Firefox's new WebExtensions permission system
Mozilla plans to turn on a permissions system for the installation of WebExtensions in the Firefox web browser that is similar to that of Google Chrome.
Whenever you install an extension in Google Chrome, all of the extra permissions that the extension requests are listed in the installation prompt.
The idea is to provide users with information on these extra permissions, so that abusive extensions can be avoided.
The main issue with the permissions system is that most users are probably ignoring the permissions prompt. One reason for that is that it is often difficult to find out whether a permission is really needed for functionality, or if it is simply there for marketing or outright malicious purposes.
Firefox's new WebExtensions permission system
Mozilla plans to launch similar installation permissions in Firefox 54 at the earliest, but most likely in Firefox 55.
Firefox will display the extra permissions an extension requires during installation. The current iteration lists all permissions, but no additional information about them in the interface.
The permissions come from the manifest.json file of the extension. If you open it in a plain text editor, or a special json viewer (for instance the json viewer of Firefox), you find them listed under the permissions section. This is true for Chrome and Firefox WebExtensions. Please note that you need to extract the extensions file first to get a listing of files included.
Google published a page that lists all optional Chrome permissions that extensions may declare, and Mozilla published one as well. The permissions are not identical at this point in time, and it seems unlikely that they will ever be identical. Mozilla plans to support more APIs, and with that may come extra permissions that only Firefox supports.
The installation prompt listing the permissions the extension requires is triggered whenever a WebExtension is installed in Firefox. This includes installations from Mozilla AMO and third-party websites, extensions that get side-loaded, and during upgrades.
Firefox users who are interested in the feature can enable it right now. Please note that this landed in Firefox 53 Nightly, and that the permission does not exist by default (yet).
If you run at least Firefox 53, you may do the following to enable the permission prompts when installing WebExtensions in the Firefox web browser:
- Load about:config in the Firefox address bar and hit the Enter-key.
- Confirm that you will be careful if the warning page opens.
- Right-click in the main area on about:config, and select New > Boolean.
- Name that Boolean extensions.webextPermissionPrompts.
- Set it to true.
Any WebExtension installation afterwards triggers the installation prompt that highlights the requested permissions.
The main tracking bug for the feature is 1308292. Additional information is provided on Mozilla's Wiki website.
While we are at it: check out Firefox's permissions manager, and the new permissions system that Mozilla plans to launch.
Now You: Do you find the installation prompts useful?
These prompts are useless since they provide no information what those permissions actually do.
What does “access” mean?
Read access?
Write access?
Can that extension read my bank details when I do online banking?
Can that extension tamper with the data I exchange with websites?
Does that extension compromise my privacy?
Right now, those prompts are nothing but confusing and I won’t install any of the extensions which require “extra permissions” since Mozilla failed to provide ANY information what those permissions actually mean, neither in Firefox itself nor anywhere on the web where end users can easily find it.
From a usability point of view, the web extensions system is a big step backwards.
“The main issue with the permissions system is that most users are probably ignoring the permissions prompt. One reason for that is that it is often difficult to find out whether a permission is really needed for functionality, or if it is simply there for marketing or outright malicious purposes.”
This is also true for Android Apps. It would good if a way to to determine if an app or extension truly requires a permission for its core functionality can be determined without having to manually test and check the different permissions combinations. This would probably make a good article.
Can I actually add extension and following the example shown here, deny it accessing tabs? Or this works in fashion “agree or you won’t use it”?
If webextensions permissions works the other way, would be it possible then to create an extension that would take in charge permissions for other extensions?
It’s all or nothing at the moment. Optional permissions are another feature coming to Firefox. But if the developer of the add-on declares all permissions as mandatory, then all permission are mandatory and you have to allow all to use the extensions.
It is allow permissions and use, or disallow any permission as you can’t install it then. You could in theory try and edit the extension, and remove permissions.
I have __lots__ of useful FF addons
working great
in FF (and in Pale Moon!).
Will my current FF addons
still work
in the new FF 54?.
Will there be FF “WebExtensions”
equivalent in functionality to my addons?.
Will the conversion from current addons
be “automatic” or “manual” (one by one)?
Not being able to use
my current FF addons anymore,
would mean my dropping FF forever,
and migrating 100% to Pale Moon or Chrome or Vivaldi.
using:
– Ubuntu Linux 12.04, 32-bit
– FF and Pale Moon browsers.
Thanks Martin for the tip.
And Firefox devs are trying to copy chome still (instead of adding apis to webext to bring functionality parity)
But they choose to ignore major problems like these
https://bugzilla.mozilla.org/show_bug.cgi?id=610357
> instead of adding apis to webext to bring functionality parity
Just going to claim that without researching it, eh? Well, this is the internet I guess.
And no, that’s not at all true.
So it’s actually a bug? I thought it’s the way firefox works. It’s quite annoying to lost the url if the page fail to load
you’re stuck to firefox
Yes, Martin is the only prominent blogger still blogging about Firefox :p
@Andy: Of Course! In fact, I’ve subscribed to Firefox Category RSS Feeds* of Ghacks. My only source of what’s up with the Mozilla and its browser. ðŸ‘
(*Link: https://www.ghacks.net/category/firefox/feed/)
…and some of us appreciate it!
Probably because I’m the only one still using Firefox ;)