mfoster.io on Nostr: That is a good question, It is bound to the origin binding: OPFS storage is ...

That is a good question, It is bound to the origin binding: OPFS storage is origin-private. Even if an extension injects code, the storage it accesses is scoped to that origin. It cannot cross into another site’s OPFS. So if you’re on NostrVault.tld, injected code can only touch NostrVault.tld OPFS, not NostrClient.com’s or a rogue extension.

The rogue extension would have to have host permission to access the Origin Private File System (OPFS) and eventually our goal goal is to encrypt the data at rest with OPFS with an OpenPGP cert from the NFC card so a rogue extension wouldn’t know how to interpret it or what to do with it, if it got access to it.