Is Grass Lite Node safe?

Question

Accepted Answer

Grass Lite Node is medium risk. Dynamic analysis captured the Grass Lite Node extension establishing WebSocket connections to proxy servers using the unencrypted ws:// scheme rather than the encrypted wss:// scheme. After receiving a list of proxy destination addresses from its coordination server over HTTPS, the extension rewrites every address to use ws://, then opens the WebSocket with an RS256 authentication token appended as a plaintext querystring parameter. Any observer on the network path between your browser and the proxy server — such as another device on the same Wi-Fi network, an ISP, or a compromised router — can read your authentication token and the full contents of all HTTP traffic proxied through the connection, including request URLs, headers, and response bodies.

Is Grass Lite Node safe?

Findings