Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

This sort of abusive, insecure extension poisons the well for all extension developers. Now, I wish to submit a couple of feature requests to the Chrome team.

1) I wish there was a way by which an extension could declare its access patterns in much more fine-grained manner (kinda like CORS headers). Then I can prove to my users that my extension cannot do the sort of ugly crap that Amazon is doing.

2) Second is an API to expose details of an XMLHTTPRequest's (or maybe even 'document' object's) SSL server certificate. Even a binary blob will do: I can parse it in JS. Without this, you can't do "certificate pinning" for extensions.

Chrome extension permissions are too coarse-grain. Why is DOM write permission not separated from DOM read perms?

If Google doesn't crack down on abusive extensions like this, they risk users losing trust in the Chrome "brand". Just my 2 cents.

Why is this a big surprise? I'm sure that you would find similar features on the eBay extension or any other 3rd party online store. The problem is really in how the permissions are displayed and users are so willing to give full access to their browser through extensions.

Cached: http://webcache.googleusercontent.com/search?q=cache:http://...

The "news" part of this is that the extension allegedly reports all the URLs you've visited to amazon, including https ones, plus some reporting of site contents to alexa.

Never attribute to malice what you can attribute to incompetence.

Then why would they state : "The Amazon Browser Apps may also collect information about the websites you view"