'A hacker could create a script that does something users want, but also makes a call to the hacker's server, sending your cookies to that machine,' Boodman wrote. 'They would still need to break into someone's computer to install the script, but the tool would make the theft process much easier.'Īaron Boodman, the 26-year-old programmer in Seattle who wrote Greasemonkey, declined to comment on the extension or on its security implications.īut in a recent posting to his Web site, he acknowledged its security liabilities, and worried that Greasemonkey would become vulnerable as a result of its increasing notoriety. 'The bad guys could likely create a script for stealing usernames and passwords in login forms using this tool,' Smith said. User scripts also could facilitate password-stealing schemes, said security consultant Richard Smith, who runs the ComputerBytesMan Web site. In what could signal a trend toward user scripts, Norwegian browser maker Opera Software has picked up the idea, adding similar functionality to beta 3 of Opera 8, acknowledging Greasemonkey on its Web site. (CNET 's tests of various scripts showed that some were more successful than others at delivering promised results.) One, called 'Butler,' is meant to remove ads on Google results pages, add links to competing search sites, and remove image copy restrictions from Google Print. Others are designed to execute more substantial changes, such as making connections to Yahoo Mail and Gmail more secure. They can also change Slashdot's colors and make the site 'less ugly,' the page says. They can, for example, transform story links on The New York Times site and take readers to ad-free, printable versions. By manipulating the Dynamic HTML, or DHTML, of a Web page, Greasemonkey scripts can perform a host of tasks, according to the GreaseMonkey UserScripts page.

Is tampermonkey software safe