Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites
This sort of abusive, insecure extension poisons the well for all extension developers. Now, I wish to submit a couple of feature requests to the Chrome team.<p>1) I wish there was a way by which an extension could declare its access patterns in much more fine-grained manner (kinda like CORS headers). Then I can <i>prove</i> to my users that my extension <i>cannot</i> do the sort of ugly crap that Amazon is doing.<p>2) Second is an API to expose details of an XMLHTTPRequest's (or maybe even 'document' object's) SSL server certificate. Even a binary blob will do: I can parse it in JS. Without this, you can't do "certificate pinning" for extensions.<p>Chrome extension permissions are too coarse-grain. Why is DOM write permission not separated from DOM read perms?<p>If Google doesn't crack down on abusive extensions like this, they risk users losing trust in the Chrome "brand". Just my 2 cents.