How would you handle exposed disable codes (say if a person who had access to it leaves the company)? There are presumably situations where revocation of the code would be needed, but that seems difficult to implement without also opening a window for the attacker to use:
* instant revocation -> attacker will just revoke the code
* delayed revocation where the code remains usable for some period -> accidental exposure is irrecoverable
Maybe it's viable as an option (extension owner takes on the risk of properly managing the secret, knowing it can't be revoked easily).
We are competing with publishing "if you're my user, disable my extension."
Revocation codes should revoke. A malicious employee or compromised gmail account should be able to disable an extension, yes. The developer should then have to work to reinstate it.
Extensions are not part of the core Chrome experience.
You are asking: "As a user, are you okay with Chrome extensions being disabled by Google if its developer had their revoke key compromised?"
Nobody would say "no".
Compare: "as a user, are you okay with Microsoft Windows locking and not booting, in case Microsoft's internal revoke key experienced a security issue?" (until Microsoft issues an update which unlocks it again.)
Most people would not want that, because people need to finish working on their things in this scenario. (Of course some ultra secure installations might want that, but most wouldn't.)
The difference is that these are small, third-party developers, working on extensions, not the core functionality.
I hope this answers your question regarding how I personally would handle exposed codes.
However, I am not an extension developer or heavy extension user! I am not saying this is the only solution.
* instant revocation -> attacker will just revoke the code * delayed revocation where the code remains usable for some period -> accidental exposure is irrecoverable
Maybe it's viable as an option (extension owner takes on the risk of properly managing the secret, knowing it can't be revoked easily).