7 ms·
At this point, my browser's (Chrome's) URL bar reads "Secure | https://news.ycombinator.com/...." https://news.ycombinator.com/....". I have quite a few extensi
by sriku 10y ago
At this point, my browser's (Chrome's) URL bar reads "Secure | https://news.ycombinator.com/...." https://news.ycombinator.com/....". I have quite a few extensions loaded including ad blockers. Is the "Secure" statement trustable? Should window.crypto be trustable in the same way? ... as a guarantee provided by the browser in spite of extensions? Is that even possible?
- Klathmon 10y agoWell it's secure in that the connection between you and ycombinator is secure. But any of your extensions that have permission to modify the page, can be modifying it in any way shape or form. So they could be rewriting my comment, they could be calling out to external servers sending all the contents of your page, they could be recording every keystroke on that page, and more. So no, you can't trust that "Secure" statement absolutely. And while the browser could make window.crypto immutable or "un modifiable", it would be a false sense of security as an extension could just get the result from the page when it's put into the DOM.