New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 740961 link

Starred by 10 users

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 2
Type: Feature
Team-Security-UX



Sign in to add a comment

All websites spams with requests to show notifications

Project Member Reported by maggiolo@google.com, Jul 11 2017

Issue description

Sorry I could not find a template for feature requests.

What steps will reproduce the problem?
(1) go to almost any website
(2) get a drawn-on-top "Allow website to show notification" prompt
(3) cry

There seems to be a trend where any website wants to show notifications. The current dialog is drawn on top of the page and is annoying. I'm sure a solution would require a lot of PM-ming, but something along the line of the following would be an improvement to me:
- by default do not show the dialog allow/block, just add something in a much less prominent way (icon?)
- draw the current dialog only after N visits, or X time on the site.
 
Components: UI>Notifications
Labels: M-61 OS-Linux OS-Mac OS-Windows Pri-2 Type-Feature
Status: Untriaged (was: Unconfirmed)
This seems to be a feature request. Hence, marking it as untriaged to get more inputs from the dev team.

Thanks...!!

Comment 2 by peter@chromium.org, Jul 13 2017

Cc: raymes@chromium.org emilyschechter@chromium.org
Labels: -Restrict-View-Google -OS-Linux -OS-Windows -OS-Mac OS-All
Status: Available (was: Untriaged)
We're aware of this and are thinking about solutions, but most ideas we've come up with result in (significant) breakage. Emily, Raymes, is there an existing bug tracking this or shall we use this one?

Comment 3 by raymes@chromium.org, Jul 16 2017

Cc: dominickn@chromium.org benwells@chromium.org kcaratt...@chromium.org owe...@chromium.org
Components: UI>Browser>Permissions>Prompts
Owner: peter@chromium.org
Status: Assigned (was: Available)
I don't think there is one. Let's use this :)

The last thread on this seems to have gone cold. At a high level it sounded like people were ok with using site engagement. Did you investigate that more closely, Peter? 
Components: Privacy

Comment 5 by battre@chromium.org, Jul 17 2017

Cc: ojan@chromium.org
Peter, didn't you write a doc to evaluate impact? I don't think I've seen it, could you link?

Comment 7 by ojan@chromium.org, Jul 18 2017

There's some good discussion at https://github.com/WICG/interventions/issues/49 about this. In particular, I think the comment about how web authors are expected to interact with site engagement when they don't know if they've hit the engagement threshold is a good one that we should have a deliberate response that seems reasonable. What counts as reasonable probably partially depends on what engagement score we require.

Comment 8 by raymes@chromium.org, Jul 19 2017

The other issue mentioned there is that push services don't tend to have any engagement when HTTP websites redirect to them to request notifications. 

AFAICT it's impossible to distinguish that case from the annoyance case. Would it be bad to require a user gesture in those cases? I understand it would be a larger barrier to entry to require a user gesture in that case but maybe that's a worthwhile tradeoff for now. This only affects http sites using push services.

Comment 9 by owe...@chromium.org, Jul 20 2017

It is unfortunate that there's no clear way to avoid breaking that, but IMHO in the long run we'd like to see developers moving away from that workaround anyway so if we need to accelerate moving people away from that flow in order to help improve this problem I think that could be a reasonable trade off.
peter: what are your thoughts? 
Labels: Hotlist-EnamelAndFriendsFixIt
+1 I find the frequent requests annoying and I haven't selected "allow" for any of them, except a couple of obvious ones (actually, calendar is the only one I can think of).  I would gladly trade a little extra work to turn on calendar notifications vs. the continuous annoyance of denying requests, plus the possibility of approving them by mistake (which has happened).
If you really don't want notification requests (on desktop), you can already go to chrome://settings/content/notifications and block "http://*" and "https://*". To enable individual sites you then have to click "secure" (https) or the info sign (http) in the omnibox and manually enable notifications for sites you like.

You can also just hit the toggle in the settings page, which changes the default to block. We're currently working on Crowd Consent (bug 793522) to reduce the number of prompts users will get.

Comment 15 by na...@chromium.org, Jan 19 2018

peter: is it OK to merge this with bug 793522 or is there something more we're planning to do here?
Hey, I kinda get annoyed with Notifications too and I did already do what is said in comment #14 and changed the Notifications to be set to Blocked by default, I did that to basically all permissions and it has been a much better experience.

The problem, though, that I have is not on my machine, but on relatives, friends and friend's relatives machines. Basically I have had the luck to use a Chrome desktop instance where the user seemed to have accepted any dialog of permissions given to them, since a ton of notifications were popping each few minutes.
What I'm not sure is which of the following things happens:
1 - the permission dialog scares the user and they want to close it ASAP, so they end up allowing notifications
2 - the website ends up convincing them that it will be a good idea to give them the permissions

I do think it is very unlikely to be the second one, since the websites I saw on these machines tend to be clickbait content sites.

Now, if it's the first one then these are the ideas I think are important:

- Make it easy to do the right thing and harder to do the wrong thing:

In the grant permission dialog make the "Deny" button a very colorful button and place it on the main action position. Also, make the "Allow" button only actionable after 5 seconds and place it on the secondary action position.
The user should never grant the position on auto pilot, make it so the person has to think before allowing.

- Make the permission dialog less intrusive

Since I have basically every permission blocked by default, I would say that how Chrome already deals with it is basically perfect. What might be needed is to extend that behavior and make it a little more visible for Ask as default behavior.
If I were to think how it could work I would do this way: Since AFAIK only https websites can show ads, I would make a small bubble extend from below the "Secure" part of the omnibar. This bubble would only say "This site wants to: " and show a notification bubble image. This bubble would have exactly the height of the omnibar as its height.
Labels: -Hotlist-EnamelAndFriendsFixIt
Related: Ctrl-W doesn't work then the notifications dialog is up: https://bugs.chromium.org/p/chromium/issues/detail?id=807643

Comment 19 by zilka@google.com, Apr 3 2018

+1 the popup is really annoying... It is sad to see that after fining a great solution to the annoying popups that websites used to show, just to replace it with another one :(

Comment 20 by d3c...@gmail.com, Jun 6 2018

When a popup is given, clicking 'deny' adds to the list of rejected sites.
if a site is aleady in the reject list, shouldn't it just not prompt?
Every time you visit a site with notifications, and you say 'no' you have to continue to say no.  I gave up and said yes, but man was THAT a mistake.  I went back to disable it.  But, now every time I go to the page, I have to find and click the block notifications dialog.

So; why hasn't this aleady just checked list of sites that have been blocked (or allowed) and just not show the allow notifications popup?
If you click "Block" on a permission prompt, the site should not be able to ask you again. 
Could you tell us your version of Chrome, your OS and the website that is causing the problem?
another (albeit more minor) annoyance, is visiting certain ... popular media-sites via incognito-mode (you may like their "content", but u don't necessarily trust the scruples of the site-operators).  so it would be nice to figure out a way to auto-block notifications for sites u regularly visit only via incognito as well.
#22: notification permission cannot be granted in incognito mode, so sites you only visit in incognito cannot send you notifications at all. In what way are you seeing notifications while in incognito?

Sign in to add a comment