HACKER Q&A
📣 Ennergizer

Why can't Chrome block extensions by default on .gov and bank websites?


And only enable them when you click on the extension or allow it on a specific domain?

Or at least have a policy to not allow all extensions on all domains by default as user selectable option in Chrome settings?


  👤 politelemon Accepted Answer ✓
You might be seeing the problem as much simpler than it is. Have a think:

* Only US gov websites, and not every country's equivalent?

* And only on their country's specific TLD, because some countries do have official government sites using .com or non government TLDs!

* And which banks? Only banks? Why not other financial institutions?

* Where would such a list be stored and maintained? Who would be the arbiter?

* How do renames and rebrands and defuncts get handled?

* How do you prevent malicious third parties getting onto the "no extensions" register?

Just listing these questions out, I can see the problem spiralling very quickly.

It could be stated simpler as, why can't my browser allow me to disable extensions for specific domains of my choosing? To which the answer will probably be, because that's another potential attack vector. A victim could be told to permanently disable extensions for a specific malicious domain.

So if I wanted this feature I might choose to approach individual extension developers and ask them if they'd be willing to disable the extension based on a specific list of domains. Again I think security concerns would make them say no but that's the narrowest 'scope' that you could ask for.


👤 dave4420
What’s the problem you’re trying to solve?