We live in the age of all kinds of malware that can sniff and copy your private keys from clipboard without triggering anti-virus and anti-malware detection, like that failed NPM hack few days ago. It seems inevitable that private keys will get hacked / leaked. For now, using browser extension seems like a good thing, until it's compromised somehow.