Stupid questions:
1) Would a plugin such as Disconnect.me stop this from happening? (Yes, I am aware of the irony...)
2) What's the best way for a non-technical person to monitor traffic to ensure that plugins are not "phoning home"?
1) Would a plugin such as Disconnect.me stop this from happening? (Yes, I am aware of the irony...)
2) What's the best way for a non-technical person to monitor traffic to ensure that plugins are not "phoning home"?
1. Unlike that other "privacy" cough extension, Disconnect doesn't send any data (user or otherwise) to Disconnect servers. In other words, Disconnect doesn't output user data that can be intercepted by a MITM attack. Disconnect does grab a config file on startup (https://disconnect.me/help#syncing), but unlike in the Amazon case, the file is both transferred over HTTPS and encrypted (with the Stanford Javascript Crypto Library). Also unlike in the Amazon case, the file has a limited functional scope (which third-party sites to block) so is less susceptible to being rewritten in an abusive way.
2. One of our other Chrome extensions, Collusion for Chrome, will actually show you requests that are coming from other extensions. The more technical approach, which isn't that hard and I'd like to see more people try, is to run a packet sniffer (recommended: http://www.wireshark.org/) or proxy server (recommended: http://www.charlesproxy.com/).
TLS already encrypts. What threat model prompted your decision to use JavaScript cryptography?