Serious Discussion Have you altered the default site-permissions on your Chromium browser? When not take a look at what ChatGPT advices?

[LinuxFan58]

As the title says have you changed the default site permissions on your Chromium based browser? When why? When not, have a look at AI's advice.

In below table: the advice is when it mentions ASK or BLOCK is that you can set it to block, when the mentioned use cases don;t apply. I am using no web-apps therefore I block all app related "ask or block" (file access and apps on your devices), because my mail and browser run in sandboxes, I have set protocal handlers also to block.

 

[Bot]

As the title says have you changed the default site permissions on your Chromium based browser? When why? When not, have a look at AI's advice.

In below table: the advice is when it mentions ASK or BLOCK is that you can set it to block, when the mentioned use cases don;t apply. I am using no web-apps therefore I block all app related "ask or block" (file access and apps on your devices), because my mail and browser run in sandboxes, I have set protocal handlers also to block.


View attachment 298093

Changing Chromium “Site settings” defaults can meaningfully reduce passive data exposure and drive‑by annoyance (popups, prompts, tracking), but it can also break legitimate workflows. The safest approach is usually: keep a conservative baseline, then allow per-site only when you actually need something.

What I’d change on most setups (practical hardening)
These typically have more “security/privacy benefit” than “breakage risk”:

• Notifications: Set to Blocked (or at minimum disable “sites can ask”). This cuts a major source of spam/scam prompts.
• Pop-ups and redirects: Keep Blocked. Allow only on specific sites that genuinely require it.
• Automatic downloads: Set to Ask or Blocked unless you have a known workflow that needs multiple files.
• Background sync: If you don’t rely on web apps, setting to Blocked is reasonable.
• Third-party cookies: Consider blocking (or using “Block third‑party cookies in Incognito” if you want fewer site issues). This is one of the bigger privacy wins, but it can cause sign-in/session issues on some sites.
• Insecure content (mixed content): Keep Blocked.

Permissions that are reasonable to block if you don’t use web-app features
Your “no web-apps” stance is a solid reason to deny a lot of these by default:

• Bluetooth, USB, Serial ports, MIDI devices: Safe to Block for most people.
• File editing / File system access (where available): If you don’t use browser-based editors/IDEs, set to Block.
• Payment handlers: If you don’t use them, Block.
• Protocol handlers: Blocking reduces “open in app” hand-offs. Just note it may interfere with legitimate links (mailto:, zoommtg:, teams:, etc.).

Permissions where “Ask” is often the best default
Hard-blocking these can be fine, but it can also be annoying or break expected site behavior. “Ask” plus per-site allow is usually the sweet spot:

• Location: Keep Ask. Block globally only if you never use location-based services (maps, local weather, delivery, etc.).
• Camera / Microphone: Keep Ask. Global blocking is OK if you never use web meetings; otherwise allow only for trusted conferencing sites.
• Clipboard: Usually best on Ask. Some sites use it for copy/paste convenience.

A note about sandboxes (important nuance)
Running the browser/mail in a sandbox is a good layer, but it doesn’t automatically make permissions “safe.” Site permissions mainly control what the website is allowed to do inside the browser context (prompt you, access devices, read sensors, etc.). Sandboxing helps contain damage if something goes wrong, but it doesn’t prevent social engineering, unwanted prompts, or privacy leaks caused by granting permissions.

What to avoid (common “over-hardening” pitfalls)

• Blocking too broadly and then “temporarily allowing everything” when something breaks (that defeats the purpose). Prefer per-site exceptions for trusted domains.
• Relying on “Block all” as a malware defense. Permissions help, but they are not a replacement for patching, reputable security software, and cautious browsing.

Good operational pattern

• Set strict defaults for high-abuse features (Notifications, Pop-ups/redirects, device access categories).
• Leave core productivity permissions on Ask (Camera/Mic/Location) unless you truly never use them.
• Create per-site allow rules only for sites you trust and actively use.
• Periodically review “Allowed” permissions and remove ones you no longer need.

If you’re not using any web apps, your approach (blocking “app/device” related permissions and protocol handlers) is generally sensible; just be prepared for occasional usability trade-offs and handle them with per-site exceptions rather than loosening global defaults.

 

[LinuxFan58]

Chat & @Bot don't 100% agree on this topic, but I am inclined to support Bot's advice more than Chat's

 

[Parkinsond]

Why wasting time to change from default "ask" to custom "block"?
I will be asked and deny if not needed.
Only changing autoplay, picture-in-picture, and payment handlers as they lack the "ask" option.

 

[Sampei.Nihira]

I notice that, unlike in Chrome, there is no automatic verification to prove that you are not a BOT.

 

[LinuxFan58]

Why wasting time to change from default "ask" to custom "block"?
I will be asked and deny if not needed.
Only changing autoplay, picture-in-picture, and payment handlers as they lack the "ask" option.

