Ferro creator here. The answer is of course no, Ferro was not looking at your coinbase or stripe data. It was only loading the API scripts from those domains asynchronously in order to reduce the load time of the options page, and to do so it needed those domains in the permissions list. I just published v1.0.9, in which I have switched it back to the slow version and removed the coinbase/stripe permissions from the manifest. Once you receive the update (<1 hr), you can visit `chrome://extensions/` and click the Ferro "Permissions" link to confirm. For more information, see https://github.com/ferro/ferro/issues/9

I wonder what sort of success you'd have by doing social engineering like this:

    Show HN: Something something Chrome extension

Except it's actually malware.

Disclaimer: I do not have much of an expertise in web technologies, and I do not have bitcoins.

But when I look at http://www.getferro.com/#security, I see:

    Ferro does not transmit your personal information to nor
    store it on our servers. That includes, for instance, 
    your browsing history, bookmarks, and saved sessions. The     
    only personal information stored is your saved sessions, 
    and that is either stored on your computer, or if you 
    are signed into Chrome, on Chrome's sync servers, which 
    are secured by Google.

    The only dynamic content that is displayed to you and 
    did not originate from you is the list of recent 
    donations on the options page, and that data is escaped.

To those in the know, would they need access to your data to be able to send info from coinbase and stripe to you, or for donations?

I don't know about Ferro, but even vimium asks for this many permissions. I guess this due to the way it will handle shortcuts and bindings. I was hesitant to install vimium because of this but it is open source and the author seems to be someone famous so I can trust them. Related vimium ticket:

https://github.com/philc/vimium/issues/366

TL;DR: not very unexpected perhaps?

I decided to uninstall because of this. It's a dealbreaker.