johannh

Both the more technical blog post as well as the MDN page are linked shortly after that paragraph.

No, there’s no allow-list, you get the same heuristics as described on that MDN page.

Yes, it’s essentially that, FPI with workarounds for common breakage. You should switch from FPI, this is essentially another take on FPI by some of its original developers, so it should have fewer issues overall, not just site breakage.

(I’m one of the developers of this feature and co-author of the blog posts)

This is a great question and I’m glad you found the answer, you probably understand that for many blog posts we avoid going into too much technical detail.

To answer your final question, there is no hardcoded allow-list for State Partitioning. The heuristics as described on MDN are accurate.

I find it ironic if banks and post offices are using combination locks as advertised security measures but the people selling those install steel doors on their storefront.

True, I'm not surprised at all. HTTPS Everywhere-like functionality should be integrated into browsers and not a downloadable extra, tricking people into feeling fully secured.

> AMO doesn't do any code signing for extensions, so they're only protected by HTTPS. As we saw with Heartbleed, SSL private keys can be compromised.

I find it quite ironic that HTTPS Everywhere is arguing HTTPS is not safe enough to offer them a reasonable guarantee of integrity.