Good question: I used to do it because of click jacking, defaults being changed and defaults being applicable to extensions

Risk of click jacking has minimized over time (thanks for asking the so what question , I thought click jacking was still a real risk)

Risk of the default being changed is probably also lowering now the sandbox security model is mature, I but I can find only a reference for the one you mentioned.

Site permissions are also applicable to extensions

 

[lokamoka820]

Off-topic:

As a user of dark mode, this is how I feel when I read your posts.

 

[Parkinsond]

Off-topic:

As a user of dark mode, this is how I feel when I read your posts.

View attachment 298104

The Dark Moders vs The Peaky Blinders

 

[TairikuOkami]

When why?

Why not, it is like blocking exploits by default and it only takes a bit of clicking, though most of those can be done via policies.

 

[oldschool]

I lock the browser down as much as possible. Simple as that.

 

[Sorrento]

I've always blocked things I don't need.

 

[Zero Knowledge]

Honestly why bother? I get people like control but it's a illusion. Your using a browser that has probably 6-8 patches a month for high severity security vulnerabilities.

It's like going down on the Titanic and saying keep in your cabin everything will be alright

For high needs security I just use Firefox/Mullvad browser with uMatrix and uBlock. I leave the rest to H-C and AppGuard. If I get owned I just format and install.
.

 

[LinuxFan58]

Honestly why bother? I get people like control but it's a illusion. Your using a browser that has probably 6-8 patches a month for high severity security vulnerabilities.

It's like going down on the Titanic and saying keep in your cabin everything will be alright

For high needs security I just use Firefox/Mullvad browser with uMatrix and uBlock. I leave the rest to H-C and AppGuard. If I get owned I just format and install.
.

Yes but Firefox based browsers only have a few site permissions, which have no security relevance. It is like saying why bother tuning the motor management system on my car when the engine is an old diesel with no fuel injection or turbo (cheek in tongue ), so I completely understand your poit of view.

 

[Sorrento]

Honestly why bother? I get people like control but it's a illusion. Your using a browser that has probably 6-8 patches a month for high severity security vulnerabilities.

It's like going down on the Titanic and saying keep in your cabin everything will be alright

For high needs security I just use Firefox/Mullvad browser with uMatrix and uBlock. I leave the rest to H-C and AppGuard. If I get owned I just format and install.
.

I agree, I use Wolf almost all of the time & its a rarity to need to use anything & it does seem that, the very fact Chrome browsers have so many options is indicative of the fact the last thing they actually want is your privacy as they live on your data, but go through the motions to give users some illusion of privacy so frankly I'm not sure why security minded people use anything but Mullvad/Wolf etc?? But we all have our own opinions & feelings

 

[Zero Knowledge]

It's like incognito mode in Chrome, it doesn't work and is just security theater. Kudos to Apple for Lockdown mode, why Android can't do this? Earn too much from tracking.

I'm not sure why security minded people use anything but Mullvad/Wolf etc??

Enterprise use I reckon. Also most people have been told Ad nauseam that chromium browsers are more secure. Truth is all browsers need constant patching. It's a furby.

Also Chromium plays nice with eCommerce/online shopping/banking. It's the most used so less captchas/cloudfare.

 

[lokamoka820]

Yes but Firefox based browsers only have a few site permissions, which have no security relevance. It is like saying why bother tuning the motor management system on my car when the engine is an old diesel with no fuel injection or turbo (cheek in tongue ), so I completely understand your poit of view.

While Firefox limits its main settings menu to prevent user error, advanced customization is available through about:config. For those who prefer a graphical interface, Firefox forks like Waterfox and Floorp include these advanced options natively, eliminating the need to tweak hidden preferences.

 

[TairikuOkami]

Honestly why bother? I get people like control but it's a illusion. Your using a browser that has probably 6-8 patches a month for high severity security vulnerabilities.

It is like disabling services, people say, why bother, if there is a vulnerability, it will get fixed! I never had a printer and never will, but Printer service is vulnerable every few years, regularly. MS fixes it eventually, but zero day exploits apply, disabling a service is actually MS's mitigation during the waiting period for the fix. Time matters.

Understanding and Mitigating CVE-2025-49722: Windows Print Spooler Denial-of-Service Vulnerability

Instead of waiting for the latest update, I will just disable everything, that I will never use and it will prevent most of the exploits automatically.
When I used Windows without updates for months, I was not worried, because I attended all vulnerabilities by using mitigations and it worked.

 

[LinuxFan58]

I agree, I use Wolf almost all of the time & its a rarity to need to use anything & it does seem that, the very fact Chrome browsers have so many options is indicative of the fact the last thing they actually want is your privacy as they live on your data, but go through the motions to give users some illusion of privacy so frankly I'm not sure why security minded people use anything but Mullvad/Wolf etc?? But we all have our own opinions & feelings

Yes we all have our own opinions (this is starting to become a browser discussion), but I like a browser with sandbox technology of today not 4-5 years behind
(according to ChatGPT, see quote below)

 

[lokamoka820]

I switched to using Vivaldi, by the way.