Is sprint.youtube - YouTube Speed Up safe?

Findings

static async buildPac(proxyServer) {  const timestamp = Date.now();  const domains = (await ConfigService.getCurrentConfig()).domains;  // domains list fetched from s3.twcstorage.ru — operator can add entries remotely  return `    // ${timestamp}    function FindProxyForURL(url, host) {        const blockedDomains = ["${domains.join('",')}"];         const isBlockedDomain = blockedDomains.some(domain =>            dnsDomainIs(host, domain)        );        if (isBlockedDomain) {            return "PROXY ${proxyServer.ip}:${proxyServer.port}";        }        return "DIRECT";    }  `;}

const CACHE_MINUTES = 3;class ConfigService {  static async getCurrentConfig() {    const cached = await Config.load();    if (cached.storedAt) {      const storedTime = dayjs(cached.storedAt);      if (dayjs().diff(storedTime, 'minutes') < CACHE_MINUTES) {        return cached; // use cache if under 3 minutes old      }    }    try {      const fresh = await fetchRemoteConfig(); // GET s3.twcstorage.ru/...config.json      await fresh.save();      return fresh;    } catch {      return cached; // fall back to stale cache on error    }  }}

{  "instance_id": "a1f23d5f-e145-4ff4-a9e4-c95872717823",  "token": "feQ81m9a4NT5UWLwG5EMmj:APA91bGS1CatZZvkVx5psx4x922tH75wq0TlE1YKu_jWPdOb1YK8thOvq0hzd8hdqexKbwo0L7wExlYSCwlRgfWawG76JT5yTndOy2K0MmTbo1spoB"}

async function sendFcmToken(instanceId, token) {  try {    // Posts FCM token to operator server so they can push to this device    await apiClient.post('/api/v2/notifications/set-fcm-token', {      instance_id: instanceId,      token: token    });  } catch (err) {    await errorLogger.addException('Failed to set notification token.', err);  }}

What it can do

Permissions this extension asks for, as declared in version 2.0.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

• Read and change your data on youtube.com

  https://*.youtube.com/*

• Read and change your data on ytimg.com

  https://*.ytimg.com/*

• Read and change your data on googlevideo.com

  https://*.googlevideo.com/*

• Read and change your data on ggpht.com

  https://*.ggpht.com/*

• Read and change your data on youtube-nocookie.com

  https://*.youtube-nocookie.com/*

• Read and change your data on youtubekids.com

  https://*.youtubekids.com/*

• Read and change your data on sprint-ext.ru

  https://*.sprint-ext.ru/*

• Read and change your data on speedyext.ru

  https://*.speedyext.ru/*

• Read and change your data on youtu.be

  https://*.youtu.be/*

• Read and change your data on s3.twcstorage.ru

  https://s3.twcstorage.ru/*

• Store data in your browser

  storage

• Route all of your browsing through a server of its choosing

  proxy

• See the address and title of every tab you have open

  tabs

• See every page you navigate to, as you navigate to it

  webNavigation

• Show you desktop notifications

  notifications

Where it sends data

Destinations our analysis observed Sprint.YouTube contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

• speedyext.ru

  Sprint.YouTube sends data to speedyext.ru. One other extension we have analysed sends data here.

• s3.twcstorage.ru

  Sprint.YouTube sends data to s3.twcstorage.ru. No other extension we have analysed sends data here.

• Firebase (sprint-72dda)

  Sprint.YouTube sends data to Firebase (sprint-72dda). Named as a recipient in this extension's own analysis.