Hacker News Reader

Is it more of an attack vector than the hundreds of unvettable third-party scripts the site usually loads itself?

Absolutely. Scripts compromise your activity on the site they're loaded on. Extensions compromise your activity on every single website you go to.

If you're looking at it that way, then we should apply even more scrutiny over native apps we install on our machine and not single out extensions.

Also, not all extensions run on every single site. Also, some extensions actually help in blocking malware, crypto-trackers etc so the potential upsides are also great.

A script loaded by a site needs to escape its sandbox. I assume an extension script is not in its own sandbox so it can read you banking details when you visit a banking website. I imagine they can read key presses so an extension can know your banking passwords.

Which is why extensions also nowadays only served via a web store which has moderation policies and moderators which look for this kind of stuff.

The Chrome Web Store is functionally a malware distribution system. There's no real moderation to speak of, and the vast majority of desktop PC malware is distributed by it.

Reply on news.ycombinator.com