Is Net iD Client safe?

Net iD Client bridges web pages to a local native app without validating message origins, allowing any page script to relay requests and receive responses.

The extension injects a content script on every page that listens for window.postMessage events and forwards them to the native messaging host com.pointsharp.netid.client without verifying the sender's origin. Responses from the native host are broadcast back to the page using a wildcard target origin ('*'), meaning any script on the page — including ad networks or injected code — can receive them. The extension also marks its presence on every page via a hidden DOM element, and discloses the extension name, version, author, and current page URL to any script that sends an information request through the bridge.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.