[Cthulhu_]

He does indicate the user gives the OK to 'access all data on all websites' - like most extensions do, come to think of it. I do think things like that should be more fine-grained, and/or that developers have to indicate /why/ they need that access.

[aragot]

I really, really have a problems with this permission:

- For a very few extensions, I allow it, but it is very clear that it is an open gateway for hackers,

- Most often, I deeply regret I can't even tell Chrome that I allow the extension on a subset of sites... At least not my gmail please...

- So the base rule is, never install something which requires all perms, obviously.

Users have been warned properly. They're at the mercy of untrustable people.

[edanm]

Problem is, almost no user will ever actually READ any message. They'll just click "OK".