3 ms·
A couple of notes on the article: 1. I'm really surprised legit vendors like LastPass don't become verified authors on the Chrome webstore; it's trivial to set
by borisjabes 14y ago
A couple of notes on the article:
1. I'm really surprised legit vendors like LastPass don't become verified authors on the Chrome webstore; it's trivial to setup. We were able to do this for Meldium easily.
2. Joe's comments that it's hard to write an extension that steals data does not seem very true. Someone who is dedicated can do a lot with Javascript.
3. The author doesn't mention the model Mozilla follows with its addons: actual humans code review extensions to determine trustworthiness. They reject extensions containing obfuscated code for example.
- rictic 14y agoAgreed. It would be a rather short script to, e.g., send every js-accessible cookie on every site you visit up to a third party. It doesn't take a lot of code to capture a lot of high value data. The supposition that it does is quite strange.