I’m the developer or SponsorBlock, an add-on for skipping integrated sponsorships, intros, outros and other unwanted sections of YouTube videos. It is a crowdsourced add-on, and relies on submissions on each individual YouTube video. Because of this, it fetches data from the server asking what submissions exist for a video, and uses that to skip parts of it.
But privacy is integral, and we take many steps to make that the case. The add-on does not send what video you are watching to the server, instead it uses a K-Anonymity system (you can learn more about that here) that makes it so the server doesn’t know what you are fetching, but not every video’s data has to be stored on the client. The add-on uses randomly generated local users for submissions instead of a social media login, or email to ensure we have no personal data we could collect, because we don’t want that.
But these new data transmission permissions seem to require us to declare many things anyway which are going to make users very confused. Even though the video you watch isn’t transmitted, it does imply you are on the youtube.com domain, which means the browsingActivity transmission type is probably required. It may even require the websiteContent because of the fact that it also sends some requests for the related videos that appear on the page, even though these are again using a k-anonymity system. Maybe that’s not needed since the domain sent isn’t really extra information, I’m not sure.
If SponsorBlock is required to add websiteContent to the declaration, it is now placed in the same category as cookie stealers, scam extensions like Honey and others. Even though it transmits nothing close to that, and for sure stores absolutely none of it.
Right now I see several big issues for implementing the data transmission declaration in the SponsorBlock extension:
- The upgrade flow for existing extensions is scary: If an existing extension adds a mandatory transmission type, it appears as “New required data collection”. Extension users are rightfully accustomed to new permissions meaning that an extension was acquired or hacked and are rightfully skeptical when they see this notice, and will treat anything written there with the most nefarious interpretation as possible. This isn’t a theoretical problem, we’ve already seen hate mobs and conspiracies created all over social media due to an existing extension who have added declarations in an update. There is no way to provide any explanation to the user.
- No distinction between transmission and collection: The UI shows “data collection” when the declaration is not about that. The declaration is not about storing data, only about transmitting it. An extension which uploads all your personal information and stores it for eternity looks exactly the same as an extension who does unlogged requests which partially reveals a website you visited.
- Not clear that data collection is only happening on domains the extension has permission for: The current collection prompt implies that the extension is collecting all of your browsing activity when it doesn’t even have access to that
- No distinction between hidden elements (cookies, request headers) and user visible elements: There is a big difference between transmitting data that reveals visible page contents, and secretly sending your cookies to a server. The current model does not differentiate
My recommendations:
- Better upgrade flow for existing extensions: Provide a way for extensions to explain to users what is happening. Ideally, Firefox should say that this is a new requirement being introduced, and not a change in permission. A customizable “Learn more” button would help here
- Splitting off collection and transmission: There is a big difference between the following phrases: “The developer says the extension will collect browsing activity”, “The developer says the extension will transmit browsing activity”, “The developer says the extension may transmit browsing activity”
- Allow an explanation to be included with mandatory permissions so that extensions with privacy preserving features can inform installers how they are safe
- Include the domains the extension has permission for somewhere in the prompt to inform the user that collection and transmission will only happen on those sites
