Disable browser extensions for your parents/grandparents/users

[-]

Confident-Quail-946@reddit

It's alarming how easily malicious browser extensions can infiltrate our systems, especially when they masquerade as harmless tools like package trackers. This incident with your grandma underscores the critical need for proactive measures. try some security tools like layerx security. They offer comprehensive visibility and control over browser extensions, allowing you to assess and block risky ones before they cause harm. anyways what steps have you taken to educate your family about such risks?

Reply

[-]

TimePlankton3171@reddit

Extension whitelist gpo. Chromium and Mozilla families both have them. These policies are enforceable on Mac and Linux too.

Reply

[-]

PawnF4@reddit (OP)

Yeah definitely gpo for any domain environment. Simple registry punch (literally all that a gpo is) for family PCs though too. Not something I would have thought of before this happened to my grandma.

Reply

[-]

Awkward-Candle-4977@reddit

No need registry editing. Just use admx and gpedit

Reply

[-]

TimePlankton3171@reddit

Yep. I tell my family and friends to pause before installing apps and extensions. The result of that pause should almost always be not installing the thing. I tell them that I'd much prefer they call me and ask than call me to deal with the mess later. I refuse to help people who can't be recruited like this. I've had really uncomfortable situations, but I'm adamant. There are two people in my family that no longer ask me for any help because if these situations. Much better.

Reply

[-]

bdog59600@reddit

I paid for Malwarebytes and turned on the Browser Guard extension for my parents. When I check the log of stuff it's blocked it's probably saved my parents from several scams.

Reply

[-]

CpuJunky@reddit

Beyond extensions, most of what I deal with is pop-up notifications spamming "Virus" notices. edge://settings/content/notifications chrome://settings/content/notifications Remove.

Reply

[-]

ender-_@reddit

Block them with Group Policy, too; this should work on non-domain-joined machines: Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\Explorer] ;Edge Alt+Tab tabs "MultiTaskingAltTabFilter"=dword:00000004 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge] "DefaultNotificationsSetting"=dword:00000002 "EdgeShoppingAssistantEnabled"=dword:00000000 "MicrosoftEditorProofingEnabled"=dword:00000000 "HubsSidebarEnabled"=dword:00000000 "DefaultBrowserSettingsCampaignEnabled"=dword:00000000 "AIGenThemesEnabled"=dword:00000000 "EdgeShoppingAssistantEnabled"=dword:00000000 "CopilotPageContext"=dword:00000000 "CopilotCDPPageContext"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google] [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome] "SafeBrowsingEnabled"=dword:00000001 "DefaultNotificationsSetting"=dword:00000002 "PrivacySandboxAdMeasurementEnabled"=dword:00000000 "PrivacySandboxAdTopicsEnabled"=dword:00000000 "PrivacySandboxPromptEnabled"=dword:00000000 "PrivacySandboxSiteEnabledAdsEnabled"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Mozilla\Firefox\Extensions] [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Mozilla\Firefox\Permissions] [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Mozilla\Firefox\Permissions\Notifications] "BlockNewRequests"=dword:00000001

Reply

[-]

fahque@reddit

The BlockNewRequests for firefox just blocks camera requests. Quote from the gpo, "If this policy is enabled, sites that are not in the Allow policy will not be allowed to ask permission to access the camera."

Reply

[-]

ender-_@reddit

There are multiple BlockNewRequests policies in Firefox, this one's under Notifications, so it applies to that. It's been a while since I exported the .reg file, so it's possible that it has some old policies in it.

Reply

[-]

ender-_@reddit

There are multiple BlockNewRequests policies in Firefox, this one's under Notifications, so it applies to that. It's been a while since I exported the .reg file, so it's possible that it has some old policies in it.

Reply

[-]

rcp9ty@reddit

My receptionist at one of the companies we take care of constantly gets stupid add-ons that get past the av software we use which pisses me off. So I disabled edge notifications.

Reply

[-]

drfusterenstein@reddit

Only addon needed is uBlockOrigin

Reply

[-]

vawlk@reddit

the very apis that allow ublockorigin to work as well as it does are also responsible for most of the extension based malware out there. Also UBO doesn't prevent people from installing things that they shouldn't.

Reply

[-]

music2myear@reddit

It makes up for this by blocking, more effectively and reliably and with less impact on overall experience, than anything else, all those popups and ads which may sucker a naive user into doing something dumb.

