[gkoberger]

There's a Chrome Extension he made based on this: https://anatolyzenkov.com/stolen-buttons/button-stealer

I used it for a bit until I realized... I probably didn't want a third party reading all my traffic. But I did like having it for a bit.

(It is linked from the page, but given how the whole page is CTAs... it's hard to notice!)

[moontear]

Why I third party? Aren’t the stolen buttons stored locally?

[cube00]

They might be today but who's to say it won't start firing off fetch calls later perhaps under a new owner if it gets sold.

Unfortunately the browser extension permissions are not granular enough to warn you when fetch is being used in an extension.

As an example, my password manager extension can read and inject content into any page along with communicating with its server to sync my vault. These are the only permissions Firefox shows me:

  * Access your data for all websites
  * Get data from the clipboard
  * Input data to the clipboard
  * Display notifications to you
  * Access browser tabs
  * Access browser activity during navigation

No indication there that it can also communicate with its server.

[altcognito]

I think due to the nature of extensions.