Browser Extensions, Sessions, and the Account You Thought 2FA Protected

A strong password and two-factor authentication are still two of the best things you can do for an account.

They just don't protect every door.

One of the doors people rarely think about is the session.

When you sign in to a website, the site needs a way to remember that you already proved who you are. Otherwise, you would have to enter your password and second factor again every time you opened another page.

That convenience creates something valuable: a trusted session.

Now add browser extensions.

Extensions are software, not decorations. Depending on the permissions you give them, some can read or change information on the websites you visit.

Microsoft Edge, for example, can let an extension access a site only when you click the extension, on specific sites, or across all sites. Firefox also lets you review extension permissions and the types of data an extension can access or collect. Microsoft Support

That doesn't mean browser extensions are bad.

It means their access matters.

Open your extension manager and ask five questions:

What does this extension do?
Do I still use it?
Who publishes it now?
What sites or information can it access?
Can I reduce that access and still keep the feature I want?

If you don't use an extension anymore, remove it.

If an extension has broad access but only needs to work on one site, reduce that access when your browser gives you the option.

The goal isn't to strip your browser down until it's miserable to use. It's to stop giving software access it doesn't need.

If you think an account or browser has been compromised

Don't stop at changing the password.

Go to the account's security settings and look for active sessions, signed-in devices, or a “sign out everywhere” option. Remove sessions or devices you don't recognize. Where the service provides a global sign-out option, use it when appropriate. Microsoft, for example, provides a “sign out everywhere” control for Microsoft accounts. Microsoft Support

Then:

Change the password or passkey.
Check the recovery email and phone number.
Verify that two-factor authentication is still configured correctly.

Changing a password is important. But if you're responding to a suspected compromise, you want to check the other pieces of trust around the account too.

What changes?
Forgotten or over-privileged software gets less automatic access.

What still works?
The extensions you actually need can stay installed. Your accounts remain usable. Your browser still works like a browser.

That's the point of hardening.

Reduce the trust you don't need without breaking the technology you do.

Harder to target. Not harder to use.

Sources: Microsoft Edge — Change site access permissions for extensions · Mozilla — Extension data collection · Mozilla — Manage optional permissions for Firefox extensions · Microsoft — Sign out of your Microsoft account everywhere