Is Language Learning with YouTube-AFL safe?
Language Learning with YouTube-AFL signs AI coach requests with an embedded secret and opens Apple sign-in over HTTP.
When its AI coach feature calls appforlanguage.com/extractionsub, the background script adds a bearer Authorization header and a request-token JWT made with a secret included in the extension bundle. Its YouTube login dialog opens Apple sign-in at http://auth.appforlanguage.com/auth/apple/login, so that authentication flow starts on a cleartext URL.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itApp For Language - 4 other listings from the same operator, 3 of them carrying a finding
App For Language - 4 other listings from the same operator, 3 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
4 other listings published from this account, 116k+ users between them. 3 of them carry a finding.
Shared hosts - 12 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 4.26.01.05. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on appforlanguage.com
https://appforlanguage.com/*
Read and change your data on clients5.google.com
https://clients5.google.com/*
Read and change your data on youtube.com
*://youtube.com/*
Store data in your browser
storage
Speak text aloud
tts
Where it sends data
Destinations our analysis observed Language Learning with YouTube-AFL contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- appforlanguage.com
Language Learning with YouTube-AFL sends data to appforlanguage.com. 2 other extensions we have analysed send data here.
- auth.appforlanguage.com
Language Learning with YouTube-AFL sends data to auth.appforlanguage.com. No other extension we have analysed sends data here.