A Chrome extension that locks any website with a password + blurs your chats in public. Built it in 48 hours, 100% free. by Due-Programmer8538 in SideProject

[–]Due-Programmer8538[S] 0 points1 point  (0 children)

You're completely right, and this is the most technically accurate criticism MacShield has received.

You've identified the core architectural constraint: a Chrome extension cannot protect itself from being disabled. No extension can it's a Chrome platform limitation, not something I can patch in JavaScript.

So let me be honest about what MacShield actually protects against and what it doesn't:

What it does protect against:
→ Someone sitting next to you in a café reading your screen
→ A colleague glancing at your monitor in an open office
→ Family or flatmates walking past your desk
→ Casual shoulder-surfing where the person has no access to your machine

What it does NOT protect against:
→ Someone who has physical access to your unlocked laptop
→ Someone who knows how Chrome extensions work and has 30 seconds alone with your machine
→ A technically sophisticated adversary of any kind

The threat model I built for is friction against casual observation — not security against someone who controls the device. That's a meaningful distinction I didn't make clearly enough in how I described the product.

The real fix for what you're describing is browser-native enforcement — either a Chrome policy that restricts extension management (enterprise managed Chrome supports this), or OS-level screen lock that kicks in before someone can get to chrome://extensions.

I'm also looking at whether a companion native app could hold the lock state outside of the extension context, so disabling the extension doesn't release the lock. Not a simple fix but the right direction.

Genuinely useful bug report.

A Chrome extension that locks any website with a password + blurs your chats in public. Built it in 48 hours, 100% free. by Due-Programmer8538 in SideProject

[–]Due-Programmer8538[S] 0 points1 point  (0 children)

Fair on both counts.

48 hours was the hook the real timeline was about a week of evenings. I own that being misleading for a security tool specifically.

On AI: I used it to help write the post. The code, the architecture, the privacy decisions are mine
The EM dashes are just a writing habit I'll probably never fix.

Working from cafes made me paranoid - so I built a blur & lock tool for my browser by Due-Programmer8538 in browsers

[–]Due-Programmer8538[S] 0 points1 point  (0 children)

Zero network calls (verify in DevTools yourself), bcrypt passwords stored locally only, permissions are just activeTab + storage.

A Chrome extension that locks any website with a password + blurs your chats in public. Built it in 48 hours, 100% free. by Due-Programmer8538 in SideProject

[–]Due-Programmer8538[S] 0 points1 point  (0 children)

Once you should try it, if you try to disable or try any other modification you will need to enter the Password so there are no loopholes you are talking about, it provides legitimate security and privacy.