Reply

[-]

vawlk@reddit

downvote me to speaking the truth lol. I never said that it didn't do that. I simply said the most malware extensions out in the wild exist because of the same APIs that UBO uses to do what it does. If your mother gets a phishing email telling her to install a spoofed Greedybear extension....they will drain her accounts before UBO ever even notices. UBO is for ad/tracker blocking. It doesn't prevent stupidity.

Reply

[-]

music2myear@reddit

I didn't downvote you, silly. Chill. I didn't say you were wrong either.

Reply

[-]

vawlk@reddit

its fine, idc anyway. I was merely saying that I was downvoted for speaking the truth. It wasn't really directed at you since there was more than one downvote at the time.

Reply

[-]

vawlk@reddit

downvote me to speaking the truth lol. I never said that it didn't do that. I simply said the most malware extensions out in the wild exist because of the same APIs that UBO uses to do what it does. If your mother gets a phishing email telling her to install a spoofed Greedybear extension....they will drain her accounts before UBO ever even notices. UBO is for ad/tracker blocking. It doesn't prevent stupidity.

Reply

[-]

TYGRDez@reddit

No, but it stops people from clicking on scammy "sponsored" links in their Google searches

Reply

[-]

Valdaraak@reddit

And trusted password manager.

Reply

[-]

drfusterenstein@reddit

That is true like uBlockOrigin

Reply

[-]

silentxor@reddit

Also remove local admin, hard to install remote control software if you cannot install programs.

Reply

[-]

Nydus87@reddit

Local Security Policy is a good start if you’re installing the Enterprise version of Edge or Chrome to begin with. Then you can whitelist extensions, black list websites, and still have it auto update.

Reply

[-]

ExceptionEX@reddit

As others have said in a business environment GPO. But for users you can modify their shortcut to use (chrome) --disable-extensions It's relatively easy to do but not full proof if something else launches the browser, But with this way, it won't load them, even if something attempted to add them.

Reply

[-]

PawnF4@reddit (OP)

Ah ok. I just made reg edits that created an empty allow list. At work I’m mostly network/Linux these days so I’m kinda rusty on windows stuff.

Reply

[-]

OhioIT@reddit

Especially for Grandparents, get them a Chromebook or cheap PC with ChromeOS next time around. No viruses, can't load malware crap, etc. After blocking Chrome notifications, it cut my calls down to nothing, literally. On PC there was something constantly wrong

Reply

[-]

ExceptionEX@reddit

you could also load a bootable OS (like mint) with no persistent partition on their existing computer off a USB drive. I've done that with older folks for years, just have them reboot when they want to log off.

Reply

[-]

ender-_@reddit

Add uBlock Origin Lite as a forced extension, it'll get rid of a lot of these requests.

Reply

[-]

ExceptionEX@reddit

Lot of ways to skin a cat in that regard, the reg edit seems like a better plan, nothing says you can combine them.

Reply

[-]

Le_Vagabond@reddit

yeah I'm not letting family browse the web without ublock...

Reply

[-]

ExceptionEX@reddit

His question was how to prevent extensions...

Reply

[-]

sprtpilot2@reddit

If the incompetent elderly doesn't have their wealth in a trust they cannot control, you are doing it wrong. The is NOTHING you can do to prevent them from getting fleeced.

Reply

[-]

Frothyleet@reddit

Lmao if you are putting people into guardianship when they download malware we'd be hauling a lot of Gen Z kids out of their offices too

Reply

[-]

PawnF4@reddit (OP)

Ok Russian bot operator. Go catch a himars.

Reply

[-]

ESXI8@reddit

If they really are only using just a browser, maybe take a look at the [Nixbook](https://github.com/mkellyxp/nixbook) Project

Reply

[-]

PawnF4@reddit (OP)

Never heard of this. I’ll check it out. My grandma is 80 so just worried about moving her to anything she’s not used to.

Reply

[-]

andyr354@reddit

Better yet put them on a iPad like I did.

Reply

[-]

tarkinlarson@reddit

Also disable toast notifications from the browser Stops things like adverts saying antivirus is out of date etc.

Reply

[-]

nerdyviking88@reddit

Literally just throw them onto a linux box that's locked down, they're just using a browser anyways

Reply

[-]

Disturbed_Bard@reddit

And turn off browser notifications

Reply

[-]

TheDawiWhisperer@reddit

maybe you're onto something here...i should join my mums PCs to a domain and lock her down like an idiot user that can't be trusted to use the internet

Reply

Reply to Post

42 Comments