Hacker News Reader

Comment by davidsawyer | Hacker News Reader

Yeah, I agree it's definitely a good security practice of Chrome. On the developer side of this, though, it definitely can lose you a lot of users pretty quickly if you add new permissions at any point, so I think it's important to carefully consider permissions before launching an extension.

For my Chrome extension[1], a change[2] in the Airbnb URLs that it runs on caused a significant spike in uninstalls[3] just because it probably scared people a bit. Not a huge deal or anything. Just wanted to share my experience with this stuff.

[1] https://chrome.google.com/webstore/detail/airbnb-price-per-n...

[2] https://github.com/davidsawyer/airbnb-price-per-night-correc...

[3] https://i.imgur.com/JBBolM1.png

View on HN

Interesting. I'll probably add some form of github and/or reddit support in the future, and I don't feel comfortable adding those URLs unnecessarily, so at somepoint there will be permissions updates anyway ¯\_(ツ)_/¯

Being able to display a custom message along the permission update request would be great, just like how GitHub does it for apps.

Requesting additional permissions without an explanation accompanying it can cause confusion, users may think that the request is unwarranted, or that there is something wrong with the extension. They may also decline it out of habit, given how extensions are auto-updated during the browser session, and the request seemingly pops out of nowhere.

See the version adoption[0] for one of my extensions, 1.1.0 has requested additional permissions. This may be problematic when you are trying to deliver a critical update that requires new permissions.

[0] https://i.imgur.com/hiKLyYT.png

I think chrome has an API for requesting permissions, instead of having them part of the extensions manifest. This means you can present custom prompts and such before the chrome prompt.

Yeah, I think that's the right way to do it. You don't really want to add entire domains that your extension does nothing with yet. Though in hindsight, I should have just found all the Airbnb subdomains, TLDs, etc. up front because my extension was intended to be used throughout all of Airbnb, if that makes sense.

Reply on news.ycombinator.com