6 ms·

"Can read and change your data on google.com" is the opposite of reassuring.

• horsawlarway 5y ago
  It means they can view/modify the DOM of those sites. Lots of harmless reasons to want to do that (ex: adding a link/button) but yes, it also means they can grab the text content of the site (read your data) and change the site DOM or your text nodes (change your data). Just because they can doesn't mean they do, though (but it also doesn't mean they don't... shrug). Again - the problem here is there's absolutely no way to tell the browser "Hey, I don't want to see text nodes, just put this button here in the DOM". --- I should add - they appear to have only requested www.google.com, which is usually just search. Gmail/Docs/Sheets/Suite/Other are usually under seperate subdomains - ex: gmail is mail.google.com.
  • martin_a 5y ago
    > It means they can view/modify the DOM of those sites. Not really into this topic (extensions), but could this capability be used by an extension to create fake (invisible) login forms, grab your login data through auto-complete and send it home?
    • horsawlarway 5y ago
      I mean - yes, although there's no real reason to even bother with the fake login form. They could just monitor the real login form the next time you login. That said - at least for google, login is on accounts.google.com - so they aren't asking for that here. Additionally, these extensions do go through review by google - something as blatant as a content_script that's phoning home with login details would ideally be caught (I develop extensions for work, but haven't tried submitting something malicious for review - so I can't really comment on whether they DO actually catch it)