Hacker News Reader

Isn't the more common problem that the extension contains malware from Google/FB? (This is definitely the case for phone apps.)

How do you deal with side channels when the page is running javascript that's being served by the attacker?

(Little Rat sounds like a great tool; I've been meaning to check it out.)

View on HN

for that, you can use ublock. Little Rat can block any traffic originating from a chrome extension. That includes content scripts injected by extensions into webpages, but not sites that you loaded.

I see. That’s pretty good. So, now the attack surface is reduced to the extension author exfiltrating data via burner domains that aren’t blocked by ublock, but that are explicitly added to legitimate web sites.

Reply on news.ycombinator.com