Is E-SIGN (Asseco Lietuva, UAB) safe?
E-SIGN relays certificate, signing and PIN-cache requests from any web page to a local native host, with no site allowlist.
A content script on all sites listens for page messages (certificate loading, data signing, PIN cache cleanup) and forwards them through the background script to the native host lt.asseco.esign. The sender URL and origin are attached so the host can decide how to respond, and replies are posted back to the page. Certificate enumeration, PIN prompts and signing happen in the native host, not in the extension.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 2.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Talk to a program installed on your computer, outside the browser's sandbox
nativeMessaging
Where it sends data
Destinations our analysis observed E-SIGN (Asseco Lietuva, UAB) contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- lt.asseco.esign (local native host)
E-SIGN (Asseco Lietuva, UAB) sends data to lt.asseco.esign (local native host). Named as a recipient in this extension's own analysis.