[bug] Editing html buttons lets you re-enable them and bypass master password about block-site HOT 4 CLOSED

As of the next release, the extension will ask and double-check the master password before performing important actions on the options page.

from block-site.

If a user knows how to inspect the options page and alter attributes, then I assume, inspecting the background page is not harder. If so, this user can disable the navigation observer altogether. So although this is a valid issue, there is no point in fixing it

from block-site.

And by not fixing it, there is no point in using this for anything more than a gimmick.

You don't ignore a fix to a problem because there is someone who knows how to bypass it, there is always someone that knows how to bypass it or has the skills to figure out how, you do it to make it harder. Most users, even those that can inspect elements will give up if it requires anything more than some two minutes to bypass. Likewise, this is for the actual settings page, which is why it is more important. Just opening the DOM explorer is not an advanced skill, it's bottom barrel -not even at a script kiddie level-, you are over-evaluating the skill it takes to open it.

If you have the necessary skills to disable the navigation observer, then you can assume they are more capable than being able to inspect an element and have the amazingly, awe-inspiring, capacity for thought to change the thing that says disabled to enabled or remove it outright.

from block-site.

Thank you :)

from block-site.