4 ms·

This seems nice, but the permissions are scary. Giving access to "your data on *.google.com and mail.google.com" to get a slightly better UI is a hard propositi

This seems nice, but the permissions are scary. Giving access to "your data on *.google.com and mail.google.com" to get a slightly better UI is a hard proposition to accept. I wish Chrome had more fine-grained permissions, like "you give this extension permission to modify the stylesheet on xyz.com, but not to access your data"."

xpressyoo 15y ago
Yes, you're right. A better granularity on the permission settings would be a nice feature to add in the webstore. Just to comment on this point, "Your tabs and browsing activity" comes from the fact that the extension modifies the style and UI of Gmail within your browser and so needs to know whether Gmail is open in your browser (i.e. tabs) to apply those changes, nothing more. To make things clear, Gmelius will never access, read, store, or transmit your personal data.
- simonbrown 15y ago
  To inject a content script, you just need permission to access that site.
  - devicenull 15y ago
    And if you're injecting a script, you can read all the data off that page.
    - simonbrown 15y ago
      But you don't need "tabs" aka "Your tabs and browsing activity".
bnr 15y ago
I doubt that would make things a lot safer. With permission to modify only the stylesheet, one could already change the login form to phish your password.
- simonbrown 15y ago
  How? I agree that something like that would be risky (you could style the delete button to say "reply"), but I'm not sure how you could do that. Stylesheets can't change a form's action.
  - bnr 15y ago
    I was thinking it would be possible by crafting pseudo elements to a replacement login form, but after reading some more that actually does not seem possible. Maybe one could make the email composition form look like the login form under some conditions. On the other hand, reddit allows people to upload stylesheets for their subreddits, they only re-host the images in them and that seems to have worked out well.

xpressyoo 15y ago

Yes, you're right. A better granularity on the permission settings would be a nice feature to add in the webstore. Just to comment on this point, "Your tabs and browsing activity" comes from the fact that the extension modifies the style and UI of Gmail within your browser and so needs to know whether Gmail is open in your browser (i.e. tabs) to apply those changes, nothing more. To make things clear, Gmelius will never access, read, store, or transmit your personal data.

simonbrown 15y ago
To inject a content script, you just need permission to access that site.
- devicenull 15y ago
  And if you're injecting a script, you can read all the data off that page.
  - simonbrown 15y ago
    But you don't need "tabs" aka "Your tabs and browsing activity".

bnr 15y ago

I doubt that would make things a lot safer. With permission to modify only the stylesheet, one could already change the login form to phish your password.

simonbrown 15y ago
How? I agree that something like that would be risky (you could style the delete button to say "reply"), but I'm not sure how you could do that. Stylesheets can't change a form's action.
- bnr 15y ago
  I was thinking it would be possible by crafting pseudo elements to a replacement login form, but after reading some more that actually does not seem possible. Maybe one could make the email composition form look like the login form under some conditions. On the other hand, reddit allows people to upload stylesheets for their subreddits, they only re-host the images in them and that seems to have worked out well.