danreeves / dt-exchange

39 stars 18 forks source link

Concerns with increased amount of permissions #15

Closed errnoh closed 1 year ago

errnoh commented 1 year ago

Concerns were raised in the discord channel about the extension suddenly requiring permission to access browsing history. Following answer was given by user ihalila:

I believe this is because the extension accesses your tabs now, so that if you click the extension's icon it'll open the Armoury tab if you have it open or open a new tab to it. To figure out if you have a tab with the armoury already open it reads the urls of every tab you have open. Since it can access the urls of every tab you have, it could start recording your browser history by saving every url you open, hence the warning.

Didn't yet check the code myself but thought it might be worth discussing the topic here. If the above is correct I feel like it might be good enough user experience to have the icon open the store page on a new tab and avoid requiring additional permissions, keeping the permission scope at the bare minimum. Any thoughts?

hammerandtongs commented 1 year ago

The bare minimum permissions made it more likely that I would use this extension.

I don't think the "access browsing history" was worth adding, you are losing trust in the extension from ordinary users even though you make it easier to access.

danreeves commented 1 year ago

Yep, totally agree. I didn't realise it would ask for full browser history permission when I added "tabs" permission. Going to remove or downgrade the feature so it doesn't need this permission