Can websites see my Firefox Addons? [duplicate]

I know when you visit a website, they can actually see a lot of your personal information, like browser type, but can they also see which addons I've installed?

What about something like Mozilla Plugin Check? How does it know what plugins I have?

I've installed Adblock Plus, but one webpage I visited redirected me because of it. How can it see I've installed ABP, and is there a way to hide this information?

Solution 1:

In general, a web site cannot tell what addons you have.

There are two ways that a web site can tell things about a web browser.

1. HTTP headers, such as User-Agent and Cookie, that the browser sends with the request.
2. Javascript code that the browser runs.

The HTTP headers do not include information about your addons. Click the link to view your own headers. Typically Firefox will include its version number, and information about your operating system, in the User-Agent header.

Javascript code that runs in your browser may detect the presence of some add-ons, if the Javascript specifically checks for something that indicates the presence of a particular add-on. Some sites specifically try to check for Adblock. The Adblock programmers try to prevent this but it is an arms-race between the sites and the Adblock programmers. You can block Javascript on a per-site basis with NoScript.

Solution 2:

Yes... and no. There's no simple way to do it for the most part, at least not inherently. Read, for example:

http://en.wikipedia.org/wiki/Adblock#Detection

Detection

Some webmasters have used JavaScript to detect the effects of the popular Adblock filters.[17] This has been done by generating a honeypot-like URL and verifying its delivery and also by more advanced verification of the DOM after the web page is rendered in the web browser to ensure the expected advertising elements are present.

These methods do not detect the presence of the Adblock extension directly, only the effects of the filters, and are vulnerable to continued updates to the filters, and by whitelist-filtering web scripts with an extension such as NoScript.

An attempt was made to detect the plug-in itself but that detection method was rendered unusable by the 0.7.5.2 update of Adblock Plus.[18]

So it's more trickery and picking up that the extension is present by finding the side effects and making an educated guess - but they can do it for some things.

As for hiding this information from a server, I don't know - it is probably possible but I know of no method.

Solution 3:

I'm positive that I saw a site that would list all of your enabled plugins (other than about:plugins which doesn't count for obvious reasons). However, I can't seem to find it anymore...