KeePassXC’s browser integration documentation says:
The KeePassXC-Browser extension is installed within your web browser so that you can automatically pull usernames and passwords from KeePassXC and populate them directly into website fields. It is a very useful and secure extension that enhances your productivity while using KeePassXC. …
The KeePassXC-Browser extension is available on the following web browsers:
- …
- Mozilla Firefox and Tor-Browser
This sounds great. Except for that thing about not installing extensions in Tor Browser.
Crsi’s answer to “How Can I Stop Extension Fingerprinting in Tor?” says:
There are extensions that do not send any data to the server side and also don't affect the data processed by the browser. Thus, these are secure to not change your fingerprint. You can see a quick overview over what an extension wants to do when adding it (explanation).
The extension’s README describes the permissions:
Name Reason activeTab
To get URL of the current tab contextMenus
To show context menu items clipboardWrite
Allows password to be copied from password generator to clipboard nativeMessaging
Allows communication with KeePassXC application notifications
To show browser notifications storage
For storing extension settings to localStorage tabs
To request tab URL's and other info webNavigation
To show browser notifications on install or update webRequest
For handling HTTP Basic Auth webRequestBlocking
For handling HTTP Basic Auth http://*/*
To allow using KeePassXC-Browser on all websites https://*/*
To allow using KeePassXC-Browser on all websites https://api.github.com/
For checking the latest KeePassXC version from GitHub
This all seems fine, except perhaps for the last item about update checks.
Crsi’s answer goes on to say (the cited page is also accessible via an onion service):
But you should not add extensions to your TBB. From https://www.torproject.org/download/#warning:
We do not recommend installing additional add-ons or plugins into Tor Browser
Plugins or addons may bypass Tor or compromise your privacy. Tor Browser already comes with HTTPS Everywhere, NoScript, and other patches to protect your privacy and security.
Is this of any concern with this particular extension?
I tried searching the web. I found that the extension developers specifically worked on Tor Browser integration in issue #4123 and the extension is listed in the ArchWiki page for KeePass (with no comments on the extensions-in-Tor Browser issue). This is not particularly helpful.
Edit: Tails includes both Tor Browser and KeePassXC, but not the browser extension. The Tails documentation for KeePassXC says nothing about the browser extension. It does refer the reader to the Surveillance Self-Defense guide for KeePassXC, which includes instructions for the browser extension, but does not mention Tor (or Tor Browser).