As long as users know what the extension is doing, hope the extension owners win. Facebook has a choice to boot the users if they don't like them giving credentials to the extension.