4 ms·
Even if they copy the warnings verbatim, I’d like to at least suggest adapting some sort of icon set. Preferably with color coding: yellow for frequently reques
by deno 10y ago
Even if they copy the warnings verbatim, I’d like to at least suggest adapting some sort of icon set. Preferably with color coding: yellow for frequently requested permissions, red for infrequently requested permissions.
Anything really, that let’s you know at glance what you’re about to install, without having to read a bullet point list.
Colors are fine but unique icons would be even better. If it potentially affects user’s privacy anything but a scary looking big brother eye would be inappropriate.
See for example Facebook’s permission dialog from 2010: https://hyuz.files.wordpress.com/2010/04/gsh-1427.jpg https://hyuz.files.wordpress.com/2010/04/gsh-1427.jpg
The article mentions that CWS’s users rely on reputation. That is 100% true. You basically have to go into at least the Review section to see if there are any ‘surprises’ included inside. There was a time you couldn’t install a mouse gesture extension without compromising your privacy.
The scary part is all your extensions are self-updating. If the author doesn’t change the permissions they can include a backdoor at any time.
I don’t suggest they review the extensions manually. Instead what I would like to see, personally, is just a simple setting to only show open source extensions.
At least with AMO it’s very simple to check the source of any extension you like. It’s right there on the extension’s page. Disabling automatic updates and reviewing the source code is something I’ve done in the past.
If you combine an easily accessible source and a comment section this alone will increase security by a significant margin.
- robryk 10y ago> If it potentially affects user’s privacy anything but a scary looking big brother eye would be inappropriate. Well, what permissions don't?
- deno 10y agoI meant anything that let’s the extension leak any data. Contacting 3rd-party servers, modifying DOM etc. I suppose more granular permissions might be required here.
- deleted 10y ago[deleted]
- duskwuff 10y agoA few examples. (I'm not sure why a lot of these are treated as permissions at all.) * Running in the background * Displaying desktop notifications * Using the OS's text-to-speech engine * Storing more than 5MB of data in local storage