12 ms·

Consider Disabling Browser Push Notifications on Family and Friends Devices

171 points by lloydatkinson 4y ago

lzooz 4y ago
I'm family of myself which is why I also disable push notifications always. Thankfully Apple does the right thing and doesn's support them at all.
- wruza 4y ago
  Wouldn’t it be better if ios could control notifications on both global and per-site basis?
  - lzooz 4y ago
    As long as the default is to globally block and that enabling for a single site is as cumbersome as possible, that's okay.
    - wruza 4y ago
      Personally I’d like to run a server that could send notifications to me and to other people who would like to join this party. It is a valid use case and making it as cumbersome as possible feels wrong (depending on what it means of course). Though I agree that it would be good to not turn it on by ok-clicking like our parents always do. “aA -> turn on” would be enough, popups definitely banned.
  - Tepix 4y ago
    That's what all browsers do and i'm sure mobile safari will do it too once the feature arrives.
- pull_my_finger 4y ago
  Sorry to be the bearer of bad news https://webkit.org/blog/13399/webkit-features-in-safari-16-1/#web-push-for-macos-ventura https://webkit.org/blog/13399/webkit-features-in-safari-16-1...
- mavhc 4y ago
  Thankfully Apple does the right thing and doesn't allow anyone to use knives in their kitchen
Markoff 4y ago
That is what I do when I have once a year father's/mother's phone in hand and I see notification bar flooded with crap notifications from various apps, not just browser. As for desktop, they should have adblockers which should take care of it hopefully.
- lloydatkinson 4y ago
  Unfortunately I have seen the notification prompts appear even with ad blockers installed
- danuker 4y ago
  I installed Linux (Manjaro), and the problems are confined to the browser (and then handled by uBlock Origin). But my parents only use the computer for browsing and very rarely for opening documents.
jasode 4y ago
Some HN/reddit threads recently mentioned Library Genesis so I visited with Chrome desktop web browser on mac and was surprised it caused a deceptive push notification. Screenshot: https://imgur.com/a/ZXxnM1G https://imgur.com/a/ZXxnM1G EDIT reply to: >That ad must've been injected by the proxy you were using to access LibGen. I just went to the top search result for "libgen" from google search result. It's possible they were trying a temporary monetization trial to take advantage of the Z-Library shutdown and that push notification is now gone. The other possibility is that the search result pointed to "libgen.ee" or "libgen.il" which apparently is a clone of Libgen (they call it "Library Genesis+") and it's the clone sites that have the push notifications. It's confusing to to people not familiar with it to know which is fake and which is real. (screenshot of google results: https://imgur.com/a/65Beo8H https://imgur.com/a/65Beo8H) On another side note, what's amazing is how that website got a push notification silently past Chrome's "Privacy and security" setting of "Sites can ask to send notifications". There was never a "Allow this site to send notification?" prompt. I wonder what Javascript trick they used to bypass Chrome's security.
- notRobot 4y ago
  That ad must've been injected by the proxy you were using to access LibGen. uBlock Origin detects no ads, malware or trackers on https://libgen.is/ https://libgen.is/ for me.
- deleted 4y ago
  [deleted]
- arepublicadoceu 4y ago
  > I just went to the top search result for "libgen" from google search result. Yeah, you should never use google for this. Protip: find the wikipedia article of your site of interest and bookmark it as a source of always up to date urls. Conversely, just use alternative search engines like duckduckgo and/or brave search.
  - denton-scratch 4y ago
    > find the wikipedia article of your site of interest and bookmark it as a source of always up to date urls. I don't recommend relying on Wikipedia as a source of up-to-date anything.
nevi-me 4y ago
I'm at my mom's place, I had never thought of turning them all off. I think I should outright disable Chrome on Android notifications, as I now can't think of a reason why she should get notifications. She's been spammed by all sorts of nonsense from tabloids and scams. > In the same way that e-mail spam filtering works, so should browser push notification spam filtering. If you don’t implement this, you are complicit in the continued abuse of your users. I can't remember as I haven't worked on notifications in years, are the notifications not meant to be encrypted? Such that the browser vendor can't see the contents? With e-mail I understand and accept the message processing needed to identify if it's spam, but I'm wondering whether browser vendors (or more specifically, push servers) would today be able to intercept messages. Numerous services will allow messages to be sent via push notifications, wouldn't it cause issues if your browser vendor is now "reading your messages"? > If needing to filter browser push notifications for spam seems like a lot of work, then questions need answering about the value of the feature in the first place. Seriously, what is the value of this feature? I understood the feature as part of making PWAs able to replace the need for native apps. When browsers started supporting push notifications, I used the service to send public transit alerts to users who opted into them. > Were you pressured into it by ad companies? Why is the feature so open to abuse? Native apps can be removed from stores, and Google/Apple would (I assume) drive the lion share of notifications thorugh their servers, and can probably detect abusive behaviour more readily. With browsers, I'd again assume that it's harder, as one can use any service they'd like. Then what about Chromium where all the tracking stuff has been stripped out? Who would police that? Two possible solutions: 1. A blocklist is maintained, similarly to malicious websites. Don't know if flagging a website abusing notification marks it as malicious overall, but at least with malicious websites the user wouldn't even see the website. 2. If a user dismisses notifications and never opens them, perhaps the browser can take initiative and block them permanently. ---- I'm responding mainly with experience of spam on family's phones, I fortunately don't have elderly family who use PCs.
- lloydatkinson 4y ago
  > are the notifications not meant to be encrypted? Such that the browser vendor can't see the contents? No, the Windows API's for showing the notification (or for any OS) are going to need to know the text to render and the image to display, which is information the browser will have to tell those API's. > send public transit alerts Probably the only legitimate use case I've heard but I've personally used apps from the transit companies for this.
SavageBeast 4y ago
Being pretty much a 100% Chrome user, I've yet to click "Allow" when a site wanted to notify/spam/inundate me with shit from sub-companies or worse yet proxy spam me from paying 3rd parties because "well, you did opt in sir". The opt in popup box might as well read: "Are you an idiot? YES|MAYBE". Not one time have I allowed it ever in all these years and I'm shocked anyone else allows it at all too. Not having considered it before but I'm really surprised this tech is on by default or even exists at all. It may have some neat IOT use cases but IOT has about a billion other notification options for machine/machine communications that are better. Thats the best I can do in terms of trying to argue theres a good aspect of the functionality. But what about Gmail you say? Well, I personally don't use the web interface anyhow opting instead for a nice/superior experience from a local client but IIRC the tab starts blinking when theres new mail and the number in the title bar changes. Even LinkedIn and its simple blue dot on the title of the tab is sufficient for me to know theres new activity there if I want to bother looking (ooooh loooook - a guy I know knows a guy that posted a virtue signaling meme regarding a supposedly socially relevant topic that companies pretend to be concerned about - I MUST KNOW ABOUT THIS IMMEDIATELY!). Now, on to changing browser and OS notifications on all 4 home systems to my preferences this morning. I didn't realize how much the hubris of bugging me with stupid crap annoyed me until this prompted me to consider it. Thanks OP!
- lloydatkinson 4y ago
