search

proginosko / LeechBlockNG-chrome

LeechBlock NG (Next Generation) for Chrome is a simple productivity tool designed to block those time-wasting sites that can suck the life out of your working day. All you need to do is specify which sites to block and when to block them.
https://www.proginosko.com/leechblock/
Mozilla Public License 2.0
72 stars 14 forks source link

Why does LeechBlock now require "Read and change your browsing history on all your signed-in devices"? #64

Closed paulcalcraft closed 5 months ago

paulcalcraft commented 7 months ago

Hi, Chrome just automatically disabled LeechBlock until I confirm the new permissions, would it be possible to check what the new permissions are for and if they are truly compulsory for the extension to function?

image

Edit: Ok, I've just spotted on the release notes on a new feature. Chrome is behaving like this is not an optional permission. I'd rather not grant it if I don't plan to use that feature. Is it possible to only request the additional permission when required by the user's options?

image

Many thanks, Paul

proginosko commented 7 months ago

Yes, the 'history' permission is needed for the option "Add blocked page to browser history" (a requested feature implemented in version 1.6.2). I added it as an install-time permission, since that's the most streamlined way to do it (no interruption to the user experience later on).

I assumed users would not object, since LB already has the 'tabs' permission, so it can monitor all browsed sites and pages. After all, if I'm okay with LB seeing whatever I'm browsing now, why would I object to LB seeing my browsing history?

But you're right: it could have been implemented as an optional permission, only requested when the user selects that option. Let me think it over some more. I'm certainly open to changing it, but you would have to wait for the next release.

gnyman commented 7 months ago

Just a quick comment, as I ended up here after investigating that same popup.

I don't think the problem is the specific permission, but rather that the user-experience of the prompt is not great. There has been so many cases where extensions have been acquired and started doing more nefarious cases so when I saw the popup I got really suspicious. The main issue I think is the lack of additional information provided by the warning. It includes no reason why it needs this, also I doubt many even remember or know that the extension already have access to all their tabs (so it could create it's own history). So this makes the warning sound especially dangerous for a extension which is supposed to block me from accessing a website right now.

I guess it's not possible to provide more information that would be shown with the popup? If so, from a user-experience I think it could be better to switch to a on-demand warning, as at least to me, that would give some context on why the additional permissions are needed.

Either way, thank you for making and supporting the extension. Happy New Year!

proginosko commented 7 months ago

Thanks, @gnyman. That's a helpful take. Unfortunately, as far as I know, extensions can't customize the warning message.

paulcalcraft commented 6 months ago

Thanks, that makes sense @proginosko

There has been so many cases where extensions have been acquired and started doing more nefarious cases so when I saw the popup I got really suspicious.

@gnyman yes, that's exactly what I was thinking!

And it was the change browsing history that I was concerned about. I have possibly a decade of browsing history on chrome, I really don't want that edited or lost (e.g. via a bug)

So yes, for me, I'd prefer a prompt for permission when used, but I totally get that 90%+ of users would have no issue with it. So I understand you keeping it as is.

Thanks for all your work on the extension!