I've been developing Chrome extensions full-time for about a year now [1], and it's honestly terrifying just how much access extensions have to sensitive user d

I've been developing Chrome extensions full-time for about a year now [1], and it's honestly terrifying just how much access extensions have to sensitive user data. Best practices I've adopted for my own extension use: - Create a separate test Chrome profile to try out extensions - Delete extensions that ask for the overly broad "Read and change all your data on the websites you visit" permission unless (a) the extension is open-source (b) backed by a reputable company or (c) has a very good reason for requesting it, and I trust the makers One of the biggest issues with extensions today is the permissions model. On more established platforms like iOS and Android, all sensitive permissions have to be requested at runtime rather than at install-time, which forces developers to explain why they need the permissions they ask for. With browser extensions, there's no such requirement, which leads many developers to ask for all the permissions they can get because there's no downside to doing so. That's why over 80% of the top 1000 extensions ask for access to ALL domains [2], which means they have the power to steal any of your data (emails, passwords, etc.) on any site if they wanted or became compromised. I've written about this issue before [3] and the good news is that with Manifest V3, the Chrome team is planning to require that host permissions (which specifies the domains an extension can run on) be requested at runtime. I think the team should go even further and enforce the runtime restriction for all sensitive permissions, not just host permissions — if you agree, feel free to chime in on the post I made about it on the chromium-extensions mailing list [4]. The extension ecosystem is pretty broken right now security and privacy-wise, but with the upcoming changes, it's headed in a better direction. [1] https://news.ycombinator.com/item?id=22936742 https://news.ycombinator.com/item?id=22936742 [2] https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3NzzhHzc-qnk4w4PX-0XMw8/edit#heading=h.oenw1ekaaubz https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3Nzz... [3] https://www.notion.so/dkthehuman/Day-4-The-Dangers-of-Chrome-Extensions-af93b84006ed48c18b807f512b6c0a07 https://www.notion.so/dkthehuman/Day-4-The-Dangers-of-Chrome... [4] https://groups.google.com/a/chromium.org/d/msg/chromium-extensions/gJZFu8UsX4M/DigVX25cBQAJ https://groups.google.com/a/chromium.org/d/msg/chromium-exte...