What is the risk of data capture/leak from web extensions when we run this tool on webpage?

79 Views Asked by At

What is the risk of data capture/leak from web extensions when we run accessibility insights for web tool on webpage?

1

There are 1 best solutions below

0
On

I'm an engineer on the Accessibility Insights team. This is a great question, and as part of the security and compliance requirements for our product, it's one we consider as part of the threat modeling exercises our team performs for all Accessibility Insights products.

When Accessibility Insights scans a webpage, or when you enter notes or pass/fail results during an assessment, the results are stored locally on your machine using your browser's "local storage" and "IndexedDB" mechanisms for the Accessibility Insights extension origin. The browser prevents this storage from being read directly by other extensions or pages, since they do not share the same origin.

The only points where the extension exports this data are:

  • When you select the "Export Report" button, it will export the data (which can include snippets of the page content) to an HTML file on your local machine.
  • If you enable the "More export options" preview feature and then select the "Export Report" option to "Export to Codepen", we will create a POST request to https://codepen.io to create a new pen with the same data that the exported HTML report would contain.
  • When select the "Copy to clipboard" option for a particular issue (the copied content includes the relevant snippet of the page)
  • When you configure an Issue Filing database and then select a "File Issue" button, this will export data about that particular issue (which can include a snippet of relevant page content) to the specific Issue Filing URL you explicitly configured. Specifically, the extension will we open a new tab with a URL along the lines of https://github.com/your-org/your-repo/issues/new?title=GENERATED_TITLE&body=GENERATED_BODY_INCLUDING_PAGE_SNIPPET

Accessibility Insights for Web does include usage telemetry, which you can choose whether to allow either in the prompt the first time you run the extension or later in the Settings for the extension. However, even if you allow telemetry, we never transmit any personally identifiable information; in particular, we never transmit the URL being scanned, any content from the page being scanned, or any of the text content you might enter in a "failure details" or "report summary" notes prompt.

Accessibility Insights for Web is open source; we welcome anyone to review the specific data we send. If you believe we're inadvertently including something that identifies either the user or the page being scanned, please file a bug!