Mozilla shouldn't copy Chrome's permission prompt for extensions

It sounds like a case of overly broad permissions. Have they looked at other permissions models?

For one, extensions should be able to include an explanation why they need each permission.

Network access should be a separate permission like it is for iOS keyboards. It's safer for an ad blocker to read and modify a page if it has no method of exfiltrating the content. Blacklist updates can be done through the regular extension update mechanism.

Looking at the list of permissions in the documentation, a lot of these look like they should be asked for at the time of first use (location, clipboard, screenshots, etc). This would avoid the problem of asking for overly broad permissions upfront "just in case". Android had the same problem.

But in the end, not informing the user is the wrong choice, no matter how bullet-proof you think your vetting process is. You'll always have users who are paranoid (as developers of a camera app on iOS, we've had 1-star reviews left because our app "uploads all your photos to the internet" because we need photo library access) and it's their loss mainly, not yours.

As extension developer, it is easier to request "Access all web sites data" at the beginning. The alternative for using optional (host origin) permissions have to deal with complex UI workflows and often ask user to grant permission that is already granted - due to Chrome bug not fixes for years[1].

1. https://bugs.chromium.org/p/chromium/issues/detail?id=310815

> Chrome is being completely honest with the user.

The article is not advocating otherwise.

A lot of extensions need that permission, even though they only need it to do something much more specific. Adblock uses it to read (but not transmit) your webpages, and remove sections. Password managers use it to scan (but not transmit) webpage content, and fill certain form fields.

If there is a review process (which Firefox already has in place), then you can actually give out permissions like this. You can ensure that the data read from the webpage is never sent to the server, and useful things like that.

I believe the proposal for webextensions in Firefox is to have certain kinds of extensions get auto-approved, the ones which need simple, sandboxable permissions (not "read all my webpages"). Extensions that need more permissions will need review, and they can request semantic permissions instead of just "give me all your data and trust I don't do anything bad with it", which is bad and has already lead to issues in the past where a Chrome extension developer sells their extension which is then used to transmit malware.

> To conclude , i would like firefox's stringent app review process and chrome's fine-grained permissions and sandbox model.

The article is proposing finer grained permissions than Chrome.

The article does make a good point regarding warning fatigue, which was one of the main reasons why Android is moving towards a permission system similar to what iOS does, i.e. ask for permission only when needed, and degrade gracefully if the permission is not granted. The previous system of showing a gigantic list of required permissions probably caused most users to a) blindly accept the permissions or b) not install some apps out of fear.

That model is probably not that good a fit for browser extensions. There might be a couple of permissions where this would work, but the biggest issue is definitely the "Read and change all your data on the websites you visit." permission, and that's not really something you could work around with using on-demand prompts. The idea of combining code reviews with an explanation of the required permissions provided by the developer and vetted by the reviewers sounds interesting, but it's not clear to me whether a model like that would work in practice.

>A lot of extensions need that permission, even though they only need it to do something much more specific. Adblock uses it to read (but not transmit) your webpages, and remove sections. Password managers use it to scan (but not transmit) webpage content, and fill certain form fields.

Yes. But the user should be made aware of the consequence of their action. Do they realize that installing a password manager means granting access to all their data to a third party. Is this author reliable? What do other users think of the author? Has anyone reviewed the code for this? These are all questions potential users should ask.

>they can request semantic permissions instead of just "give me all your data and trust I don't do anything bad with it", which is bad and has already lead to issues in the past where a Chrome extension developer sells their extension which is then used to transmit malware.

A lot of things cannot be controlled either by review process or sandboxing. What if your extension has a web-component ( say your password manager backs up passwords to the cloud)? Mozilla cannot review your server code. A sandbox won't protect resources you have already given access to, but it will limit the damage done.

>The article is proposing finer grained permissions than Chrome.

I have reread the article and haven't found anything that backs this assertion. Indeed the author seems to say : Mozilla vouches for me, so you trust me with all your stuff too. From article :

'Wouldn’t it be a better idea to keep doing that so that the installation prompt can simply say: “Hey, we made sure that this extension is doing what it says, want to install it?”'

Edit : I agree that some form of review is needed for extensions. Simple sandboxing alone is not enough. But article doesn't seem to support sandboxing.