3 ms·
> Again, it's not hard for a malicious extension/app to do that, it's just that only the malicious extensions/apps are going to do that. So it becomes easier to
by seanwilson 8y ago
> Again, it's not hard for a malicious extension/app to do that, it's just that only the malicious extensions/apps are going to do that. So it becomes easier to educate users with simple rules like, "if a site asks for a permission that's unrelated to what you're doing, always say no."
Are you sure it's this simple? Adblockers and password managers for example require wide ranging permissions to work and there's plenty of popular extensions in the same situation.
- Ajedi32 8y agoPassword managers don't need extensive permissions, they just need a built-in autofill API. Similarly, you could implement a basic adblocker via a declarative content blocking API. Fine-grained permissions will allow for this sort of thing.
- seanwilson 8y agoDoes that cover the functionality of most popular extensions though? When there's an API that matches up with the purpose of the extension, it's more straightforward. I would have thought the popularity of those particular example extensions is what partially drove the creation of those APIs as well.
- Ajedi32 8y agoThe APIs I mentioned in my previous comment don't exist yet. My point is that Google is going to need to _build_ APIs to fulfill all of the most common use cases (including those ones) in order to succeed in their goal of making extension permissions more fine-grained. So yes, the functionality of most popular extensions will be covered by the new APIs, because Google will designing the new APIs with those popular extensions in mind.