Hacker News Reader

The biggest problem is that Chrome Extensions don’t have granular enough permissions. I’ve seen developers write explanations of needing access to “all your data” because of one small feature they need access to.

They should also add some monitoring regarding domains extensions talk to. Or even make developers add a description of outgoing requests from extensions somehow.

View on HN

You already have to do that. In the extension manifest you need to specify URLs you need to access. I'm pretty sure the process of approving an extension is entirely automated though, so there isn't any real accountability unless an extension is specifically investigated.

In practice many extensions need access to all URLs.

Reply on news.ycombinator.com