> Avoid installing spurious, unknown or unnecessary extensions.
This is wrong. You absolutely must use an ad blocker or noscript extension if you intend to browse the web securely.
This is wrong. You absolutely must use an ad blocker or noscript extension if you intend to browse the web securely.
If I was using Firefox or IE, I would agree with you. But step one here is not to be using un-hardened browsers.
https://chrome.google.com/webstore/detail/password-alert/noo...
https://chrome.google.com/webstore/detail/https-everywhere/g...
GPA is great, but the premise behind this guide is that if you're relying on passwords for Google you're already boned. It's a security win even with TOTP enabled, but I don't think it's enough to earn a spot.
These guidelines are being distributed to activists and journalists along with free U2F keys, for whatever that's worth.
IME, it breaks too many sites to give to all end-users; if the default configuration omitted sites listed as 'Partial'; maybe it would be passable. Maybe have a subcategory for intermediate users and put it there. Novice-level users (for lack of a better term) have no idea why the website is not working, and thus don't even know to consider disabling HTTPS Everywhere.
Also, it makes the user easier to identify.