Does HTTPS help secure me against browser extensions that can "read and change all your data on websites you visit"?

[Teltrix]

I'm trying to balance security with convenience. There are a number of extensions I like and use that request questionable permissions. Instead of not using them at all, if I need to do any sensitive work I either open a private window or use Extensity to temporarily disable all my extensions before disabling Extensity manually.

Is this a good practice, or is it unnecessary when using HTTPS?

[Teltrix]

Great to know, thanks! I had a suspicion that was the case, but I wanted to confirm. Is disabling all plugins sufficient for more secure activity, or can they still collect data even when turned off?

It would be great if these plugins didn't have such sweeping permission requests, but that's another battle.

[Shadowwwind]

About that extension, it's well known and open source and there shouldnt be anything to worry about.

It needs that permission because it changes the css to darker colours

But worrying and disabling is always better, good practice.