Permission: Read your browsing history

[kuchta]

Hi there 👏🏻

First I would like to thank you for you good work. Very useful extension 👏🏻👍🏻

One thing that makes me a little bit nervous though, is the "Read your browsing history" permission. Why is that needed? Other similar extensions like "Custom CSS by Denis" etc. don't require it for comparable functionality...

Thank you...

[webextensions]

@kuchta

Hello! 👋

Thanks for your kind words about the extension!

The "Read your browsing history" permission is triggered by the webNavigation permission, which is needed only for the "Apply styles automatically" feature. This allows the extension to detect page navigations and automatically reapply your saved CSS styles without manual intervention.

The warning sounds broader than it actually is in our case. The extension only uses this permission to monitor when pages load/navigate to maintain your custom styles. Seemingly other CSS extensions (which don't request for these permissions) either don't have this auto-reapply feature or require manual reactivation after each page change. If that is not the case, please provide us more details and we will investigate it further.

The extension follows different permission strategies across browsers - Chrome/Edge request this permission only when needed, while Firefox includes it by default due to browser limitations. We have not pushed updates to Firefox extension since quite some time and it is possible that the permissions model for the Firefox might have improved since our last update. If so, we may update our implementation in near future to mitigate this factor.

Marking this discussion as closed under the hope that this explanation attends to the core part of the concern you have raised.

Thank you again 😄

[kuchta]

Thank you for you answer and the broader context. Didn't know about those differences across browsers. I don't know much about WebExtensions, but I still think your claim that webNavigation permission is needed for "Apply styles automatically" is not valid, at least in the last Chrome (or derivatives like Brave which I'm currently using) versions. This very simple chrome-only WebExtension is a good example that it's not needed. It automatically re-applies styles and doesn't need any permissions apart from [ "activeTab", "scripting", "storage" ]. It's a very simple extension, but if one doesn't need much, like full-featured editor, than it does the job very well. Take a look at it and let me know. Looking forward 👋🏻

[webextensions]

@kuchta

The UI of the extension at https://github.com/denis-sokolov/chrome-custom-css works inside a dialog attached to the icon, while the Magic CSS extension works by embedding the editor inside the webpage itself. IIRC, in the past, the way this extension was getting launched, it needed the webNavigation permission. Then a while back, the extension was migrated to "manifest_version": 3. Probably now with that, there might be a solution to achieve the feature (of reapplying styles) without requesting the webNavigation permission.

We will look into it further to gain even further confidence of the users w.r.t. the security, but it might not be the among the top priority for a while since there are some other pending improvements/changes which need more focus (eg: Before that, we may rather provide a UI based option for the user to review and revoke the permissions that the user has granted to this extension for various domains).

Also, in case you would like to review the code regarding usage of the webNavigation permission, you may review it at

live-css-editor/extension/scripts/background-magicss-include.js

Line 1194 in 85ce9b5

chrome.webNavigation.onCommitted.addListener(function(details) {

We are doing "Unmark as answer" for our previous message since we would now need to do a proof-of-concept / change regarding the concern you have raised.

Thank you again for all the details and references you have provided :-)

[kuchta]

Thank you very much for the explanation. Makes sense. Looking forward and thanks again for the great extension. 👏🏻👍🏻