Show HN: Chrome/FF plugin brings the HN and Reddit conversation to you as you surf

Re:Show HN: Chrome/FF plugin brings the HN and Reddit conver... by jaredsohn on Sunday August 02, 2015 @08:00PM (#9993030)

> Because...sync storage in Chrome is not sandboxed or encrypted, the blocked list would be "in the open" to other extensions.

Unless things have changed from a couple of years ago (highly doubt it), I don't think this is the case. https://groups.google.com/a/chromium.org/d/msg/chromium-exte...

[ Parent | on HN ]

Re:Show HN: Chrome/FF plugin brings the HN and Reddit conver... by spenvo on Sunday August 02, 2015 @08:03PM (#9993041)

chrome.storage docs: "Confidential user information should not be stored! The storage area isn't encrypted." https://developer.chrome.com/extensions/storage

[ Parent | on HN ]

Re:Show HN: Chrome/FF plugin brings the HN and Reddit conver... by jaredsohn on Sunday August 02, 2015 @08:26PM (#9993092)

I was intending to just dispute that 'the blocked list would be "in the open" to other extensions'.

Why couldn't you use chrome.storage.local or the background page's localStorage? Either should protect the data from other extensions and not expose it to third parties.

[ Parent | on HN ]

Re:Show HN: Chrome/FF plugin brings the HN and Reddit conver... by spenvo on Sunday August 02, 2015 @08:32PM (#9993112)

I wanted explicit language from Chrome's docs about how it scopes storage.

Firefox provided it: "The simple storage module exports an object called storage that is persistent and scoped to your add-on." https://developer.mozilla.org/en-US/Add-ons/SDK/High-Level_A...

But all Chrome's docs said were the previously mentioned warning about not using it to store confidential user info.

So, to answer your question: caution

Actually, if you go back to my init commit on Github - you can see that I originally used the chrome.storage API. I extricated it from the code - except for the non-sensitive settings

[ Parent | on HN ]