Chrome should really come up with some better approach to its extensions. I consider myself a relatively cautious user (definitely well above average), and more

Chrome should really come up with some better approach to its extensions. I consider myself a relatively cautious user (definitely well above average), and more than once I've enabled an extension that, in a later moment of clarity, I turned off because of what the permissions allowed it to do. Part of the solution might be informational: make it more clear how dangerous it is to give an extension 'control' of a domain or, as it often the case, all the pages you ever visit. Or perhaps there are ways to make this more granular: considering that web apps are more and more powerful, limit not just on what domains an extension can operate, but limit what it can do. While I imagine this one is more challenging, if installing an extension says "this extension can READ and MODIFY stuff on <domain>, but will never send this data anywhere" could be a huge win (assuming this is possible to detect automatically). Finally, depending on how much power an extension has, Google could be more diligent about gatekeeping (assuming they aren't already). To give an example: I use cVim. It's permissions are: - Read and change all your data on the websites that you visit - Read and change your browsing history on all your signed-in - devices - Read and change your bookmarks - Read and modify data that you copy and paste - Manage your downloads I understand and accept that it needs to do these things, but it strikes me as rather important whether the plugin is allowed to GET/POST stuff too. Correct me if I'm wrong, but looking at my other plugins, this does not appear to be a specific permission. I'd basically be happy to allow a plugin access to everything the browser has on me, provided that it can't send this data anywhere. (and, assuming I'm wrong and this is actually a permission, clearly most of my phoning-home plugins seem to get around it using a somewhat opaque other permission to do this. probably "Read and change all your data on the websites that you visit", which sort of is correct, but shouldn't be)