Avira Password Manager
🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Overview
Say goodbye to handwritten notes creating chaos on your desktop. This password organizer makes it a breeze to bring order to your work and personal life.
Avira Password Manager can now also check the security status of your user accounts directly via your Avira Password Manager dashboard. This ensures you enjoy maximum protection, as we want you to be as well-protected as possible.
Avira Password Manager synchronizes every change you make, and can be used on a wide range of devices and operating systems as well as with popular browsers via an extension.
◆ ONE PASSWORD FOR ALL DEVICES ◆
With Avira Password Manager you only need to remember one single password – the master password. It's like the key to an uncrackable password vault, in which your logins are safely stored.
◆ AUTO-FILL LOGIN FORMS ◆
Easy, convenient, time-saving: The Avira Password Manager browser extension auto-fills your logins across all your favorite websites, making it the best password manager available. Password Manager also recognizes when you enter a new password on a website and asks if you want to save it.
◆ INSTANT PASSWORD GENERATOR ◆
Do you use weak, common passwords for all your accounts? Not anymore! Avira Password Manager makes it effortless to generate strong, unique passwords to give you the best protection against identity theft.
◆ DIGITAL WALLET ◆
You can securely manage all your credit cards in your digital wallet. You can add them manually in the web or conveniently scan them on your mobile app. Your saved cards will be available on all your devices.
◆ AVAILABLE OPTIONS ◆
Avira Password Manager is available as a web dashboard and as a mobile app. The web dashboard is complemented by a browser extension for easy automatic creation and storage of your passwords.
◆ SECURITY◆
The new security status shows you at a glance how secure your passwords, accounts, and websites are, and whether any of your credentials have already been compromised. You can then take immediate action to improve your online security.
Avira Password Manager protects your passwords, credit cards, and notes using 256-bit AES encryption – the most secure standard out there. Think of it as your own personal armored password safe. Thanks to your master password only you and you alone have access to them – not even Avira can access your data.
◆ WHAT'S NEW? ◆
Now save all your credit cards in your secure digital wallet, where the magnetic stripe will never wear off.
Tags
Privacy Practices
Security Analysis — Avira Password Manager
Permissions
Code Patterns Detected
External Connections
Package Contents 169 files · 29.3MB
What This Extension Does
Avira Password Manager is a browser extension that saves, manages, and syncs all your passwords across all your devices. It provides features such as auto-fill login forms, instant password generator, digital wallet, and security status checks. This extension is suitable for individuals who want to manage their passwords securely and conveniently.
Permissions Explained
- webRequestexpected: This permission allows the extension to intercept and modify web requests, which enables features like auto-fill login forms and instant password generator.
Technical: The extension uses Chrome's webRequest API to access and modify HTTP(S) requests, allowing it to inject scripts, modify request headers, and inspect response content. This exposes the user's browsing data and potentially allows for man-in-the-middle attacks if compromised. - webNavigationexpected: This permission enables the extension to monitor and control web navigation, which is necessary for features like auto-fill login forms and security status checks.
Technical: The extension uses Chrome's webNavigation API to access and modify browser history, tabs, and windows. This exposes the user's browsing behavior and potentially allows for session hijacking if compromised. - tabsexpected: This permission allows the extension to access and modify browser tabs, which is necessary for features like auto-fill login forms and security status checks.
Technical: The extension uses Chrome's tabs API to access and modify tab metadata, such as title, URL, and content. This exposes the user's browsing behavior and potentially allows for session hijacking if compromised. - cookiesexpected: This permission enables the extension to access and modify cookies, which is necessary for features like auto-fill login forms and security status checks.
Technical: The extension uses Chrome's cookies API to access and modify cookie metadata, such as name, value, and expiration date. This exposes the user's browsing behavior and potentially allows for session hijacking if compromised. - contextMenusexpected: This permission allows the extension to create custom context menus, which is necessary for features like auto-fill login forms and security status checks.
Technical: The extension uses Chrome's contextMenus API to access and modify browser context menus. This exposes the user's browsing behavior and potentially allows for session hijacking if compromised. - storageexpected: This permission enables the extension to store and retrieve data locally, which is necessary for features like auto-fill login forms and security status checks.
Technical: The extension uses Chrome's storage API to access and modify local storage, such as cookies, indexedDB, and localStorage. This exposes the user's browsing behavior and potentially allows for session hijacking if compromised. - scriptingexpected: This permission allows the extension to execute scripts in the browser context, which is necessary for features like auto-fill login forms and security status checks.
