New issue
Advanced search Search tips

Issue 593169 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 588516
Owner: ----
Closed: May 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug
Team-Security-UX



Sign in to add a comment

Can't view the *changed* permissions for an extension upon upgrade.

Project Member Reported by lgar...@chromium.org, Mar 8 2016

Issue description

What steps will reproduce the problem?
(1) Install an extension.
(2) Receive an upgrade to the extension that requires approving more permissions

What is the expected output? What do you see instead?
The dropdown from the menu (menu-dropdown.png) uses the phrase "It can now: [lit of permissions]". Upon first reading, this suggests to me that these are the *newly requested* permissions. That is, I interpreted it as: "in addition to what the extension could do in the past,*it can now*:"
However, it appears to be a list of all permissions.

If you visit the extension in chrome://extensions, it is already shown as upgraded but disabled. Clicking on "Permissions" shows the same full list of permissions for teh upgraded version (chrome-extensions.png).

On the one hand, it is not a bad idea to be transparent and show all the permissions.

However, the current message looks alarming than it should, and requires more cognitive overhead. Ideally, I'd like to see what the old permissions were as well as which ones changed.
Lower cognitive overhead: I want to be able to trust that I reviewed the old permissions in the past, and only think about the changes.

Is it easy to at least expose the old permissions in chrome://extensions?
 
menu-dropdown.png
70.3 KB View Download
chrome-extensions.png
63.9 KB View Download
As far as I remember there are some limitations to what that dialog can do, e.g. it can't have an expand button (because of how it's implemented?). I think bug 440003 and bug 443216 already covers this bug though.
Hmm, you're right, those bugs talk about the same fundamental problem, but they're stalled since 2014. :-(

Although I wouldn't mind deduping, this bug covers something the others don't: Not only does the bubble not make it clear what permissions have changed, but there is no way, *even for a savvy user or a developer*, to tell what permissions have changed.
Mergedinto: 588516
Status: Duplicate (was: Untriaged)
Duping.  Will transfer #2.

Sign in to add a comment