Login-password info read by browser extensions?
I was shocked to just now review "permissions" for the 2 Firefox extensions I have installed - an ad blocker and an RSS feed reader - and see that both have "Access your … (read more)
I was shocked to just now review "permissions" for the 2 Firefox extensions I have installed - an ad blocker and an RSS feed reader - and see that both have "Access your data for all websites" permission.
Looking that up, I found that means, "The extension could READ the content of any web page you visit, as well as data you enter into those web pages, such as USERNAMES and PASSWORDS!"
Seriously?
I realize Mozilla can read login and password info, but why in the world does an ad blocker or feed reader need the ability to read logins and passwords?
I realize login data may be practically impossible to separate from other FORM data, YET neither an ad blocker nor a feed reader should need to read page FORM INPUT data anyway!
Looks to me like Mozilla is being way too lax in allowing extension permissions not needed.
In particular, if any extension can read account login and password data, there should be a pop-up warning, and IMO such should not be allowed where not required.