CODEWITHSUNDEEP
google-chromegoogle-chrome-extensiongoogle-chrome-devtools
tjati
tjati

Reputation: 6079

How to trust an extension in Google Chrome without the Web Store?

For internal use in my department I wrote a Chrome extension. It works fine in developer mode and I delivered it to my colleagues by e-mail attaching the .crx-file. They opened chrome://extensions and drag-and-drop it there. The message

drop to install extension

appeared, Chrome installed the extension and it works like a charm.

Nevertheless, on the very first restart of Chrome, a message appears that Chrome deactivates an unsupported extension.

A link to the help page Extensions disabled by Chrome is added to the message, and states:

To protect you while you browse, Chrome only lets you use extensions that have been published on the Chrome Web Store.

While I understand the reason, is there any other way a user can explicitly tell Chrome an extension is safe? Some effort is acceptable as publishing the extension to the webstore is not.

I have no administrative access, so no changes to registry nor active directory are possible.

Upvotes: 1

Views: 3034

Answers (2)

Xan
Xan

Reputation: 77531

As noted, you need Active Directory level policies to whitelist / auto-install extensions. See Policy List.

Chrome will use many defense mechanisms to detect and fight other trickery. The stance is simple: anything an unprivileged user can do any other software can do to implant malware.

However, you should consider publishing in CWS.

  1. This can be done unlisted; unless someone has the listing link, the extension won't be discoverable.

    This approach will present a risk of a leak of the link, but with your current delivery mechanism crx can leak as well; in general, copy-protecting extensions is basically infeasible.

  2. This can be done with enforced control over accounts; you can publish to a Google Group of "trusted testers", who will be the only ones to see the listing.

    Won't work if you're not allowed to sign into your Google accounts in Chrome.

  3. This can be published with enforcing access only to your domain's users - if you use GApps for your work.

All of the above might not work if your extension is somehow questionable by CWS policies; if you can't publish for this exact reason, and can't use AD policies, I'm afraid you're SOL.

Upvotes: 1

Garbee
Garbee

Reputation: 10991

There isn't a way without domain level management to make this work. You can't just have the user "say" it is safe, since the user "saying" something could very well be the attacker. Any mechanism put in place to get around this would simply be used by attackers and unthoughtful companies to add more junk into your browser.

Upvotes: 0

Related Questions