Add more extensions to the list.

extensions/common/api/_behavior_features.json

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This features file defines switches used to control Extension behaviour,
 // typically whitelist configuration.
 // See chrome/common/extensions/api/_features.md to understand this file, as
 // well as feature.h, simple_feature.h, and base_feature_provider.h.
 
 {
@@ skipping 57 matching lines @@
     "whitelist": [
       "EC3DE21E048B67319893889529354DFBFA96FD23",  // Smart Card Connector
       "6B748A5C005F21B7CBCF4170C2F883E435DEB511"   // CSSI Smart Card Middleware
     ]
   }, {
     // Explicitly whitelist extensions that should always be available
     // on a sign-in screen.
     "channel": "stable",
     "component_extensions_auto_granted": false,
     "platforms": ["chromeos"],
-    "location": "external_component",

[Denis Kuznetsov (DE-MUC), 2016/11/30 23:22:33]

This restriction seems too strict: Virtaul Keyboard is loaded as extension, not
a component app.
Is there any chance for a side-loaded extension to have the same ID as for a
component extension?

[asargent_no_longer_on_chrome, 2016/12/01 00:22:45]

If by "side loaded" you mean loaded in development mode from
chrome://extensions, then yes, any extension id can be spoofed if you have the
corresponding public key (taken from the "key" field of the manifest"). 

If by "side loaded" you mean an extension installed via a mechanism like
drag/drop of a .crx file onto the chrome://extensions page, or via policy or
external extensions (https://developer.chrome.com/extensions/external_extensions
but probably not relevant to ChromeOS), then no, it is not possible to spoof an
id unless you have the private key to sign the .crx file with. 

     "whitelist": [
       "E24F1786D842E91E74C27929B0B3715A4689A473",  // Gnubby component extension
       "6F9E349A0561C78A0D3F41496FE521C5151C7F71",  // Gnubby app
       "8EBDF73405D0B84CEABB8C7513C9B9FA9F1DC2CE",  // Genius app (help)
-      "3F50C3A83839D9C76334BCE81CDEC06174F266AF"   // Virtual Keyboard
+      "3F50C3A83839D9C76334BCE81CDEC06174F266AF",  // Virtual Keyboard
+      "2F47B526FA71F44816618C41EC55E5EE9543FDCC",  // Braille Keyboard
+      "86672C8D7A04E24EFB244BF96FE518C4C4809F73",  // Speech synthesis
+      "1CF709D51B2B96CF79D00447300BD3BFBE401D21",  // Mobile activation
+      "D519188F86D9ACCEE0412007B227D9936EB9676B",  // Gaia auth extension
+      "40FF1103292F40C34066E023B8BE8CAE18306EAE",  // Chromeos help
+      "3C654B3B6682CA194E75AD044CEDE927675DDEE8",  // Easy unlock
+      "2FCBCE08B34CCA1728A85F1EFBD9A34DD2558B2E"   // ChromeVox

[Denis Kuznetsov (DE-MUC), 2016/11/30 23:22:33]

We can also include Chrome PDF Viewer to this list, it now attempts to load on
login screen, but I wonder if it is really needed there.

     ]
   }
   ]
 }