Is Automatic message translation safe?
Automatic message translation sends Pro-tier DeepL and AI translation requests over plain HTTP, including message text and the user's session token.
When a user on the paid tier selects the 'Deepl (beta)' or 'AI (beta)' translation engine, the extension sends the Facebook/Messenger message being translated to translate-api.ext-api.com over unencrypted HTTP along with the user's session auth token. Because the connection is not HTTPS, both the message content and the token are readable by anyone in a position to observe the network traffic, such as on public Wi-Fi. The default 'google' engine instead uses HTTPS and is not affected.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itultracoding - 4 other listings from the same operator, none carrying a finding
ultracoding - 4 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
4 other listings published from this account, 34k+ users between them, none of them carrying a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed Automatic message translation contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- translate-api.ext-api.com
Automatic message translation sends data to translate-api.ext-api.com. 13 other extensions we have analyzed send data here.