Almost exactly a year ago I wrote a blog post explaining how permission prompts are a particularly problematic area for a functioning extension ecosystem. While at this point it was already clear that Firefox would show some kind of permission prompt, I hoped that Mozilla would put more thought into it than Chrome did. Unfortunately, this didn’t quite happen. In fact, as I now experienced, the permission prompt in Firefox turned out significantly worse than the one in Chrome.

Two days ago I released a new version of my Google search link fix extension. I finally got to turning that “run on all websites” permission into a list of specific domains, with all of 193 Google domains. And the backlash came immediately, in form of this review (translated from Russian):

“Google search link fix has been updated. You must approve new permissions before the updated version will install. Choosing “Cancel” you will maintain your current add-on version. It requires your permission to: Access your data for sites in the yandex.com domain

• Access your data for sites in the yandex.com.tr domain

• Access your data for sites in the yandex.by domain

• Access your data in 197 other domains” Developers, re-read the name of your extension.

This prompt doesn’t show up on the stable Firefox release yet, but Firefox Nightly indeed shows it:

I guess that I must consider myself lucky for having implemented this change so early. A few months later I would have received lots of comments like that, as all users would have seen this prompt. As I explained in my previous blog post, permission prompts on update are particularly disruptive and should be avoided if somehow possible. However, Firefox is currently displaying them even if the extension’s permissions got reduced like in this case.

The other issue is the way the information is presented. I didn’t expect the order to matter so I put Google domains last. But that’s confusing to users if only three domains are being displayed, with Google Search being the primary target for this extension. Worse yet, with no way of listing the remaining domains users suspect that something malicious is going on.

It seems that the use case “run on various search pages” is common enough that Chrome developers chose to special-case it. The permission prompt displayed by Chrome is way more straightforward:

This also leaves me hoping that Chrome won’t display a permission prompt just because a future update added a new Google domain. Still questionable whether I want to add support for more search engines in future, but it probably won’t confuse users all too much.