“Too many” permissions required

[klmr]

The new version of Vimium (1.28) was automatically disabled by Chrome because it required additional permissions.

It would be nice if it included a short notice on why these permissions are in fact required.

• My data on all websites
• My bookmarks
• My tabs and browsing activity

This may simply be Chrome’s formulation but this sounds like an awful lot of trust I’m placing in a plugin that should “merely” hook to certain keystrokes.

Note: I’m not objecting to the fact that Vimium requires these permissions. I’m merely pointing out that it sounds scary, and should be properly explained to the user, lest it creates a culture of always clicking “OK”, no matter what data a plugin wants to access (which is precisely what Chrome wants to prevent, for good reasons).

[jonathanjouty]

Agreed, nowhere on the webstore page does it mention why these permissions are needed. Stumbled upon this as I'm trying to figure out why they are needed.

[mraaroncruz]

I am actually freaked out enough by these that I have chosen not to update until I see some kind of explanation. I bet I'm not the only one.

[bheckel]

I freaked out and disabled it too. On the Chrome webstore Ilya replied to my request for info saying that the new bookmarks (b and B) are the reason. I trusted him enough to re-enable it. The new bookmarks are cool. Still wish Chrome extension permissions weren't so wide open. And wish the explanation preceded the question.

[mraaroncruz]

Thanks bheckel. I'll trust him too!

[ghost]

Vimium needs to access "Your data on all websites" and "Your browsing history" for the b and B keys to work on your bookmarks?

I don't think it's ok that a new software update suddenly requires access to
Your data on all websites
Your bookmarks
Your browsing history

with no explanation offered. And that the only explanation offered (upon request) is that it's to access bookmarks? I don't find that a satisfactory explanation.

[ilya]

Yes it's unfortunate that Chrome has sort of alarmist messaging around these permissions. I'll add a notice at the top of the Chrome web store page.

"Your data on all websites" is really just Vimium asking for its javascript to run on every page you load. Theoretically we could steal everything on the page by doing so but we don't and never will.

"Your bookmarks" is obviously necessary for us to offer the bookmark feature.

The code is open source. Read it if you're paranoid. We don't communicate with any servers. Do you really think I wrote this Vim browser extension for nefarious purposes?

[mraaroncruz]

Do you really think I wrote this Vim browser extension for nefarious purposes?
Of course not, but put yourself in our shoes. I'm sure I install a bunch of crap all the time that is way more potentially dangerous than Vimium, but the warnings are new and the warnings are dramatic.

[john-kurkowski]

Just encountered the ask for new permissions again, which made me think twice.

In the app store, where you say Google is being alarmist, could you explain each permission it's asking for? Understood if you think it's benign. But as a user, understanding each, briefly, would help.

[innaterebel]

Up to this point they are pretty obvious though assuming you utilize a wide array of commands of Vimium.

• All your data on the websites: The scariest-sounding one, already explained by the closing comment above, is basically how Vimium and most Extensions that interact with web pages can work.
• Your browsing history: So Vimium can offer the history functions.
• Your bookmarks: So Vimium can offer the bookmark functions.
• Your copy and paste: So commands like yf, p, and visual mode can work.
• Display notifications: The update notification when Vimium is updated.

I am just an average user and know nothing about coding, but as I see and use it, apparently they are most what Vimium is expected being able to do so it naturally needs those permissions.