  > I'm shocked anyone else allows it at all too I was too! But then like I mentioned with UX dark patterns encouraging users to click by making them believe they have to click it, it's perhaps not as surprising. Non-technical users are already conditioned to click OK or Yes to anything that appears on their screen without reading it. Glad you found the advice useful!
- rjzzleep 4y ago
  Interesting. I'm in the same boat I never actually pressed allow, but somehow I never actually thought about disabling it either. I'm going to do that on my moms laptop as well when I get the chance.
- simion314 4y ago
ack_inc 4y ago
The post says there are no legitimate use-cases for browser push notifications, but I disagree. I'm building a niche social media PWA (eschewing native apps to save time), and use browser push notifications to let my users know when someone has DM'ed them.
- hdjjhhvvhga 4y ago
  This is one of the very, very few cases when it makes sense. The problem is, everybody else is abusing it beyond imagination.
  - Hamuko 4y ago
    Yeah, >90% of the uses are just pure abuse. Browsers should've really made it an user-initiated action. Something more akin to adding a site to your browser's bookmarks than what we have currently.
- spiffytech 4y ago
  BoardGameArena uses push notifications to let players know it's their turn. I prefer running Slack in the browser, and I need to receive message notifications. Push notifications aren't any less useful to have in browsers than in native apps. Though I would like to see the prompt locked behind "add to home screen".
  - kevinyew 4y ago
    Sadly, boardgame arena also pushes advertising for new games and features through the notifications as well. I'm sure it's possible to disable specific categories, but it unfortunately undermines their value even more when otherwise legitimate sites still somewhat abuse push notifications.
- nonameiguess 4y ago
  Somewhat real-time chat with a human I'm talking to on purpose is the only legitimate use case I can think of and the only thing I enable any sort of push notification from at all, but even then, only from native apps. If the only reason this needs to be in a browser is saving time for the developer, that isn't a good enough reason for me as a user as long as other options exist that use native apps. Even to use this theoretically, though, I'd want the strict ability to control who can even send me a direct message. As it stands, the only thing I currently allow push notifications for are SMS and Signal, but the SMS texts are still overwhelming election spam from people who aren't even trying to spam me but have the wrong number for my mother or grandmother and bulk property buyers who claim they want to buy one of my houses. So I hope you plan to enable user-controllable proactive origin filtering (not after the fact user-by-user blocking).
throwingrocks 4y ago
Does this person work for Apple? I love how people here are simultaneously for pushing the web platform forward and also for holding it back.
- my123 4y ago
  Apple was right in restricting web notifications in the first place. The sad story is that they're abused way too much. :/ Now about how to fix that is an interesting question...
- lloydatkinson 4y ago
  No, don't be ridiculous. Having rescued several people from the described situations I wrote this because because it's an abused feature. If pushing the web forward is whatever the hell that assortment of notifications is at the top of the article, I'm all for holding it back.
- KevinGlass 4y ago
  This feature should never have existed. I used to work in a computer repair shop and saw hundreds of people with spam, scams, and malicious content piped directly to their computer. Most people have no idea how to make it stop, have no idea where it came from, but are aware it's happening and hate it. Browser push is probably close to 100% malicious or ads at this point. It's directly enabled scammers to steal 10s of millions of dollars. If Google came out with a feature that just stole $50 of iTunes gift cards from your granny no one would want it. That was browser push is at this point.
  - lloydatkinson 4y ago
    Yes, these types of stories are incredibly common unfortunately. The advice here should be taken on board by any repair shop.
  - rejectfinite 4y ago
    >This feature should never have existed The feature is needed for browser based mail, chat, calendar, meetings etc like office.com, Teams, Slack Yes, they all have native apps but some like to use web versions or being logged in to different accounts
Torlan 4y ago
Are these the same people who use billion dollar corporations like Twitter just for receiving another type of notification from the same sources instead of native way?
donkeyd 4y ago
Another interesting thing I found out is that Chrome seems to store pretty much all of these notifications, indefinitely, on the filesystem. It's a great source for reading messages someone has received on Whatsapp/Telegram web clients and things like that.
everydaypanos 4y ago
> Your non-technical family members and friends will likely fall for these at some point. For their sake, disable them. As the famous proverb says "give a man a fish and you feed him for a day; teach a man to fish and you feed him for a lifetime". The best way to "fix" phishing attacks and malware is by making people more "technical". The only way to eliminate these phenomena is by educating people about what a Push Notification really is and that you simply don't have to click it. The Web needs to be a competitive platform for apps next to the closed and "gated" App Stores. I think that we should not dumb down web browsers to simple page viewers.
- whiddershins 4y ago
  Many people are not ever going to ‘be more technical.’ Any plan now and going forward has to take this reality into account. Not blame the victim.
  - lloydatkinson 4y ago
    Yes, that was a pretty outlandish suggestion.
- scarface74 4y ago
  How has that worked out for the past four decades?
- ufmace 4y ago
  I've been around the tech world for a few decades. This sentiment has often been repeated about things like this, but I no longer believe that it's viable. The tech world is just too fast-moving, which means there's not really any such thing as "education". If you manage to teach someone something, it'll probably be out of date in a year or two, if not less. You have to pay attention to the latest trends all the time to really be knowledgeable about it. That just isn't going to happen.
- macNchz 4y ago
  I've managed to get my parents to be suspicious about emails and phone calls, to forward me anything they're unsure of, to reply to any communications purporting to be from their financial institutions by calling back with the number on their card or statement, to install updates as soon as they become available, to use unique passwords for everything and so on....but I still regularly find malicious extensions installed on their browsers and homepages set to some fake version of Google. I continue to try to educate, but nowadays I make sure they always have ad blockers installed (I believe most of the tricks they fall for stem from malicious ads) and I try to lock things down and disable features where it makes sense. I dislike the locked down world of iOS and what has become of MacOS, but I appreciate having it for devices they use. This is part of my job, I think about this stuff every day and I still worry I can't keep up, so I can't really expect the same from them.
mozman 4y ago
Push notifications are a detriment to society. All notifications are always blocked and my browser is blocked by my OS. I always “poll” data mentally, I find this to be crucial to me maintaining control over my devices and not allowing them to control me.
- Tepix 4y ago
  When your phone rings, it's a push notification of sorts. It is a real push notification if it's an OTP call. Most people are not ok with missing incoming calls.
  - intrasight 4y ago
    The phone app is the only one which I allow to have "push notifications". And they can be disabled. It's also the only one that I can think of that allows me to selectively enable based upon the sender (iOS user here).
    - samb1729 4y ago
      I believe you can also allow Messages notifications in Do Not Disturb mode for your favourite contacts, if that's desirable for you
      - intrasight 4y ago
        That's what I meant by "selectively enabled"
  - fmajid 4y ago
    "What, someone rings you like a valet, and you rush to answer?"— French playwright Sacha Guitry, about the telephone. You just described why millennials consider phone calls incredibly disruptive and rude (and I entirely agree with them despite being a Gen-Xer).
