New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 685915 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 82362
Owner: ----
Closed: Feb 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 2
Type: Feature
Team-Security-UX



Sign in to add a comment

More aggressive popup blocking

Project Member Reported by pkasting@chromium.org, Jan 27 2017

Issue description

Things I recall we discussed:

* Shift popup blocker options to basically "prevent any popups for any reason" vs. "allow a single popup on click" (may require checking UMA stats for existing "allow" usage).  Thought: perhaps in either of these cases adding a whitelisted site should let it show popups without a click, so that "whitelist this site for your popup blocker" still works?

* Close holes with Flash-triggered popups.

Almost any porn site (e.g. YouPorn) is a good testcase for popups, they seem to like to open popups on the first click of any specific video's page.
 
Cc: dominickn@chromium.org jochen@chromium.org
Components: Internals>Permissions>Model
Owner: kcaratt...@chromium.org
Status: Assigned (was: Untriaged)
It seems we use simplified "Block" language now, but "Block" only applies to non-user-gesture popups.

Kendra, do you have data on how what settings people are using for popups?
And who would make a decision about adding a "Full Block" level?
Incidentally, since you used the word "adding" -- I suspect if we try to turn popup blocking into a three-state setup we're going to stall, and personally I think we would do well to stick with two states, where one of the two is "never show popups, not even on gesture" and the other is whatever.  Not sure what "adding" was intended to convey, so just throwing that out there :)

Also, if the Flash-triggered stuff should be forked off to its own bug, please feel free to do so -- I don't know exactly what the state of the world there is, only that Jochen says there are improvements that could be made but haven't been due to test coverage.
Cc: emilyschechter@chromium.org
Ah, okay. So like this:
- Allow
- Default (current "Block" behaviour == allow 1 per user gesture, else block and show page action)
- Block (block alllllllllll)

That was how I had *assumed* this worked until you pointed out otherwise last night.

That sounds fine to me. Sydney folks/Emily: How much research/approval do we need for a change like that?
Uh... are we talking past each other?  I was saying that we should try and stick with two states, whatever we do (in your labels, "block" + either "default" or "allow").  And "block" should be default.

Comment 5 by jochen@chromium.org, Jan 28 2017

Right, I'd suggest to go for "block all popups whatsoever (default)" and "allow popups with user gesture"

as opposed to currently "allow all popups" and "allow popups with user gesture (default)"
Apparently we were.

I presume some use cases require popups without user gestures. I've certainly seen Chrome experiments that require it.

Comment 7 by eisinger@google.com, Jan 28 2017

that's like the only case I know of.
That's why I said in my first comment "perhaps in either of these cases adding a whitelisted site should let it show popups without a click".

In other words, under the hood there are actually the three states you describe, and if you make an "allow" exception, it means "fully allow", even if that isn't one of the choices we give you for the global setting.
I'm a bit confused -- @jochen would you be able to clear up what the current behaviour is? I know there is a way for users to block and allow popups, and there is also a default state, but somehow this maps to only two Content Settings?
Also to answer #1, we only added popup metrics in M57 so it will be a while before we have numbers.
Mergedinto: 82362
Status: Duplicate (was: Assigned)
Owner: ----
Removing myself as owner since this is a duplicate.

Sign in to add a comment