Hide my MFA codes

Name: Hide my MFA codes
Author: Jeroen Swen

By: Jeroen Swen Add-on

Hides MFA codes from prying eyes.

This add-on was removed from Firefox Add-ons Store on 2022-11-23

Overview

Removed

Daily users

Data as of 2022-11-23

Version:

1.0.2

Last updated: 2022-10-10

Download

Features & Capabilities

What is Hide my MFA codes? Hide my MFA codes turns Multi-Factor Authentication-related input fields into Password fields. This prevents any prying eyes from stealing MFA codes, effectively reducing potential attack-windows from 30 seconds to 0.

In other words, codes will no longer be shown as "123456", but as "******" instead.

Is showing MFA codes really a security issue? Aren't you just being paranoid? An attack like this is indeed highly theoretical. Someone would need access to your regular credentials and look over your shoulder either physically or through a camera and use the token within the time it expires.

So is an attack likely? No. Is the impact of a successful attack high though? Yes.

Verification codes are shown to give users a balance between security and usability. I personally choose security.

What's with the "Access your data for all websites" install notification? The way this add-on, like most other add-ons, works is that it injects a JavaScript function in every page so that it can detect MFA-related fields and change them to Password-fields. To do this, it will require access to every page you visit. If you are skeptic about installing this add-on (which I can only applaud), please check out the source-code to be reassured. Tip: To view the actual source code of add-ons, right-click the "Add to Firefox"-button and press "Save link as...". A file with the extension '.xpi' will be downloaded. This is actually a ZIP-file, so just rename it to .zip and you can view the source-code of the add-on.

A verification code field was not hidden / A field was hidden that was not a verification code field Unfortunately developers across the world have to deal with the most difficult question in development: "How to name things?". This is no different for MFA input fields. While creating this webextension I encountered different names for almost every web-application. I've created a regular expression to deal with this, but it's not perfect. There could be undetected fields.

If you encounter any problems, please let me know by creating a new issue here: https://gitlab.com/jeroen.swen/hide-my-mfa-codes/-/issues. Make sure to include a link to the service and preferably the ID and Name of the input element.

User Growth & Download Statistics

Add-on

By:

Jeroen Swen

Daily users:

Version:

1.0.2 Last updated: 2022-10-10

Creation date:

2022-10-09

Risk:

Content scripts matches:

Size:

11.59KB

Full description:

Source:

Firefox Add-ons Store

Data ingested on:

2022-11-23

Compare stats and ranking:

Contact the developer

Chrome-Stats does not own this Firefox add-on. Please use these information below to contact the Firefox add-on developer.

Developed by:

Jeroen Swen

Firefox Add-ons Store

https://addons.mozilla.org/firefox/addon/hide-my-mfa-codes/

Is Hide my MFA codes Safe?

Risk impact

Risk impact measures the level of extra permissions an extension has access to. A low risk impact extension cannot do much harms, whereas a high risk impact extension can do a lot of damage like stealing your password, bypassing your security settings, and accessing your personal data. High risk impact extensions are not necessarily malicious. However, if they do turn malicious, they can be very harmful.

Hide my MFA codes requires a few sensitive permissions. Exercise caution before installing.

Risk impact analysis details

Critical Allows access to all websites, posing a significant security risk as it can monitor and modify data from any visited site.
High ******* ******* **** *** ****** ***** *** ***** ** ******* **** ********* ********* ** * *********** *****

Risk likelihood

Risk likelihood measures the probability that a Firefox add-on may turn malicious. This is determined by the publisher and the Firefox add-on reputation on Firefox Add-ons Store, the amount of time the Firefox add-on has been around, and other signals about the Firefox add-on. Our algorithms are not perfect, and are subject to change as we discover new ways to detect malicious extensions. We recommend that you always exercise caution when installing a Firefox add-on.

Hide my MFA codes may not be trust-worthy. Avoid installing if possible unless you really trust this publisher.