    - JohnFen 4y ago
delecti 4y ago
I understand the advice, but I don't agree they're entirely without purpose. > I have never seen them used for any legitimate or useful purpose That's definitely overblown. I've got a half-dozen enabled, and on re-reviewing that list, I still think they're legitimate. Upon checking mine, I've whitelisted Google Calendar, Gmail, Google Meet, Mattermost (work chat app), and Slack, and I want notifications enabled for all those things.
- jholman 4y ago
  Same: I understand the advice, but it's trivial to find cases where it's useful. I have three enabled. One is for a past side-hustle, but the others are messages.android.com and messages.google.com . Definitely keeping both of those, even if/when I finally mostly depart the google ecosystem.
- celtain 4y ago
  Right, a more reasonable argument would be just that the risks outweigh the benefits for some users, especially if they aren't currently using notifications on any legitimate sites.
- lloydatkinson 4y ago
  I'm sure people out there do have some use cases, and as the screenshots in the guide show you can still manually turn on specific notifications. Personally I haven't had any use cases for them and they have only been a source of frustration.
- majani 4y ago
  Exactly. I use mine to alert users of my poker site about tournaments. Many would lose money without these timely alerts
  - niij 4y ago
    "many" being gamblers or site operators ;)
- FabHK 4y ago
aeharding 4y ago
Some APIs need to be locked behind “add to home screen” starting with the notifications api.
- joshstrange 4y ago
  That's an interesting idea that I think I agree with, or maybe the site can only prompt you if it's been added but you can still manually enable it if you want (though adding the homescreen isn't the end of the world if you want notifications). That said, PWAs have downsides on iOS and I can't speak for Android. I'd almost always prefer to stay in Safari when looking at web content. I'm ok with webviews in apps for their internal UI but I almost always bounce from the in-app-browser to safari with the exception of maybe something like Reddit (Apollo) since normally things I look at from there are news articles or other read-only-type content. As soon as I need to login then I'm off to Safari. Off topic: I don't know if the situation is better on Android but my biggest pet peeve currently is being bounced into an app instead of the web version of the same page. Like clicking on an IMDB link in google results or a Steam link (often comments, like when I'm trying to figure out if something is a bug while playing on a console). I know the workaround for this (long-press link, open in new tab, or delete the app) but on the other side of that coin sometimes I get sent to the Amazon webpage but I want to bounce to the app where I'm logged in and the UI is better (IMHO) but I've yet to find a good way to do that (maybe "share" the page to the Amazon app? I've never tried).
Tepix 4y ago
Browser push notifications on mobile have the potential to make many native apps superfluous - use PWAs (progressive web apps) instead. According to Apple it'll finally arrive on iOS 16.x on Mobile Safari in 2023. It would be a shame if the feature becomes unusable for other reasons after being delayed for so long.
- sdfhbdf 4y ago
  Well I think the power usage (AFAIK the website needs to register a service worker working in the background) and abuse potential were the main concerns of Apple for not implementing it earlier. I am wondering what the limitations are going to be. As I understand Apple used to be the gatekeeper of all push notifications (App Store, APNS) but with enabling push notifications on the em web it might open the floodgates. Could be a thing, could be problematic.
- scarface74 4y ago
  So if Apple is the only reason that PWAs aren’t mainstream, why do most companies have web apps, iOS apps and Android apps instead of just telling Android users to go to the web?
  - Tepix 4y ago
    For many companies, apps are advantageous: 1. easier to install. Users are not used to PWAs and may not manage to install them. 2. easier tracking - you can't delete cookies inside an app. 3. can unlock the full potential of the device (almost, some private APIs are only for Apple/Google). PWAs have these advantages: - no censorship from Apple, Google, Amazon, other app stores - no fees paid to Apple and Google. - might be easier to develop in some cases - will run on both iOS and Android
    - scarface74 4y ago
      It still doesn’t answer the question. Android supposedly has great PWA support obviating the need to write native apps yet no one has ever stepped up to the challenge of finding popular examples where a company was forced to write an app for iOS . But decided that a PWA was good enough for Android. And despite the whining about fees, most (80% it came out during the Epic trial) App Store revenue is from games. And most other companies are either in the B2B space where the customers sign contracts outside of the App Store, B2C companies that are advertising supported, sell physical goods and services that are not effected by the policy (Uber, Amazon, etc) or have the option to bypass the App Store in app purchases like Netflix and Spotify.
userbinator 4y ago
Another annoyance that totally disappears if you disable JS. In fact, except for perhaps the "I have never seen them used for any legitimate or useful purpose" point, the content of the article could be about JS. As a bonus, fake warnings on the page may also disappear. I completely agree with the author about how hostile the "modern web" is. At least push notifications are dubious in value from the start, but unfortunatelY JS seems to be trying to replace built-in functionality of the browser like rendering static content.
- FabHK 4y ago
  I've come across a site (on HN, I think) with content written in Markdown which used JavaScript to render Markdown to HTML in the client/browser. Why oh why? I like to disable JS, but these days virtual no site works without it (except HN, kudos!)
intrasight 4y ago
I will rephrase as: "Consider disabling push notifications on your device and on family and friends devices" because browser vs native should make no difference, right? But when said that way, you see how absurd is the statement as a generate guide. This would be a full-time job to a) convince people not to get notifications and b) change their settings. Now personally, I have disabled all native push notifications or at best have them sent to the "Notification Center". And after seeing my GF bothered by so many notifications, I showed her how to disable them. Everyone else is on their own.
- markandrewj 4y ago
  You have the ability to disable just browser push notifications, at least for Android. I actually find notifications useful, but they can quickly become useless if you are receiving a lot of irrelevant notifications. If you disable all notifications on Android, you wont get things like calendar reminders. Although it can be useful for some web applications, I kind of wish that push notifications were not added to browsers. Most often they are just abused to spam users. The pop-up you get while going to pages asking you to allow push notifications is also annoying. I have started to disable notifications in all the browsers I use on mobile and desktop.
  - intrasight 4y ago
    Web and native apps have to ask. But we visit thousands of web sites vs use a dozen apps - so there are going to be many more irrelevant requests. Here's a question. Can you disable web sites asking while keeping the notifications that you have already allowed?
    - markandrewj 4y ago
      I haven't looked enough to know if this is possible. In general I found that any browser push notifications I may receive have been better served from a dedicated application.
kmeisthax 4y ago
Google Fi Messages uses push notifications and it's one of the few things that makes me really, really wish iPadOS had web push support. (I already have a SIM in my iPad, I just need to use a webapp to text or call.) Otherwise, completely agree. I've already had to clean out notification permissions from multiple people who were getting insidious amounts of web push spam. Nobody knows how to manage their notification permissions on Chrome, and web push popups themselves aren't great at telling you how to disable unwanted ones. I suppose this is why every hostile ad site begs you for web push permissions nowadays. Related gripe: websites that ask for location before you even have a chance to know why they need it.
Operative0198 4y ago
