A malicious browser extension can steal all sorts of secrets. Is there a unique weakness here in the linked tool? Otherwise, this seems similarly vulnerable to everything else on the web.