"New Permission" popup, but no permissions are listed

[aaronbauman]

Describe the bug: After restarting Chrome, 67.0.3396.99, Authenticator (v 5.1.1) is disabled until i accept new permissions. (Sorry, I don't know what version was installed previously.)
However, the permissions dialog doesn't list any new permissions.
The extensions page says Authenticator doesn't require any special permissions.

Unclear whether this is an Authenticator issue or Chrome issue.

• Platform: OSX
• Browser: Chrome
• Browser Version: 67.0.3396.99

[mymindstorm]

It's probably the file://*/* permission that was added in 5.1.1. It adds this switch (off by default) in extension settings:

It lets Authenticator access local image files opened in Chrome if you turn it on.

[Sneezry]

@aaronbauman Thanks for your feedback. We handle Authenticator permissions very carefully, and set a very strict content security policy to protect user data.

We keep trying to reduce the extension permission scope to avoid permission abuse.

In previous version (5.0.2 and before), we request to inject a script to all urls for scanning QR codes to add accounts, which results in the extension has permission to read all data user visit on the web. In 5.0.3 we changed the way to inject the script, and release the incorrect permission. However, the extension cannot scan QR code from local image file simultaneously.

Days ago we received a report (in Chinese) about scanning local image issue, and we recognized that the extension's permission is limited too much.

In 5.1.1 we added a new permission to access local files for scanning local image file. However, as @mymindstorm said, it is disabled by default, even if you have accepted the new permission. When we add the new permission, we have a very careful consideration on the permission scope.

[aaronbauman]

Thank you both for the detailed responses.