3 ms·
You just described Manifest v3 Chrome extensions hosted on the Chrome Web Store. No remotely loaded code, frozen assets, third party review.
by modeless 3y ago
You just described Manifest v3 Chrome extensions hosted on the Chrome Web Store. No remotely loaded code, frozen assets, third party review.
- nightpool 3y agoCorrect. I know that there's a lot of concerns about Mv3 and I don't want to downplay them, but from a security perspective the team absolutely made the right and necessary calls that are required to prevent the (currently widespread) abuse of browser extensions for tracking and ads injection, not to mention malware distribution. I would trust an audited, Chrome-or-Firefox-store distributed browser extension to implement end-to-end encryption. I don't think that extends to UI elements injected into the page itself though—the UI elements where you're typing your messages have to be separate from the rest of the page to prevent malicious web apps from overwriting them and capturing your input before sending it on to the extension themselves.
- tptacek 3y agoFor what it's worth, the threat model for Chrome extensions is not the same as that of arbitrary websites. You can probably reasonably accomplish some things in extensions that are untenable on web pages.