RE: https://ohai.social/@dcoderlt/116435674001182181
Can someone explain to me what exactly the security issue is here? The way I understand it:
- The Claude app pre-installs a permission that, if you later install the browser plugin, allows the browser plugin to communicate with the App.
- If you don't have the plugin installed, the permission / bridge does nothing.
- If it didn't do this, and you installed the browser plugin, you would have to give this permission manually for the browser plugin to work (and thus the end result would be the same).
Is this understanding correct? What's the threat model here? Anyone who legitimately installed the browser plugin would also give this permission (and is thus just as vulnerable as if Anthropic had not pre-provisioned something). So - is the threat that someone tricks the browser into installing the browser plugin?
I don't want to defend pre-installing the permission, it's not cool to do that and a violation of consent. But I really don't understand what the real-world security impact is - in which situation are you now more vulnerable than you would realistically be if you either never install the extension or legitimately and knowingly installed the extension and manually gave this consent? But that may be because I don't know enough about how this browser plugin permission stuff works, so, legitimately curious about the background here.
hkz
Jonah Aragon 
Filippo Valsorda
dragosr
daniel:// stenberg://
Daniel Pomarède
Seth Larson
Mark Boszko
aaron