private data? Do things I didn't want to do? How safe is Greasemonkey?

Thanks

Answer 1

Considering that GreaseMonkey allows you to let random people on the Internet change the behavior of your favorite websites, how safe can it be?

It's as safe as you allow it to be - but you aren't very clear, so let's look at it from a few perspectives:

Web Developer

Greasemonkey can't do anything to your website that a person with telnet can't already do to your website. It automates things a bit, but other than that if greasemonkey is a security hole, then your website design is flawed - not greasemonkey.

Internet user with Greasemonkey loaded

Like anything else you load on your system, greasemonkey can be used against you. Don't load scripts onto your system unless you trust the source (in both meanings of the term 'source'). It's fairly limited and sandboxed, but that doesn't mean it's safe, merely that it's harder for someone to do something nefarious.

Internet user without Greasemonkey

If you do not load greasemonkey or any of its scripts, it cannot affect you in any way. Greasemonkey does not alter the websites you visit unless you've loaded it on your system.

Greasemonkey developer

There's not much you can do beyond what can already be done with XUL and javascript, but it is possible to trash your mozilla and/or firefox profile, and possibly other parts of your system. Unlikely, difficult to do on purpose or maliciously, but it's not a bulletproof utility. Develop responsibly.

-Adam

Answer 2

Considering that GreaseMonkey allows you to let random people on the Internet change the behavior of your favorite websites

Random people whose UserScript you have installed. No one can force you to install a UserScript.

Can they steal my passwords?

Yes, a UserScript could modify a login page so it sent your password to an attacker. No, it cannot look at your current passwords, or for websites the UserScript isn't enabled for

Look at my private data?

Yes, if your private data is viewable on a website that you've given a UserScript access too

Do things I didn't want to do?

Yes, a UserScript could do things to a webpage (you've given it access to) that are unwanted

How safe is GreaseMonkey?

As safe as the individual UserScripts you have installed

Answer 3

When used with discretion, Greasemonkey should be perfectly safe to install and use. While it is definitely possible to do all manners of mischief with carte-blanche Javascript access to pages, Greasemonkey scripts are restricted to specific URLs, and will not run on sites that are not specified by the URL patterns in their headers.

That being said, a basic rule of thumb is to consider most information on pages with Greasemonkey scripts active to be accessible to those scripts. It is technically feasible to play games like replacing input boxes (in which you might enter passwords or personal info), read any data on the pages, and send data collected to a third party. Greasemonkey scripts do run in an effective sandbox within the browser, and shouldn't be able to affect your computer outside of Firefox.

That being said, in some respects, the risk is comparable to or less than that of installing any other small pieces of open source software. Since Greasemonkey scripts are simple open source Javascript files, it's relatively easy for a programmer to take a look inside and make sure it does what it says it does. As always, run strangers' code (of any form) with care, and take the time to skim the source code if the software is important to you.

In general though, Greasemonkey scripts should be pretty safe. Try to use scripts with a large number of reviews and users, since these are likely to be more thoroughly vetted and analyzed by the community.

Happy userscripting!