Wrong solution to the problem. Let's be honest here, they are only getting those notifications because they visited some random shady website and clicked on "allow" notifications as they would click the "accept" cookies button; to hide the nag. Installing uBlock or setting up ad-blocking DNS for your friends should cut out 99.9% of phishing and spam.
- scarface74 4y ago
  Is Toms Hardware considered “shady”?
  - Operative0198 4y ago
    Can't find that reference in the article. Are you sure you got that right?
    - scarface74 4y ago
      Toms Hardware does or at least did use web notifications for advertising. I believe PCWorld did also.
      - Operative0198 4y ago
        Oh okay. Missed the joke. Killing off the notifications feature on the account of a few rogue actors doesn't seem like a reasonable measure. Though ironically even if we are to take your example, I would consider advertising in this scenario to be harmless compared to receiving malicious phishing links in your notifications. I believe those 2 websites would never stoop that low.
        scarface74 4y ago
        They are mostly rogue actors. Almost everyone on the internet tries to monetize via advertising at every opportunity. And they may not purposefully stoop that low. But there are most likely using a third party ad network.
ilyt 4y ago
Oh damn, that makes me remember one weird event, my tech illiterate mum told me "did you heard queen died?" like... 3 months before that actually happened coz she accidentally subscribed to some random garbage on their phone and most likely assumed some clickbait header is actual news...
JohnFen 4y ago
Push notifications are horrible. They're automatically one of the first things I disable.
seydor 4y ago
As opposed to app notifications? Anyway people never click allow on those so they might as well be useless. I prefer to make my own notification system. If the user wants it , they leave the tab in the background , much like how i leave gmail. Aren't they already a privacy nightmare being so centralized?
- yamtaddle 4y ago
  > Anyway people never click allow on those so they might as well be useless. They do, by accident. And then wonder why the fuck they keep getting spam push messages and how to turn it off. Which is why the right thing to do is turn them off completely for non-technical friends and family. Likelihood of harm is near-zero (as you note, basically no-one wants these) and, at the very least, it saves them from distracting, useless pop-up dialogs.
rejectfinite 4y ago
Would rather install Firefox + uBlock Origin and block notifications per default. >I have never seen them used for any legitimate or useful purpose At work. If you use web-based email like office.com/outlook.com/gmail.com If you use MS Teams and/or Slack in a browser you want to have notifications on :)
rejectfinite 4y ago
Being in IT support, a bit above tier one, we got lots of these. We have endpoint protection of course, but they do not react to this of course as it is not real. But you can turn it off in Chrome, Edge and Firefox over GPO or Intune policy. And/or push out ublock origin too :) if customer allows/wants.
fmajid 4y ago
We need more distractions and interruptions getting in the way of flow like we need a hole in the head (something push notifications do a great work simulating, as far as impact to your productivity is concerned).
pleb_nz 4y ago
There are cases. But I prefer my browser to act as a sandbox. Push notifications are disabled and I don't get any requests to allow on any device I use. But then I don't like notifications in general even from apps and only have f exceptions for Telegram direct messages/sms and calendars. If I want to know if I have an email or some app has she news for me, it can wait until I make time to go have a look. I use devices to work and the last thing I want is distractions from notifications as much as possible. I also feel less overwhelmed and freer when exposed to less notifications.
InCityDreams 4y ago
The author should include in their own article: "watch out for bad grammar" which makes anything that does get past preferences and UBO seem even worse - “Your computer is infected with dangerous viruses.” “Your bank account has been compromised.” “System Is At Risk” "Your might loose your data!”
cronix 4y ago
I don't like this title, even though the article doesn't really mention the logistics. It implies for you to go and muck with someone else's device. I'd rather inform them and let them make up their own minds. I can't tell you how pissed I'd be if someone changed a setting on my phone without consent, regardless of how well intentioned they were.
notatoad 4y ago
consider not messing with people's computers without their permission. there's legitimate uses for browser notifications. messaging apps like slack and discord, calendars, email clients, etc. some browser games. some buy/sell platforms. notifications serve a purpose. if you understand the consequences and want to turn them off on your computer, then go ahead. but in my experience well-meaning young folks turning things off on other people's computers is a big part of why some people don't trust their computers, or think they're bad at computers. they're talking to a friend and find out that their friend's computer gives them a little notification every time they get an email, and they don't understand why their computer doesn't do that. and the first conclusion they come it is that they just don't know how to use the computer properly. meanwhile they know how to use their computer perfectly fine, but some grandson has gone through the settings and turned off half the things their computer does.
- angry_octet 4y ago
  I've done some victim support for people who have lost their life's savings to a phishing scam. If only they had someone helping them disable these things, install ad blockers, explain caller ID spoofing etc. I wish you could completely block URLs and phone numbers from SMS -- it's by far the most dangerous vector. People get a text from their bank, the tax agency, their medical fund, fedex. It warns them of a problem on their accounts and they leap into action like Pavlov's dog, clicking the link, calling the number. The nice man on the other end listens and says "we need to secure your accounts, but before we continue I need to do a full ID check. Can we start with the current balance of your account? Very good. And your full name and DOB? Okay, just waiting for the system, a bit slow today ha ha. Now we will be sending you a security prompt by SMS to verify you. We take security very seriously here...".
babypuncher 4y ago
The first thing I do when setting up a new browser is to permanently disable this feature. The feature had potential, but the fact that websites can ask you to enable push notifications unprompted renders it far more irritating than useful.
JTbane 4y ago
Browser push notifications give me the same vibe as the malware toolbars and add-ons of old.
bmk44 4y ago
I volunteer at a church by helping out with some basic IT issues from time to time. I recently had to disable Chrome browser notifications on one of their PCs because the McAffee anti-virus notifications just wouldn't stop. I thought I had already uninstalled the actual McAffee desktop software but I guess it embedded itself into the chrome browser somehow too. On a related note, I wish Chrome had an easy way to permanently say "don't ask again" (on a site-by-site basis) to the "Do you want to login with a google account?" popup that so many sites have nowadays.
- sentientslug 4y ago
  Ah, but that benefits Google so they wouldn’t do that.
asadotzler 4y ago
Teach them to pin the tabs of their most used "apps" and enable notifications for those tabs. The block future notification requests.
aendruk 4y ago
Legitimate notifications from web apps are still useful. (e.g. being mentioned in real-time chat) The problem is the rampant spamming of the permissions prompt itself and ensuing inadvertent acceptance. So the practical solution is to close that vector. Instead of the active popup, use only a passive menu entry or an unobtrusive icon, like how it already works for mailto handler registration.
deleted 4y ago
[deleted]
nov21b 4y ago
I'm considering moving a notification service currently implemented with email to Web Push Notifications. It's a shame these notifications have such a bad rep due to abuse. A permission request to enable Push Notifications should in my mind only be initiated from a user interaction. Like a toggle in a settings dialog to specifically enable these notifications for specific topics.

