"Please stop looking at all network requests, especially when you don't need to."
doesn't result in action... while:
"You can no longer look at all network requests" requires extension makers to update to the new paradigm.
"Please stop looking at all network requests, especially when you don't need to."
doesn't result in action... while:
"You can no longer look at all network requests" requires extension makers to update to the new paradigm.
It's not "please stop looking at network requests", it's "ask the user for informed consent to look at network requests". Make it a big scary red warning if you want to. Definitely don't auto-grant it to existing extensions.
There are many options that don't involve removing functionality. It's like when Google removed SMS and clipboard permissions because they used to be too broad. People were pissed, a bunch of apps were killed, Google's walled garden got reinforced...
Scare prompt fatigue is real. If you're constantly blasting users with "XXX wants to do Y" which sounds scary, you're training them to just accept without thinking.
You fix an insecure implementation by replacing it with a secure implementation, not removing the feature completely.