> In Manifest V3, we want activeTab-style host permissions to be the default, with a number of extra options. Instead of being granted access to all URLs on installation, extensions will be unable to request <all_urls>, and instead the user can choose to invoke the extension on certain websites, like they would with activeTab. Additional settings will be available to the user post-installation, to allow them to tweak behavior if they so desire.
To me that reads that extensions won't be allowed to request <all_urls> anymore which would definitely increase privacy since they won't be able to get script access on every website. Some observational capabilities will still be available but from what I'm reading not as many. I would've liked the web request API to be deprecated and discouraged or under heavy scrutiny, if used but there was too much push back.
[1] https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3Nzz...
There are no permission changes that I know of that are being applied to the observational API that couldn't be applied to the blocking API.
There are changes in V3 that are good for privacy -- but the removal of the blocking API will not increase your privacy.
If so, then I totally agree: this change does absolutely nothing! But as expected from Google: this sort of thing has been going on for 5-10 years, and nothing has been done. They got my hopes up yet again.
> In Manifest V3, this API will be discouraged (and likely limited) in its blocking form. The non-blocking implementation of the webRequest API, which allows extensions to observe network requests, but not modify, redirect, or block them (and thus doesn't prevent Chrome from continuing to process the request) will not be discouraged.
Longer answer, there are multiple good changes coming in V3 (in particular, the introduction of active-tab permissions, which would let you have an extension that can only run code when you explicitly click on it), but those changes aren't really part of the blocking/observation argument that's been happening.
I thought about doing a blog post going into more detail about this at one point, but I figured it was unlikely to make anything change, and that the controversy was old enough that anyone who wasn't already informed wouldn't care any more.
If I'm wrong, maybe I should take a week and write something more detailed.
[0]: https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3Nzz...
They're not going to improve your privacy and they're not going to improve your security, because the observational capabilities are still going to be available.
And if the new active-tab permissions wouldn't be enough to protect users from the blocking capabilities of the web request API, they're not going to be enough to protect users from the observational capabilities either. Removing blocking abilities isn't really going to slow malicious extensions down.
As a quick side note, this is how roughly 80% of the big public conflicts with the Chrome/web branch of Google go nowadays.
- Google proposes a change that they claim will improve security or privacy.
- People point out that the change doesn't actually improve security or privacy.
- Google wonders out loud why people don't care about security and privacy.
In regards to the web request API, so many developers have explained the problems so many times, that a less charitable me could plausibly claim that the continued implication that extension developers just don't understand security is borderline misinformation.