Lack of Manual Review for Extensions

“The case for limiting your browser extensions A root cause for this is the incredibly unwise decision Google made to allow extensions to request access to All Websites (including https) without even a scary nag warning. The description for that permission kind of understates the danger and because it had no negative impact on installs many extensions requested it that didn&#x27;t need it.<p>Worse still, the <i>correct</i> approach - specifically listing pages you need access to - has been broken for ages, such that if you add a new URL your extension will silently break until users go into a popout menu and turn it on manually. This discourages doing the right thing. If you want your extension to keep working you need to request wildcard access from the beginning, because Google&#x27;s update flow for new permissions is broken by design.<p>Sadly Mozilla followed in their footsteps and the warning for that permission isn&#x27;t much better. In my opinion any extension with that permission should be forced into a slower manual review cycle. Google <i>does</i> have the ability to do this - my extension was forced into a slow manual review cycle for a month after a fraudulent DMCA claim - but for some reason they opt not to do it. It would also be very beneficial for them to apply additional controls like requiring use of two-factor authentication and a code-signing key before uploading extensions with those permissions to reduce the risk of malicious code sneaking in. You can&#x27;t completely safeguard it but manual review + aggressive authentication would help.<p>As-is, thousands of extensions used on a daily basis have the ability to steal people&#x27;s gmails (including password reset emails), issue password reset requests, send emails, or manipulate your bitcoin wallet. A well-crafted extension could do this near-invisibly in a way the average user would not understand. Google has taken some steps to mitigate this, but it&#x27;s taken them far too long and they haven&#x27;t been aggressive enough.<p>Security-wise, web extensions are worse than desktop software has been in over a decade. UAC, sudo, the iOS app store - all dramatically more effective at protecting users. With web browsers being used daily by a billion+ people it&#x27;s really unfortunate that this security blindspot has remained so long.<p>EDIT: It&#x27;s kind of sobering to consider AddonJet&#x27;s promised payout of $2500&#x2F;day for 100k users. I maintained an extension with roughly 120k weekly actives across the globe for about 3 years and it mostly cost me money. Monetizing that would have covered medical expenses and rent for my family, plus potentially college for my nieces and nephews... oh well.”