3 ms·

This introduces an especially silly attack vector: if you expect that asking for a specific permission might alarm users, and if you can push it below the fold,

This introduces an especially silly attack vector: if you expect that asking for a specific permission might alarm users, and if you can push it below the fold, just ask for more innocuous or plausible permissions than you need! Besides the oversight of hiding some permission requests, this highlights that the order they’re presented matters too. Even if it weren’t scrollable with ~invisible indication of that, people stop reading at some point. If N lines (I’m gonna guess ~5 for most people) seem totally innocuous, the rest are probably effectively invisible.

ameliaquining 4y ago
In general, for the most part, it looks like the permissions shown higher in the list are the more dangerous ones. In particular, "read and change all your data on websites" is by far the most dangerous permission, and it always appears first or second. ("Access the page debugger backend", which is above it, sounds technical and opaque to most users, but the permission that it gates also triggers the "read and change all your data" warning.) I vaguely suspect that this is by design.
- eyelidlessness 4y ago
  There are several below the fold that I’d consider more dangerous than “show notifications”, but I suppose that one is enough of a nuisance to most people that it gets sorted up. Either way, having this kind of design is an opportunity for it to be gamed. Probably a better design would be more annoying over time (prompting for permissions as needed), but I’m the oddball who’d prefer that annoyance over this kind of approve-and-forget scheme.
- pflenker 4y ago
  Every ad blocker asks for "read and change all your data on websites" permission, same as page scrapers/readability tools - so depending on the disguise I think it won't be hard to get this permission.
jefftk 4y ago
> just ask for more innocuous or plausible permissions than you need! Looking at the list I think they're sorting by ~alarmingness, so it seems hard to push an alarming one below the fold with innocuous ones?

ameliaquining 4y ago

In general, for the most part, it looks like the permissions shown higher in the list are the more dangerous ones. In particular, "read and change all your data on websites" is by far the most dangerous permission, and it always appears first or second. ("Access the page debugger backend", which is above it, sounds technical and opaque to most users, but the permission that it gates also triggers the "read and change all your data" warning.) I vaguely suspect that this is by design.

eyelidlessness 4y ago
There are several below the fold that I’d consider more dangerous than “show notifications”, but I suppose that one is enough of a nuisance to most people that it gets sorted up. Either way, having this kind of design is an opportunity for it to be gamed. Probably a better design would be more annoying over time (prompting for permissions as needed), but I’m the oddball who’d prefer that annoyance over this kind of approve-and-forget scheme.
pflenker 4y ago
Every ad blocker asks for "read and change all your data on websites" permission, same as page scrapers/readability tools - so depending on the disguise I think it won't be hard to get this permission.

jefftk 4y ago

> just ask for more innocuous or plausible permissions than you need! Looking at the list I think they're sorting by ~alarmingness, so it seems hard to push an alarming one below the fold with innocuous ones?