171 points by lloydatkinson 4y ago

I'm family of myself which is why I also disable push notifications always. Thankfully Apple does the right thing and doesn's support them at all.

wruza 4y ago
Wouldn’t it be better if ios could control notifications on both global and per-site basis?
- lzooz 4y ago
  As long as the default is to globally block and that enabling for a single site is as cumbersome as possible, that's okay.
  - wruza 4y ago
    Personally I’d like to run a server that could send notifications to me and to other people who would like to join this party. It is a valid use case and making it as cumbersome as possible feels wrong (depending on what it means of course). Though I agree that it would be good to not turn it on by ok-clicking like our parents always do. “aA -> turn on” would be enough, popups definitely banned.
- Tepix 4y ago
  That's what all browsers do and i'm sure mobile safari will do it too once the feature arrives.
pull_my_finger 4y ago
Sorry to be the bearer of bad news https://webkit.org/blog/13399/webkit-features-in-safari-16-1/#web-push-for-macos-ventura https://webkit.org/blog/13399/webkit-features-in-safari-16-1...
mavhc 4y ago
Thankfully Apple does the right thing and doesn't allow anyone to use knives in their kitchen

Markoff 4y ago

That is what I do when I have once a year father's/mother's phone in hand and I see notification bar flooded with crap notifications from various apps, not just browser. As for desktop, they should have adblockers which should take care of it hopefully.

lloydatkinson 4y ago
Unfortunately I have seen the notification prompts appear even with ad blockers installed
danuker 4y ago
I installed Linux (Manjaro), and the problems are confined to the browser (and then handled by uBlock Origin). But my parents only use the computer for browsing and very rarely for opening documents.

jasode 4y ago

Some HN/reddit threads recently mentioned Library Genesis so I visited with Chrome desktop web browser on mac and was surprised it caused a deceptive push notification. Screenshot: https://imgur.com/a/ZXxnM1G https://imgur.com/a/ZXxnM1G EDIT reply to: >That ad must've been injected by the proxy you were using to access LibGen. I just went to the top search result for "libgen" from google search result. It's possible they were trying a temporary monetization trial to take advantage of the Z-Library shutdown and that push notification is now gone. The other possibility is that the search result pointed to "libgen.ee" or "libgen.il" which apparently is a clone of Libgen (they call it "Library Genesis+") and it's the clone sites that have the push notifications. It's confusing to to people not familiar with it to know which is fake and which is real. (screenshot of google results: https://imgur.com/a/65Beo8H https://imgur.com/a/65Beo8H) On another side note, what's amazing is how that website got a push notification silently past Chrome's "Privacy and security" setting of "Sites can ask to send notifications". There was never a "Allow this site to send notification?" prompt. I wonder what Javascript trick they used to bypass Chrome's security.

notRobot 4y ago
That ad must've been injected by the proxy you were using to access LibGen. uBlock Origin detects no ads, malware or trackers on https://libgen.is/ https://libgen.is/ for me.
deleted 4y ago
[deleted]
arepublicadoceu 4y ago
> I just went to the top search result for "libgen" from google search result. Yeah, you should never use google for this. Protip: find the wikipedia article of your site of interest and bookmark it as a source of always up to date urls. Conversely, just use alternative search engines like duckduckgo and/or brave search.
- denton-scratch 4y ago
  > find the wikipedia article of your site of interest and bookmark it as a source of always up to date urls. I don't recommend relying on Wikipedia as a source of up-to-date anything.

nevi-me 4y ago

I'm at my mom's place, I had never thought of turning them all off. I think I should outright disable Chrome on Android notifications, as I now can't think of a reason why she should get notifications. She's been spammed by all sorts of nonsense from tabloids and scams. > In the same way that e-mail spam filtering works, so should browser push notification spam filtering. If you don’t implement this, you are complicit in the continued abuse of your users. I can't remember as I haven't worked on notifications in years, are the notifications not meant to be encrypted? Such that the browser vendor can't see the contents? With e-mail I understand and accept the message processing needed to identify if it's spam, but I'm wondering whether browser vendors (or more specifically, push servers) would today be able to intercept messages. Numerous services will allow messages to be sent via push notifications, wouldn't it cause issues if your browser vendor is now "reading your messages"? > If needing to filter browser push notifications for spam seems like a lot of work, then questions need answering about the value of the feature in the first place. Seriously, what is the value of this feature? I understood the feature as part of making PWAs able to replace the need for native apps. When browsers started supporting push notifications, I used the service to send public transit alerts to users who opted into them. > Were you pressured into it by ad companies? Why is the feature so open to abuse? Native apps can be removed from stores, and Google/Apple would (I assume) drive the lion share of notifications thorugh their servers, and can probably detect abusive behaviour more readily. With browsers, I'd again assume that it's harder, as one can use any service they'd like. Then what about Chromium where all the tracking stuff has been stripped out? Who would police that? Two possible solutions: 1. A blocklist is maintained, similarly to malicious websites. Don't know if flagging a website abusing notification marks it as malicious overall, but at least with malicious websites the user wouldn't even see the website. 2. If a user dismisses notifications and never opens them, perhaps the browser can take initiative and block them permanently. ---- I'm responding mainly with experience of spam on family's phones, I fortunately don't have elderly family who use PCs.

lloydatkinson 4y ago
> are the notifications not meant to be encrypted? Such that the browser vendor can't see the contents? No, the Windows API's for showing the notification (or for any OS) are going to need to know the text to render and the image to display, which is information the browser will have to tell those API's. > send public transit alerts Probably the only legitimate use case I've heard but I've personally used apps from the transit companies for this.

SavageBeast 4y ago

Being pretty much a 100% Chrome user, I've yet to click "Allow" when a site wanted to notify/spam/inundate me with shit from sub-companies or worse yet proxy spam me from paying 3rd parties because "well, you did opt in sir". The opt in popup box might as well read: "Are you an idiot? YES|MAYBE". Not one time have I allowed it ever in all these years and I'm shocked anyone else allows it at all too. Not having considered it before but I'm really surprised this tech is on by default or even exists at all. It may have some neat IOT use cases but IOT has about a billion other notification options for machine/machine communications that are better. Thats the best I can do in terms of trying to argue theres a good aspect of the functionality. But what about Gmail you say? Well, I personally don't use the web interface anyhow opting instead for a nice/superior experience from a local client but IIRC the tab starts blinking when theres new mail and the number in the title bar changes. Even LinkedIn and its simple blue dot on the title of the tab is sufficient for me to know theres new activity there if I want to bother looking (ooooh loooook - a guy I know knows a guy that posted a virtue signaling meme regarding a supposedly socially relevant topic that companies pretend to be concerned about - I MUST KNOW ABOUT THIS IMMEDIATELY!). Now, on to changing browser and OS notifications on all 4 home systems to my preferences this morning. I didn't realize how much the hubris of bugging me with stupid crap annoyed me until this prompted me to consider it. Thanks OP!

