12 ms·
Does anyone know how big a deal this really is? So a handful of developers (and their employers) have my full browser history. What could possibly go wrong?
by theseatoms 11y ago
Does anyone know how big a deal this really is?
So a handful of developers (and their employers) have my full browser history. What could possibly go wrong?
- scrollaway 11y agoIf someone else has it, everyone has it. You're never safe from a leak.
- danr4 11y agoThey store access tokens to your private accounts ie. Gmail. They/future hackers can use them to access your accounts.
- striking 11y agoThey can't steal cookies, because HttpOnly exists: http://blog.codinghorror.com/protecting-your-cookies-httponly/ http://blog.codinghorror.com/protecting-your-cookies-httponl... They can take your passwords, though. If you install an extension that "can access your data on all sites", I hope your trust is well-founded.
- borski 11y agoTo be clear, they can definitely steal cookies if the HTTPOnly flag isn't enabled. About 60% of the session cookies we see in our scans don't have it enabled. Scary.
- me_again 11y agoThe extension developers sell the right to embed arbitary tracking code in the extension. That code puts it on a site which arbitrary users can pay to get access to. Still not worried?