Is Distill safe?

Question

Is Distill safe?

Accepted Answer

Distill is critical risk. When you use Distill's onboarding flow or an allowed Distill web page requests a cookie check, the extension can read LinkedIn session cookies from Chrome. The extension sends LinkedIn cookie values to Distill pages, including through a Distill onboarding URL that carries the LinkedIn session token as a query parameter. When you use Distill with an open Outlook or Office tab, a Distill web page can ask the extension to read Outlook's LokiAuthToken from session storage and return it to distill.com or distill.fyi. The confirmed database row says this requires injection access to the Outlook or Office tab and involves credential and storage data.

Is Distill safe?

Findings