lloydatkinson 4y ago
> I'm shocked anyone else allows it at all too I was too! But then like I mentioned with UX dark patterns encouraging users to click by making them believe they have to click it, it's perhaps not as surprising. Non-technical users are already conditioned to click OK or Yes to anything that appears on their screen without reading it. Glad you found the advice useful!
rjzzleep 4y ago
Interesting. I'm in the same boat I never actually pressed allow, but somehow I never actually thought about disabling it either. I'm going to do that on my moms laptop as well when I get the chance.
simion314 4y ago

ack_inc 4y ago

The post says there are no legitimate use-cases for browser push notifications, but I disagree. I'm building a niche social media PWA (eschewing native apps to save time), and use browser push notifications to let my users know when someone has DM'ed them.

hdjjhhvvhga 4y ago
This is one of the very, very few cases when it makes sense. The problem is, everybody else is abusing it beyond imagination.
- Hamuko 4y ago
  Yeah, >90% of the uses are just pure abuse. Browsers should've really made it an user-initiated action. Something more akin to adding a site to your browser's bookmarks than what we have currently.
spiffytech 4y ago
BoardGameArena uses push notifications to let players know it's their turn. I prefer running Slack in the browser, and I need to receive message notifications. Push notifications aren't any less useful to have in browsers than in native apps. Though I would like to see the prompt locked behind "add to home screen".
- kevinyew 4y ago
  Sadly, boardgame arena also pushes advertising for new games and features through the notifications as well. I'm sure it's possible to disable specific categories, but it unfortunately undermines their value even more when otherwise legitimate sites still somewhat abuse push notifications.
nonameiguess 4y ago
Somewhat real-time chat with a human I'm talking to on purpose is the only legitimate use case I can think of and the only thing I enable any sort of push notification from at all, but even then, only from native apps. If the only reason this needs to be in a browser is saving time for the developer, that isn't a good enough reason for me as a user as long as other options exist that use native apps. Even to use this theoretically, though, I'd want the strict ability to control who can even send me a direct message. As it stands, the only thing I currently allow push notifications for are SMS and Signal, but the SMS texts are still overwhelming election spam from people who aren't even trying to spam me but have the wrong number for my mother or grandmother and bulk property buyers who claim they want to buy one of my houses. So I hope you plan to enable user-controllable proactive origin filtering (not after the fact user-by-user blocking).

throwingrocks 4y ago

Does this person work for Apple? I love how people here are simultaneously for pushing the web platform forward and also for holding it back.

my123 4y ago
Apple was right in restricting web notifications in the first place. The sad story is that they're abused way too much. :/ Now about how to fix that is an interesting question...
lloydatkinson 4y ago
No, don't be ridiculous. Having rescued several people from the described situations I wrote this because because it's an abused feature. If pushing the web forward is whatever the hell that assortment of notifications is at the top of the article, I'm all for holding it back.
KevinGlass 4y ago
This feature should never have existed. I used to work in a computer repair shop and saw hundreds of people with spam, scams, and malicious content piped directly to their computer. Most people have no idea how to make it stop, have no idea where it came from, but are aware it's happening and hate it. Browser push is probably close to 100% malicious or ads at this point. It's directly enabled scammers to steal 10s of millions of dollars. If Google came out with a feature that just stole $50 of iTunes gift cards from your granny no one would want it. That was browser push is at this point.
- lloydatkinson 4y ago
  Yes, these types of stories are incredibly common unfortunately. The advice here should be taken on board by any repair shop.
- rejectfinite 4y ago
  >This feature should never have existed The feature is needed for browser based mail, chat, calendar, meetings etc like office.com, Teams, Slack Yes, they all have native apps but some like to use web versions or being logged in to different accounts

Torlan 4y ago

Are these the same people who use billion dollar corporations like Twitter just for receiving another type of notification from the same sources instead of native way?

donkeyd 4y ago

Another interesting thing I found out is that Chrome seems to store pretty much all of these notifications, indefinitely, on the filesystem. It's a great source for reading messages someone has received on Whatsapp/Telegram web clients and things like that.

everydaypanos 4y ago

> Your non-technical family members and friends will likely fall for these at some point. For their sake, disable them. As the famous proverb says "give a man a fish and you feed him for a day; teach a man to fish and you feed him for a lifetime". The best way to "fix" phishing attacks and malware is by making people more "technical". The only way to eliminate these phenomena is by educating people about what a Push Notification really is and that you simply don't have to click it. The Web needs to be a competitive platform for apps next to the closed and "gated" App Stores. I think that we should not dumb down web browsers to simple page viewers.

whiddershins 4y ago
Many people are not ever going to ‘be more technical.’ Any plan now and going forward has to take this reality into account. Not blame the victim.
- lloydatkinson 4y ago
  Yes, that was a pretty outlandish suggestion.
scarface74 4y ago
How has that worked out for the past four decades?
ufmace 4y ago
I've been around the tech world for a few decades. This sentiment has often been repeated about things like this, but I no longer believe that it's viable. The tech world is just too fast-moving, which means there's not really any such thing as "education". If you manage to teach someone something, it'll probably be out of date in a year or two, if not less. You have to pay attention to the latest trends all the time to really be knowledgeable about it. That just isn't going to happen.
macNchz 4y ago
I've managed to get my parents to be suspicious about emails and phone calls, to forward me anything they're unsure of, to reply to any communications purporting to be from their financial institutions by calling back with the number on their card or statement, to install updates as soon as they become available, to use unique passwords for everything and so on....but I still regularly find malicious extensions installed on their browsers and homepages set to some fake version of Google. I continue to try to educate, but nowadays I make sure they always have ad blockers installed (I believe most of the tricks they fall for stem from malicious ads) and I try to lock things down and disable features where it makes sense. I dislike the locked down world of iOS and what has become of MacOS, but I appreciate having it for devices they use. This is part of my job, I think about this stuff every day and I still worry I can't keep up, so I can't really expect the same from them.

mozman 4y ago

Push notifications are a detriment to society. All notifications are always blocked and my browser is blocked by my OS. I always “poll” data mentally, I find this to be crucial to me maintaining control over my devices and not allowing them to control me.

