[DerekBickerton]

> you already allow connections to that host

Correct. You could always have JS disabled by default in uBlock Origin to mitigate JS snooping on sensitive info, so there is that. You can blacklist specific domains in uBlock too. We need something like Portmaster[0], but inside the browser as an extension.

[0] https://safing.io/portmaster/

[dewey]

That ship has sailed.

Apart from a few of us nerds on HN nobody will do that. In reality people have a hard time seeing the problem with re-using a password, making people decide which hostnames are okay or vet javascript files before allowing them is unrealistic and not the solution to the problem.