Re:Grammarly shared its tokens with all websites
by paulgb on Tuesday February 06, 2018 @12:19PM
(#16317686)
As an open-source extension developer, I wish there was a way to prove that the extension uploaded is generated from a specific git commit. It wouldn't solve everything, but it would make it easier for anyone to audit the code and know that it actually matches the code I've uploaded.
[ Parent
| on HN ]
Re:Grammarly shared its tokens with all websites
by ocdtrekkie on Tuesday February 06, 2018 @12:30PM
(#16317778)
Indeed. I was thinking about this, and would argue this should really not only exist... but be the only way extensions with this level of wide-sweeping access should be permitted to be published.
Chrome team, if they were security-focused, would not permit any closed source extensions which have access to all website data.
People don't seem to understand sometimes that if an extension has this sort of access, you need to be able to trust your browser extensions as much as you trust your browser itself.
Re:Grammarly shared its tokens with all websites
by paulryanrogers on Tuesday February 06, 2018 @02:55PM
(#16319007)
I'd add to that "not obfuscated" too since JS minimization and WASM can be as obscure as binary.