Tepix 4y ago
When your phone rings, it's a push notification of sorts. It is a real push notification if it's an OTP call. Most people are not ok with missing incoming calls.
- intrasight 4y ago
  The phone app is the only one which I allow to have "push notifications". And they can be disabled. It's also the only one that I can think of that allows me to selectively enable based upon the sender (iOS user here).
  - samb1729 4y ago
    I believe you can also allow Messages notifications in Do Not Disturb mode for your favourite contacts, if that's desirable for you
    - intrasight 4y ago
      That's what I meant by "selectively enabled"
- fmajid 4y ago
  "What, someone rings you like a valet, and you rush to answer?"— French playwright Sacha Guitry, about the telephone. You just described why millennials consider phone calls incredibly disruptive and rude (and I entirely agree with them despite being a Gen-Xer).
  - JohnFen 4y ago

delecti 4y ago

I understand the advice, but I don't agree they're entirely without purpose. > I have never seen them used for any legitimate or useful purpose That's definitely overblown. I've got a half-dozen enabled, and on re-reviewing that list, I still think they're legitimate. Upon checking mine, I've whitelisted Google Calendar, Gmail, Google Meet, Mattermost (work chat app), and Slack, and I want notifications enabled for all those things.

jholman 4y ago
Same: I understand the advice, but it's trivial to find cases where it's useful. I have three enabled. One is for a past side-hustle, but the others are messages.android.com and messages.google.com . Definitely keeping both of those, even if/when I finally mostly depart the google ecosystem.
celtain 4y ago
Right, a more reasonable argument would be just that the risks outweigh the benefits for some users, especially if they aren't currently using notifications on any legitimate sites.
lloydatkinson 4y ago
I'm sure people out there do have some use cases, and as the screenshots in the guide show you can still manually turn on specific notifications. Personally I haven't had any use cases for them and they have only been a source of frustration.
majani 4y ago
Exactly. I use mine to alert users of my poker site about tournaments. Many would lose money without these timely alerts
- niij 4y ago
  "many" being gamblers or site operators ;)
FabHK 4y ago

aeharding 4y ago

Some APIs need to be locked behind “add to home screen” starting with the notifications api.

joshstrange 4y ago
That's an interesting idea that I think I agree with, or maybe the site can only prompt you if it's been added but you can still manually enable it if you want (though adding the homescreen isn't the end of the world if you want notifications). That said, PWAs have downsides on iOS and I can't speak for Android. I'd almost always prefer to stay in Safari when looking at web content. I'm ok with webviews in apps for their internal UI but I almost always bounce from the in-app-browser to safari with the exception of maybe something like Reddit (Apollo) since normally things I look at from there are news articles or other read-only-type content. As soon as I need to login then I'm off to Safari. Off topic: I don't know if the situation is better on Android but my biggest pet peeve currently is being bounced into an app instead of the web version of the same page. Like clicking on an IMDB link in google results or a Steam link (often comments, like when I'm trying to figure out if something is a bug while playing on a console). I know the workaround for this (long-press link, open in new tab, or delete the app) but on the other side of that coin sometimes I get sent to the Amazon webpage but I want to bounce to the app where I'm logged in and the UI is better (IMHO) but I've yet to find a good way to do that (maybe "share" the page to the Amazon app? I've never tried).

Tepix 4y ago

Browser push notifications on mobile have the potential to make many native apps superfluous - use PWAs (progressive web apps) instead. According to Apple it'll finally arrive on iOS 16.x on Mobile Safari in 2023. It would be a shame if the feature becomes unusable for other reasons after being delayed for so long.

sdfhbdf 4y ago
Well I think the power usage (AFAIK the website needs to register a service worker working in the background) and abuse potential were the main concerns of Apple for not implementing it earlier. I am wondering what the limitations are going to be. As I understand Apple used to be the gatekeeper of all push notifications (App Store, APNS) but with enabling push notifications on the em web it might open the floodgates. Could be a thing, could be problematic.
scarface74 4y ago
So if Apple is the only reason that PWAs aren’t mainstream, why do most companies have web apps, iOS apps and Android apps instead of just telling Android users to go to the web?
- Tepix 4y ago
  For many companies, apps are advantageous: 1. easier to install. Users are not used to PWAs and may not manage to install them. 2. easier tracking - you can't delete cookies inside an app. 3. can unlock the full potential of the device (almost, some private APIs are only for Apple/Google). PWAs have these advantages: - no censorship from Apple, Google, Amazon, other app stores - no fees paid to Apple and Google. - might be easier to develop in some cases - will run on both iOS and Android
  - scarface74 4y ago
    It still doesn’t answer the question. Android supposedly has great PWA support obviating the need to write native apps yet no one has ever stepped up to the challenge of finding popular examples where a company was forced to write an app for iOS . But decided that a PWA was good enough for Android. And despite the whining about fees, most (80% it came out during the Epic trial) App Store revenue is from games. And most other companies are either in the B2B space where the customers sign contracts outside of the App Store, B2C companies that are advertising supported, sell physical goods and services that are not effected by the policy (Uber, Amazon, etc) or have the option to bypass the App Store in app purchases like Netflix and Spotify.

userbinator 4y ago

Another annoyance that totally disappears if you disable JS. In fact, except for perhaps the "I have never seen them used for any legitimate or useful purpose" point, the content of the article could be about JS. As a bonus, fake warnings on the page may also disappear. I completely agree with the author about how hostile the "modern web" is. At least push notifications are dubious in value from the start, but unfortunatelY JS seems to be trying to replace built-in functionality of the browser like rendering static content.

FabHK 4y ago
I've come across a site (on HN, I think) with content written in Markdown which used JavaScript to render Markdown to HTML in the client/browser. Why oh why? I like to disable JS, but these days virtual no site works without it (except HN, kudos!)

intrasight 4y ago

I will rephrase as: "Consider disabling push notifications on your device and on family and friends devices" because browser vs native should make no difference, right? But when said that way, you see how absurd is the statement as a generate guide. This would be a full-time job to a) convince people not to get notifications and b) change their settings. Now personally, I have disabled all native push notifications or at best have them sent to the "Notification Center". And after seeing my GF bothered by so many notifications, I showed her how to disable them. Everyone else is on their own.

markandrewj 4y ago
You have the ability to disable just browser push notifications, at least for Android. I actually find notifications useful, but they can quickly become useless if you are receiving a lot of irrelevant notifications. If you disable all notifications on Android, you wont get things like calendar reminders. Although it can be useful for some web applications, I kind of wish that push notifications were not added to browsers. Most often they are just abused to spam users. The pop-up you get while going to pages asking you to allow push notifications is also annoying. I have started to disable notifications in all the browsers I use on mobile and desktop.
- intrasight 4y ago
  Web and native apps have to ask. But we visit thousands of web sites vs use a dozen apps - so there are going to be many more irrelevant requests. Here's a question. Can you disable web sites asking while keeping the notifications that you have already allowed?
  - markandrewj 4y ago
    I haven't looked enough to know if this is possible. In general I found that any browser push notifications I may receive have been better served from a dedicated application.

kmeisthax 4y ago

Google Fi Messages uses push notifications and it's one of the few things that makes me really, really wish iPadOS had web push support. (I already have a SIM in my iPad, I just need to use a webapp to text or call.) Otherwise, completely agree. I've already had to clean out notification permissions from multiple people who were getting insidious amounts of web push spam. Nobody knows how to manage their notification permissions on Chrome, and web push popups themselves aren't great at telling you how to disable unwanted ones. I suppose this is why every hostile ad site begs you for web push permissions nowadays. Related gripe: websites that ask for location before you even have a chance to know why they need it.

