As an open-source extension developer, I wish there was a way to prove that the extension uploaded is generated from a specific git commit. It wouldn't solve everything, but it would make it easier for anyone to audit the code and know that it actually matches the code I've uploaded.

Indeed. I was thinking about this, and would argue this should really not only exist... but be the only way extensions with this level of wide-sweeping access should be permitted to be published.

Chrome team, if they were security-focused, would not permit any closed source extensions which have access to all website data.

People don't seem to understand sometimes that if an extension has this sort of access, you need to be able to trust your browser extensions as much as you trust your browser itself.

I'd add to that "not obfuscated" too since JS minimization and WASM can be as obscure as binary.

> I personally stay far away from password managers

I am curious how you manage your passwords.

Use an out of band password manager, whose key is never transmitted over a network. Or a notebook that is physically secured. There are a number of solutions for password vaults, and you can use a variety of means to synchronize them if needed.

The notion that it's a good idea to trust a browser extension for secrets management is pretty bizarre to me if you're protecting high value assets.

As always, it depends on your threat assessment and what is practically possible. For the vast majority of users, using a password manager browser extension [1] is a large improvement over password re-use over dozens of sites. Most folks will also not want to put in the effort to use an out-of-band password manager.

(Not directed at you personally, but I often hear such comments from people who are then perfectly fine to use a password manager in X11, where in a the default configuration every application can read your keystrokes, screen grabs, clipboard, etc.)

[1] Preferably one that communicates with an out-of-process password manager over an authenticated channel like 1Password.

I love passphrases and mnemonics. There are passwords that I retired out of anywhere they existed several years ago that I will probably never forget as long as I live. And not only is it easy to create memorable passphrases, and they're fairly long, you can then combine your passphrases in interesting combinations to get even more passwords that you probably will never forget.

Beyond that, the "never reuse passwords" adage is horribly oversold. If it handles my money, my email, or my web hosting, it needs to be unique. Passwords for places I comment are commonly reused and not as sophisticated because it is not seriously impactful to me if someone gets a hold of them.

Reuse passwords for sites that can't meaningfully harm you if they get compromised. Minimize how many accounts can harm you by not saving your credit card info in most of them, uncheck that box when you pay for stuff.

I'm also insanely liberal about deploying 2FA. I have it everywhere it's available, even sites with common/stupid passwords. So a lot of sites I don't bother with unique passwords will still be somewhat protected if my password is compromised. I'm also subscribed to haveibeenpwned with every email address I've ever used for anything.

Memory

In other words, you're not using strong, unique passwords, and your security is likely nil.

A Chrome extension even with all available permissions doesn't have access to your password manager. (It could record the passwords as they're typed or autofilled into a webpage, but it doesn't make a difference whether you're using your browser's password manager or typing it yourself there.)