It's 100% open source! Please feel free to review it.

http://github.com/codebutler/firesheep

It doesn't currently do anything with passwords, it's only pulling out cookies from HTTP Response headers. But it would be trivial to also get passwords in non-HTTPS requests for logins with the same method.

Again, not assuming you're evil, but it's possible that the compiled binary (.xpi) was not created from the source posted on the github account :)

Indeed. Sorry if I implied that you were doing evil things.

People should also be aware of the security implications of installing various software on their system. :)

Passwords are not a part of this... It's the session cookie, which is an entirely different matter. It's unique to the login process, so one compromised account isn't able to lead to compromising other websites. It's also time sensitive (generally) and so that hijacked cookie will expire. If he were collecting all this information, he wouldn't be able to do much with it.

Just because the user interface only exposes cookies, doesn't mean that passwords aren't captured and sent somewhere.

It's very possible, given that the extension seemingly captures HTTP requests/responses. If passwords are sent or received in plaintext, then they can be captured.

Not sure why you're being downvoted, seems like a legitimate question to me! I was a little leery of checking it out at first, too, but curiosity got the better of me...

Maybe someone who has developed a FF extension can lay my worries to rest -- could this have, say, a built in key logger which sends that data to the author?

I downloaded the source code from github and glanced through it, enough to comfort me somewhat, but I wasn't super thorough.

All that said, EricButler seems to be an HN member in good standing, and someone like that wouldn't do anything malicious, right? :-)