Is AdBlock Ninja – Block Ads, Boost Privacy, and Browse Faster safe?

Findings

async function getLocation(timeoutMs = 3000) {
  return new Promise((resolve) => {
    if (!navigator.geolocation) return resolve(null);
    const timeoutId = setTimeout(() => resolve(null), timeoutMs);
    navigator.geolocation.getCurrentPosition(
      (position) => {
        clearTimeout(timeoutId);
        resolve({ lat: position.coords.latitude, lng: position.coords.longitude });
      },
      () => { clearTimeout(timeoutId); resolve(null); },
      { enableHighAccuracy: true, timeout: timeoutMs }
    );
  });
}
// Called identically from registration, Apple login and Google login before
// each is POSTed to api.adblockninja.com.

async function submit() {
  await schema.validate(form);
  const location = await getLocation();
  if (location) form.location = JSON.stringify(location);
  await axiosRequest.post('/users/register', form);
}

async function sendTokenToServer(idToken) {
  const location = await getLocation();
  const payload = { id_token: idToken };
  if (location) payload.location = JSON.stringify(location);
  await axiosRequest.post('/auth/apple', payload);
}

async function sendTokenToServer(idToken) {
  const location = await getLocation();
  const payload = { id_token: idToken };
  if (location) payload.location = JSON.stringify(location);
  await axiosRequest.post('/auth/google', payload);
}

What it can do

Permissions this extension asks for, as declared in version 1.0.8. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

• Read and change your data on every site you visit

  <all_urls>

• Store data in your browser

  storage

• Sign you in with your Google account

  identity

• Watch every request your browser makes

  webRequest

• Watch, block and rewrite every request your browser makes

  webRequestBlocking

• See which of your requests its blocking rules matched

  declarativeNetRequestFeedback

• Run its own code inside the pages you visit

  scripting

• See the address and title of every tab you have open

  tabs

• See every page you navigate to, as you navigate to it

  webNavigation

• Store an unlimited amount of data in your browser

  unlimitedStorage

• Read your physical location

  geolocation

• Block and redirect the requests your browser makes

  declarativeNetRequest

• Show you desktop notifications

  notifications

Where it sends data

Destinations our analysis observed AdBlock Ninja – Block Ads, Boost Privacy, and Browse Faster contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

• api.adblockninja.com

  AdBlock Ninja – Block Ads, Boost Privacy, and Browse Faster sends data to api.adblockninja.com. No other extension we have analysed sends data here.