Does installing the KeePassXC-Browser extension in Tor Browser change its fingerprint or otherwise reduce security?

Question

KeePassXC’s browser integration documentation says:

The KeePassXC-Browser extension is installed within your web browser so that you can automatically pull usernames and passwords from KeePassXC and populate them directly into website fields. It is a very useful and secure extension that enhances your productivity while using KeePassXC. …

The KeePassXC-Browser extension is available on the following web browsers:

• …
• Mozilla Firefox and Tor-Browser

This sounds great. Except for that thing about not installing extensions in Tor Browser.

Crsi’s answer to “How Can I Stop Extension Fingerprinting in Tor?” says:

There are extensions that do not send any data to the server side and also don't affect the data processed by the browser. Thus, these are secure to not change your fingerprint. You can see a quick overview over what an extension wants to do when adding it (explanation).

The extension’s README describes the permissions:

Name	Reason
activeTab	To get URL of the current tab
contextMenus	To show context menu items
clipboardWrite	Allows password to be copied from password generator to clipboard
nativeMessaging	Allows communication with KeePassXC application
notifications	To show browser notifications
storage	For storing extension settings to localStorage
tabs	To request tab URL's and other info
webNavigation	To show browser notifications on install or update
webRequest	For handling HTTP Basic Auth
webRequestBlocking	For handling HTTP Basic Auth
http://*/*	To allow using KeePassXC-Browser on all websites
https://*/*	To allow using KeePassXC-Browser on all websites
https://api.github.com/	For checking the latest KeePassXC version from GitHub

This all seems fine, except perhaps for the last item about update checks.

Crsi’s answer goes on to say (the cited page is also accessible via an onion service):

But you should not add extensions to your TBB. From https://www.torproject.org/download/#warning:

We do not recommend installing additional add-ons or plugins into Tor Browser

Plugins or addons may bypass Tor or compromise your privacy. Tor Browser already comes with HTTPS Everywhere, NoScript, and other patches to protect your privacy and security.

Is this of any concern with this particular extension?

I tried searching the web. I found that the extension developers specifically worked on Tor Browser integration in issue #4123 and the extension is listed in the ArchWiki page for KeePass (with no comments on the extensions-in-Tor Browser issue). This is not particularly helpful.

---

Edit: Tails includes both Tor Browser and KeePassXC, but not the browser extension. The Tails documentation for KeePassXC says nothing about the browser extension. It does refer the reader to the Surveillance Self-Defense guide for KeePassXC, which includes instructions for the browser extension, but does not mention Tor (or Tor Browser).

Answer 1

After reading a bit, I've come to believe that this particular extension may or may not affect your anonymity. It's complicated and for me, I wouldn't use it. (I believe) it's just not worth the risk given that even one error can completely deanonymize you. Here's what I found:

---

On KeePassXC-Browser extension's private policy (https://addons.mozilla.org/en-US/firefox/addon/keepassxc-browser/privacy/) it states:

The extension adds content to the page DOM when needed. However, pages cannot know the extension is used.

So in terms of the addon being detected and being used to fingerprinting you, it seems unlikely (but it is always possible - there is always a chance). I don't know how exactly, but the addon may accidentally (or not) change something about your appearance to a website and make you visible. However, if this is what the extension says, you just have to trust that it is right when you use it.

Other than fingerprinting, the extension says:

The extension does not collect any information about user data or save it. When KeePassXC database is connected to the extension, and database is open, site URL is transmitted to KeePassXC for comparison. This is not saved or cached either.

So the extension is collecting the URL but claims it doesn't save it. You basically have to trust what it says if you plan to use it. There is always a risk that one day, the extension may decide to collect/store your data (not saying it will happen, but...) with or without telling you so you have to be careful.

Now the last thing I want to mention is that the extension's private policy states:

KeePassXC-Browser has an automatic update check, which will contact GitHub only so as to check for the most recent KeePassXC version. This check is optional and can be turned off in the settings. No additional data will be transmitted besides what is necessary to establish a connection.

Now, there is an (unlikely) possibility for data to be unintentionally (or intentionally) collected through this so you might want to consider disabling this feature if you don't want this.

---

It all comes down to this: do you trust this extension? Do you trust that it doesn't collect your data or harm your privacy/anonymity/security while using tor? Technically nothing can stop it from collecting data if you are using it and it wants to. From my viewpoint, it's just not worth the risk based on what I just said above. So you choose, will you use the extension?

By the way, since the extension is open source, I recommend checking out in detail the code (https://github.com/keepassxreboot/keepassxc-browser/tree/develop/keepassxc-browser). Hope this helps!