secmax

The goal of this system is too make faking license plates using a bit of black tape hard/impossible. So I have some trouble getting the point of Erik Spiekermann's comment.

That is/could be true for hybrid cars too.

I do not use catch-all addresses, but use a version of [domain]@mydomain.com buy adding new email addresses (aliases) in an automated way. I "remember" the used email addresses in two ways: 1) my mail server configuration contains a list of all aliases created in the past, 2) my password manager saves logins on top of that. The nice side effect is, that you keep track of all the sites you have ever created logins at.

That depends on your definition of "solution". The scheme protects you (to a certain degree) from automated creation of inter-site profiles. The reason is, only very few people employ (a variant of) this strategy, so trying to "deanonymize" is costly and usually not worth it economically.

Last time I checked, offline message (storage) was not implemented. Is there progress on this?

> As long as the parties are talking (which they are), this is an unfinished security review on lock-down to prevent exploitation in the interrim.

I agree! There are a lot of Chrome extensions out there which could be affected. Immediate public disclose would be irresponsible.

So a vulnerability of this kind would not only affect Firefox but also Chrome and others?

I am really worried about the security implications for addons like bitwarden, if mozilla is right about this. I hope that competent people will take a close look.