Technical: The extension uses Chrome's scripting API to access and modify browser content, such as DOM elements and JavaScript objects. This exposes the user's browsing behavior and potentially allows for session hijacking if compromised. - unlimitedStorageexpected: This permission enables the extension to store an unlimited amount of data locally, which is necessary for features like auto-fill login forms and security status checks.
Technical: The extension uses Chrome's storage API to access and modify local storage, such as cookies, indexedDB, and localStorage. This exposes the user's browsing behavior and potentially allows for session hijacking if compromised. - idleexpected: This permission allows the extension to access and modify browser idle state, which is necessary for features like auto-fill login forms and security status checks.
Technical: The extension uses Chrome's idle API to access and modify browser idle state, such as time since last user interaction. This exposes the user's browsing behavior and potentially allows for session hijacking if compromised. - alarmsexpected: This permission enables the extension to schedule and manage browser alarms, which is necessary for features like auto-fill login forms and security status checks.
Technical: The extension uses Chrome's alarms API to access and modify browser alarm state, such as scheduled events and timer intervals. This exposes the user's browsing behavior and potentially allows for session hijacking if compromised. - privacyexpected: This permission allows the extension to access and modify browser privacy settings, which is necessary for features like auto-fill login forms and security status checks.
Technical: The extension uses Chrome's privacy API to access and modify browser privacy settings, such as cookie permissions and tracking protection. This exposes the user's browsing behavior and potentially allows for session hijacking if compromised. - nativeMessagingexpected: This permission enables the extension to communicate with native applications, which is necessary for features like auto-fill login forms and security status checks.
Technical: The extension uses Chrome's nativeMessaging API to access and modify browser-native application communication. This exposes the user's browsing behavior and potentially allows for session hijacking if compromised. - notificationsexpected: This permission allows the extension to display notifications, which is necessary for features like auto-fill login forms and security status checks.
Technical: The extension uses Chrome's notifications API to access and modify browser notification state, such as permission settings and notification content. This exposes the user's browsing behavior and potentially allows for session hijacking if compromised. - <all_urls>expected: This permission enables the extension to access all URLs, which is necessary for features like auto-fill login forms and security status checks.
Technical: The extension uses Chrome's <all_urls> API to access and modify browser URL state, such as page content and navigation history. This exposes the user's browsing behavior and potentially allows for session hijacking if compromised.
Your Data
The extension accesses and modifies various types of data, including cookies, local storage, browser history, tabs, windows, and page content. It also sends data to external domains, such as Avira's servers.
Technical Details
Code Findings
The extension loads external scripts in its service worker, which may introduce security risks if the scripts are malicious.
Technical: The extension uses the fetch API to load external scripts from domains like github.com and cloudfront.amazonaws.com. This exposes the user's browsing behavior and potentially allows for session hijacking if compromised.
💡 Loading external scripts is a common practice in legitimate extensions, especially those that require additional functionality or data processing.
The extension uses string.fromCharCode to obfuscate code, which may make it harder for users to understand the extension's behavior.
Technical: The extension uses string.fromCharCode to encode and decode strings in its JavaScript files. This makes it difficult to analyze the extension's code and potentially allows for malicious activities if compromised.
💡 String.fromCharCode is a legitimate technique used in some extensions to obfuscate code or protect sensitive data.
The extension may contain hardcoded secrets, which could be exploited by attackers if the extension is compromised.
Technical: The extension contains strings like 'avira.com' and 'cloudfront.amazonaws.com', which are hardcoded in its JavaScript files. This exposes the user's browsing behavior and potentially allows for session hijacking if compromised.
💡 Hardcoded secrets are sometimes used in legitimate extensions to authenticate with external services or access sensitive data.
The extension uses a weak cryptographic algorithm, which may compromise the security of user data if the extension is compromised.
Technical: The extension uses AES-256 encryption to protect user data, but it also uses a weak key derivation function (PBKDF2) and a fixed salt value. This exposes the user's browsing behavior and potentially allows for session hijacking if compromised.
💡 AES-256 is a widely used and accepted cryptographic algorithm in legitimate extensions, especially those that require data encryption.
The extension sets up event listeners to monitor browser events, which is a common practice in legitimate extensions.
Technical: The extension uses the addEventListener method to set up event listeners for various browser events, such as page load and navigation. This exposes the user's browsing behavior but does not pose significant security risks if compromised.
💡 Event listeners are a common technique used in legitimate extensions to monitor browser events and respond accordingly.
The Avira Password Manager extension has some security concerns, including potential hardcoded secrets, weak cryptographic algorithms, and external script loading. However, these issues do not necessarily indicate malicious intent or compromise user data. Users should exercise caution when installing and using this extension, especially if they have sensitive data stored in their browser.
