3 ms·
why an extension needs all website permission, even then can't google provide a mechanism to avoid password fields out of scope of access. Is there a reason why
by rammy1234 8y ago
why an extension needs all website permission, even then can't google provide a mechanism to avoid password fields out of scope of access. Is there a reason why it is not done ? technically speaking.
- chatmasta 8y agoLazy developers, that’s all there is to it. And of course some extensions do need access to the whole page, including password fields. For example a password manager obviously needs access (though it shouldn’t need to read the password field, only write to it). As to why it’s not possible to have super granular permissions (i.e. restricting to certain elements on the page) — that would break the whole extension model, because scripts you inject into the page would have to operate on a “shadow DOM” of sorts. Also properly sand boxing within a single DOM would be porously impossible. Now that I type it out though, I could see how maybe it would be possible to construct a restricted, parallel DOM for an extension to interact with... but I really don’t think the complexity is worth changing the status quo.