マイナポータル

{
"summary": "マイナポータル (My Number Portal) is a Chrome extension that provides an application for using My Number cards with various online administrative services. It's designed to simplify access to these services, making it easier for users to manage their accounts and perform tasks online.",

"permissions": [
{
"name": "nativeMessaging",
"user_explanation": "This permission allows the extension to communicate with native applications on your device.",
"technical_note": "The nativeMessaging API enables the extension to interact with native code, potentially exposing sensitive data or allowing unauthorized access. This poses a critical risk if compromised.",
"aligned": false,
"concern": true
}
],

"data_exposure": {
"summary": "The extension accesses various online administrative services, including government portals and websites related to My Number cards. It sends data to these domains for authentication and authorization purposes.",
"technical": {
"domains": [
"https://mposs.force.com/*",
"https://portal.post.japanpost.jp/*",
"https://login.post.japanpost.jp/*",
"https://*.go.jp/*",
"https://*.e-shishobako.ne.jp/*",
"https://*.lg.jp/*",
"https://*.e-taxrenkei.jp/*",
"https://aizuwakamatsu.mylocal.jp/*",
"https://*.mypg.jp/*",
"https://*.onshikaku.org/*",
"https://*.online-web-development.net/*",
"https://portal.city.higashimurayama.tokyo.jp/*",
"https://nsa.pref.nara.jp/*",
"https://*.supportnavi.jp/*",
"https://*.su-mynote.jp/*",
"https://www.msc-kumamoto.jp/*",
"https://*.libe-mypg.jp/*",
"https://www.msc-ehime.jp/*",
"https://www.msc-tochigi.jp/*",
"https://www.okayama-musubi.jp/*",
"https://www.ems-kagawa.jp/*",
"https://www.msc-nagasaki.jp/*",
"https://*.smart-cert.d-secure.jp/*",
"https://www.msc-tottori.jp/*",
"https://www.online-a.com/*",
"https://api-smartlife-pf.com/*"
],
"protocols": ["HTTPS"],
"encryption_status": "Not specified",
"data_types": ["cookies", "tokens"]
}
],

"findings": [
{
"title": "Uses postMessage for cross-origin communications",
"severity": "medium",
"user_explanation": "This extension uses the postMessage API to communicate with other scripts across different domains. This is a common practice, but it can also be used for malicious purposes if not properly secured.",
"technical_detail": "The extension uses window.postMessage() to send and receive messages between scripts in different contexts. This allows for cross-origin communication, which can be useful for legitimate purposes like authentication or data sharing.",
"legitimate_use": "Legitimate extensions often use postMessage for secure communication with other scripts or services.",
"concern": false
},
{
"title": "Sets up event listeners",
"severity": "info",
"user_explanation": "This extension sets up event listeners to monitor user interactions and respond accordingly. This is a common practice in extensions that need to interact with the browser or other scripts.",
"technical_detail": "The extension uses addEventListener() to set up event listeners for various events, such as page loads, clicks, or keyboard input. These listeners allow the extension to respond to user interactions and perform tasks accordingly.",
"legitimate_use": "Legitimate extensions often use event listeners to interact with the browser or other scripts in response to user actions.",
"concern": false
}
],

"verdict": "Based on our analysis, we recommend exercising caution when using this extension. The nativeMessaging permission poses a critical risk if compromised, and the extension's data exposure is significant due to its interactions with various online administrative services. Users should carefully review their permissions and consider alternative solutions for accessing these services."
}