teatwo on Nostr: Security and privacy are trade-off is seemingly common sense around identity space as ...

Security and privacy are trade-off is seemingly common sense around identity space as book i read.

KYC to enhance receiver's security lowers sender's privacy. Protecting visitor's privacy lowers security of Guest House.

Let's analogying that concept for webextension!
postMessage has security modernized, but, between tab app and webextension, lowers user privacy, because other webextension can also witness the activity.

High security, low privacy.

I've found using the traditional methods, exportFunction/cloneInto/etc. , of so-called "addons" times, but used broadly inside firefox, can enhance privacy. Because those can be the method to directly communication without postMessage, not being seen by other webextension.

However, this has security risk as per the trade-off between security and privacy. High privileged webextension code can be changed by low privileged tab app code. Very nervous. Perhaps that is why it remains implementation of ES5 times and stops evolution. no async, no class can pass it (promise has a restricted bypass way).

Low security, high privacy.

It's OK if the object is persisted and non-configurable 🆎