Version 0.5.0 requires very broad permissions about arconnect

[martonlederer]

This isn't a new permission required by ArConnect, I suspect it's something by chrome. The only new permission required by the new update is "notifications". I'll look into this, but I'm afraid this is out of our control.

[martonlederer]

We have added more permissions in the past to ArConnect, but these were all "optional" permissions, while "notifications" is not an optional one.

Any time an extension adds new permissions that would result in additional permission warnings, it is disabled on the user's machine, and the user is asked to re-enable it with the new permissions.

Adding optional permissions will not disable the extension, since those are not automatically approve, rather the user has to grant them when they're being used.

[ppedziwiatr]

Hmm, I see, that is simply a screenshot from Chrome's extension's view - I've noticed that ArConnect stopped working few days ago in my browser, so I've checked the chrome://extensions/ - and that is what I saw.

I cannot enable ArConnect without granting this "Read and change all your data on all websites" permission - I believe it is not optional.

It also shows when I'm trying to install the ArConnect from scratch:

[ppedziwiatr]

But..maybe that is caused by some update in the Chromium itself and maybe all extensions right now require such permission (in order to work at all).

It would be probably good to test it with some older ArConnect version.

[martonlederer]

I'm pretty sure it's not gonna happen with older versions. I suspect Google has some kind of script that checks for "dangerous" permissions, and somehow it prompts this "Read and change all your data on all websites" with the "Display notifications" permission as well.

[ppedziwiatr]

Our q-rate (which is using some ooold ArConnect version underneath) also needs this permission now:

So I believe this a new Chrome "feature" - maybe to warn the users that using any kind of browser extensions might not be very safe.

This would probably require to track whether sth in https://chromium.googlesource.com/chromium/src/+/refs/heads/main/chrome/browser/extensions/permission_message_combinations_unittest.cc#1214 have changed recently

[martonlederer]

Hmm okay thanks for researching that, this explains a lot... This is quite annoying, but it seems like this is triggered by a permission, that was used previously, just the new chrome version flags it for "verification by the user".

As a sidenote, you can see the permissions we have added over ArConnect's development here (the latest only adds notifications, so the prompt is clearly misleading on chrome's end)

• 0.5.0: https://github.com/th8ta/ArConnect/pull/81/files#diff-639916bc14c3f311c31f629a2ec116292a4b2f64d06b3607b9ddd2e495703895R7-R15
• 0.4.4: https://github.com/th8ta/ArConnect/pull/79/files#diff-639916bc14c3f311c31f629a2ec116292a4b2f64d06b3607b9ddd2e495703895R6-R14
• Before that: https://github.com/th8ta/ArConnect/blame/d1aec80ac9e06a69ac7e4498583b6c30761b2585/public/manifest.json#L7

[ppedziwiatr]

Yup, it's the <all_urls> that seems to trigger this notification now.

Not sure if anything can be done here, from my perspective the case is closed :-)

[martonlederer]

Thanks for investigating, will keep this issue pinned and try to let people now this is the case