Is eParaksts safe?

Question

Is eParaksts safe?

Accepted Answer

eParaksts is critical risk. When the eParaksts signing extension is installed, any website can request your electronic identity certificate by sending a crafted JavaScript message. The extension does not verify which website is making the request before relaying it to your local native signing application. During dynamic analysis, a page at an unrelated domain successfully triggered the relay and received a response confirming the full round-trip completed. When the native application is present and a smart card is inserted, a page at any origin could read your identity certificate—which contains your full name and national identification number—without a consent prompt or user interaction beyond page load. The extension's background code contains a comment indicating an origin allowlist was planned but not implemented. When the eParaksts signing extension is active, it loads its electronic identity signing library onto every website you browse—not only the official eParaksts portal. This makes the eParakstsTokenSigning constructor, along with its getCertificate(), sign(), and getVersion() methods, callable by any JavaScript running on any page you visit. The extension's own source code contains a comment acknowledging this injection may be broader than intended. Observed during dynamic analysis on an unrelated website: the eparaksts-page.js script tag was present in the page document and the eParakstsTokenSigning constructor was accessible in the global JavaScript scope.

Is eParaksts signing extension safe?

Findings