3 ms·
No, it would be straightforward if they asked the user something like this: "Is it ok that this extension sends every single URL you open to an untrusted third
by ThePhysicist 7y ago
No, it would be straightforward if they asked the user something like this:
"Is it ok that this extension sends every single URL you open to an untrusted third party for processing? Please note that URLs might contain sensitive data like access tokens or session information."
Even so, I don't think such an API should exist. And if you absolutely need to have something like this you should restrict it to domain information by default, cutting away the path.
I can understand that Google might not care much about this (Chrome itself is a data collection platform), but I really don't get why Mozilla is so lenient about it as well, as their main differentiator has been user privacy for years.
- the8472 7y ago> Even so, I don't even think such an API should exist. There is no "exfiltrate all my history" in the webextension APIs. What exists are two distinct and reasonable components. A) accessing browsing history/current tabs/network requests¹. all things required for extensions to work B) ability to make generic network requets Combining these two can be used to exfiltrate data. But that does not mean that any particular extension that has access to both will also exfiltrate private data. Thus a blanket warning would be overly broad and anything more targeted would require manual sourcecode inspection. ¹ Those require separate permissions, but for the purpose of the discussion they can all be used to harvest data
- qtplatypus 7y agoWasn't there a big story on HN about how chrome had disabled the ability for plugins to see your URLs and how adblocker plugin makers where up in arms about it?