Browser extensions and free software: what to install and what to avoid

Someone on your team finds a free PDF converter, a browser extension that promises coupons, or a tool a friend recommended. Most of the time it is harmless. Sometimes it is the way an attacker gets in, and the difference is not obvious from the download page. This article explains how we approach it.

Why we check first

Browser extensions can read everything on every page you visit, including your email and the systems you sign in to. Free software often bundles extra programs, changes your search engine or quietly sends data back to someone. And a popular tool's name is easy to copy: fake download pages for well-known programs are one of the most common ways malware is spread. On managed computers, installing software needs an administrator, so these requests come to us, and that pause is deliberate.

What we look at

Who publishes it and whether they are a real, reachable company. Whether the download comes from the maker's own site or an official store rather than a third-party download site. What permissions an extension asks for, and whether they match what it does. How it is paid for, because software that is free with no visible business model is often paid for with your data. Whether it is still maintained and gets security updates. Whether its license allows business use; many "free" tools are free for personal use only.

Good signs

Open-source software with an active community, tools from established vendors, and anything already built into Microsoft 365 or your operating system. Quite often the free tool someone wants duplicates something you already pay for: Microsoft 365 already converts, edits and signs PDFs, records your screen, and translates text.

Warning signs

A download that arrives by email or a pop-up. A page that insists you need to "update your player" or "install a codec" to view something. An extension with few users, no publisher website or a flood of identical five-star reviews. Anything that asks you to turn off your antivirus to install it. Any "cracked" or "free" version of paid software; these are almost always carrying something.

How to ask

Email hello@bitnode.tech with the name of the tool, a link to it and what you want to do with it. If it is fine, we install it. If there is a better or safer option, we suggest it. If you already installed something and now feel unsure about it, tell us; there is no trouble for asking, and it is far better than finding out later.