Reply to thread

Message

<blockquote data-quote="qua3k" data-source="post: 953696" data-attributes="member: 92539">Suggest you read the linked resources. There have been multiple studies conducted on this. EV certs fundamentally don&#039;t work. <a href="https://arstechnica.com/information-technology/2017/12/nope-this-isnt-the-https-validated-stripe-website-you-think-it-is/" target="_blank">Oh look, a Stripe, Inc EV cert.</a> You should talk with your mother and tell her to look for the &#039;Not secure&#039; feedback instead of the flawed positive feedback. Additionally, take a look at Moxie&#039;s SSLStrip talk where he uses positive feedback to his advantage.Content scripts run in the context of all tabs and introduce new dangerous attack surface that can be used to bypass Chrome&#039;s site-bound renderer isolation. An extension has the ability to access everything in the DOM. I fail to see how this isn&#039;t a serious concern, especially with an extension that can communicate with a third party server. <a href="https://twitter.com/justinschuh/status/1412464534334230531" target="_blank">Justin Schuh, previously Chrome Security Lead, echos these concerns</a>.</blockquote>

[QUOTE="qua3k, post: 953696, member: 92539"] Suggest you read the linked resources. There have been multiple studies conducted on this. EV certs fundamentally don't work. [URL='https://arstechnica.com/information-technology/2017/12/nope-this-isnt-the-https-validated-stripe-website-you-think-it-is/']Oh look, a Stripe, Inc EV cert.[/URL] You should talk with your mother and tell her to look for the 'Not secure' feedback instead of the flawed positive feedback. Additionally, take a look at Moxie's SSLStrip talk where he uses positive feedback to his advantage. Content scripts run in the context of all tabs and introduce new dangerous attack surface that can be used to bypass Chrome's site-bound renderer isolation. An extension has the ability to access everything in the DOM. I fail to see how this isn't a serious concern, especially with an extension that can communicate with a third party server. [URL='https://twitter.com/justinschuh/status/1412464534334230531']Justin Schuh, previously Chrome Security Lead, echos these concerns[/URL]. [/QUOTE]

Verification