Hack of the Day: Javascript Transport via Chrome Extensions

In the beginning of a project it is common to cut corners to save time. Security is often the first to be sacrificed because you might not be dealing with terribly sensitive information and who really wants to hack your crowd-sourced “Netflix for knives” pinterest-clone, anyway?

However, there are some poor security decisions I’ve been alarmed to discover recently on a number of websites. These sites that I use and enjoy have made the cardinal sin of storing passwords in plain text in Javascript. This is a Bad Idea® for a number of reasons and no amount of https is going to save you.