giveaway.su is safe/secure?

So I'm wrong, I thought there were giveaways that didn't need the extension. That way there's not much to do.

Yes but having an extension bypasses that anyway. It basically has full control of your steam account.

Do you also dedicate a different browser for it? It adds ads on popularly used websites to annoy you while browsing.

RE: site & extension

I was once curious and I tried to inspect the CRX extension and the site JS source code a while back... let me tell you it is highly obfuscated, encoded in a convoluted manner, and includes a number of anti-debugging measures to prevent you from easily inspecting the source code!

For example, when you load the g.su site with the browser devtools open, it will enter a deliberate infinite loop of debug breakpoints to prevent inspection. now there is a workaround for this, but this is just an example of the type of things it tries to prevent you from seeing what it does.

Given the permissions requested in the manifest.json file, I would say it is at the very least injecting ads in these sites (vk, insta, fb, yt, reddit, etc.), or doing more evil things...

let me clarify here, the extension code itself is obviously clean (otherwise they won't be able to submit it to the addon store), but the way it works is it calls the server and the response received is then interpreted and executed (i.e remote code execution), which means whatever the server responds with can change any time, so even if it was doing something malicious, it could be selectively sending these payload to escape easy detection, you just can't know for sure without some serious effort to study it...