I too was thinking exactly this. I watched the crypto walkthrough video on the kickstarter page and though what was shown looked solid, it didn't mention this. Would it turn into a client-side JS-war between the extension and the host (FB, etc)? It would be nice if someone involved in the project could mention this and why it's not a problem. Thanks! Edit: clarified.