Operative0198 4y ago

Wrong solution to the problem. Let's be honest here, they are only getting those notifications because they visited some random shady website and clicked on "allow" notifications as they would click the "accept" cookies button; to hide the nag. Installing uBlock or setting up ad-blocking DNS for your friends should cut out 99.9% of phishing and spam.

scarface74 4y ago
Is Toms Hardware considered “shady”?
- Operative0198 4y ago
  Can't find that reference in the article. Are you sure you got that right?
  - scarface74 4y ago
    Toms Hardware does or at least did use web notifications for advertising. I believe PCWorld did also.
    - Operative0198 4y ago
      Oh okay. Missed the joke. Killing off the notifications feature on the account of a few rogue actors doesn't seem like a reasonable measure. Though ironically even if we are to take your example, I would consider advertising in this scenario to be harmless compared to receiving malicious phishing links in your notifications. I believe those 2 websites would never stoop that low.
      - scarface74 4y ago
        They are mostly rogue actors. Almost everyone on the internet tries to monetize via advertising at every opportunity. And they may not purposefully stoop that low. But there are most likely using a third party ad network.

ilyt 4y ago

Oh damn, that makes me remember one weird event, my tech illiterate mum told me "did you heard queen died?" like... 3 months before that actually happened coz she accidentally subscribed to some random garbage on their phone and most likely assumed some clickbait header is actual news...

JohnFen 4y ago

Push notifications are horrible. They're automatically one of the first things I disable.

seydor 4y ago

As opposed to app notifications? Anyway people never click allow on those so they might as well be useless. I prefer to make my own notification system. If the user wants it , they leave the tab in the background , much like how i leave gmail. Aren't they already a privacy nightmare being so centralized?

yamtaddle 4y ago
> Anyway people never click allow on those so they might as well be useless. They do, by accident. And then wonder why the fuck they keep getting spam push messages and how to turn it off. Which is why the right thing to do is turn them off completely for non-technical friends and family. Likelihood of harm is near-zero (as you note, basically no-one wants these) and, at the very least, it saves them from distracting, useless pop-up dialogs.

rejectfinite 4y ago

Would rather install Firefox + uBlock Origin and block notifications per default. >I have never seen them used for any legitimate or useful purpose At work. If you use web-based email like office.com/outlook.com/gmail.com If you use MS Teams and/or Slack in a browser you want to have notifications on :)

rejectfinite 4y ago

Being in IT support, a bit above tier one, we got lots of these. We have endpoint protection of course, but they do not react to this of course as it is not real. But you can turn it off in Chrome, Edge and Firefox over GPO or Intune policy. And/or push out ublock origin too :) if customer allows/wants.

fmajid 4y ago

We need more distractions and interruptions getting in the way of flow like we need a hole in the head (something push notifications do a great work simulating, as far as impact to your productivity is concerned).

pleb_nz 4y ago

There are cases. But I prefer my browser to act as a sandbox. Push notifications are disabled and I don't get any requests to allow on any device I use. But then I don't like notifications in general even from apps and only have f exceptions for Telegram direct messages/sms and calendars. If I want to know if I have an email or some app has she news for me, it can wait until I make time to go have a look. I use devices to work and the last thing I want is distractions from notifications as much as possible. I also feel less overwhelmed and freer when exposed to less notifications.

InCityDreams 4y ago

The author should include in their own article: "watch out for bad grammar" which makes anything that does get past preferences and UBO seem even worse - “Your computer is infected with dangerous viruses.” “Your bank account has been compromised.” “System Is At Risk” "Your might loose your data!”

cronix 4y ago

I don't like this title, even though the article doesn't really mention the logistics. It implies for you to go and muck with someone else's device. I'd rather inform them and let them make up their own minds. I can't tell you how pissed I'd be if someone changed a setting on my phone without consent, regardless of how well intentioned they were.

notatoad 4y ago

consider not messing with people's computers without their permission. there's legitimate uses for browser notifications. messaging apps like slack and discord, calendars, email clients, etc. some browser games. some buy/sell platforms. notifications serve a purpose. if you understand the consequences and want to turn them off on your computer, then go ahead. but in my experience well-meaning young folks turning things off on other people's computers is a big part of why some people don't trust their computers, or think they're bad at computers. they're talking to a friend and find out that their friend's computer gives them a little notification every time they get an email, and they don't understand why their computer doesn't do that. and the first conclusion they come it is that they just don't know how to use the computer properly. meanwhile they know how to use their computer perfectly fine, but some grandson has gone through the settings and turned off half the things their computer does.

angry_octet 4y ago
I've done some victim support for people who have lost their life's savings to a phishing scam. If only they had someone helping them disable these things, install ad blockers, explain caller ID spoofing etc. I wish you could completely block URLs and phone numbers from SMS -- it's by far the most dangerous vector. People get a text from their bank, the tax agency, their medical fund, fedex. It warns them of a problem on their accounts and they leap into action like Pavlov's dog, clicking the link, calling the number. The nice man on the other end listens and says "we need to secure your accounts, but before we continue I need to do a full ID check. Can we start with the current balance of your account? Very good. And your full name and DOB? Okay, just waiting for the system, a bit slow today ha ha. Now we will be sending you a security prompt by SMS to verify you. We take security very seriously here...".

babypuncher 4y ago

The first thing I do when setting up a new browser is to permanently disable this feature. The feature had potential, but the fact that websites can ask you to enable push notifications unprompted renders it far more irritating than useful.

JTbane 4y ago

Browser push notifications give me the same vibe as the malware toolbars and add-ons of old.

bmk44 4y ago

I volunteer at a church by helping out with some basic IT issues from time to time. I recently had to disable Chrome browser notifications on one of their PCs because the McAffee anti-virus notifications just wouldn't stop. I thought I had already uninstalled the actual McAffee desktop software but I guess it embedded itself into the chrome browser somehow too. On a related note, I wish Chrome had an easy way to permanently say "don't ask again" (on a site-by-site basis) to the "Do you want to login with a google account?" popup that so many sites have nowadays.

sentientslug 4y ago
Ah, but that benefits Google so they wouldn’t do that.

asadotzler 4y ago

Teach them to pin the tabs of their most used "apps" and enable notifications for those tabs. The block future notification requests.

aendruk 4y ago

Legitimate notifications from web apps are still useful. (e.g. being mentioned in real-time chat) The problem is the rampant spamming of the permissions prompt itself and ensuing inadvertent acceptance. So the practical solution is to close that vector. Instead of the active popup, use only a passive menu entry or an unobtrusive icon, like how it already works for mailto handler registration.

deleted 4y ago

[deleted]

nov21b 4y ago

I'm considering moving a notification service currently implemented with email to Web Push Notifications. It's a shame these notifications have such a bad rep due to abuse. A permission request to enable Push Notifications should in my mind only be initiated from a user interaction. Like a toggle in a settings dialog to specifically enable these notifications for specific topics.