Is ncapture safe?

Question

Is ncapture safe?

Accepted Answer

ncapture is medium risk. NCapture embeds a fixed AES-256 encryption password and salt directly in its source code (service-worker.js line 1109). Before authenticating with Twitter, LinkedIn, Facebook, or Geonames on your behalf, the extension retrieves encrypted OAuth consumer credentials from the vendor's API server and decrypts them in the browser using that hardcoded password. A proof-of-concept script confirmed that anyone who reads the extension source can use the embedded values to independently authenticate to the vendor's credential endpoint and decrypt the OAuth consumer credentials the server returns. The Geonames API username was recovered in plaintext; Twitter and LinkedIn OAuth consumer key and consumer token were also recovered (values withheld).

Is NCapture safe?

Findings