All websites regularly loose permissions

[ss9227]

ss9227 last edited by

Workaround that works for me so far: always start Opera with the command-line flag --disable-features=DIPS.

Since I did that, my site permissions (notifications etc.) have stopped disappearing.

On Windows just add it in shortcut properties e.g.
"C:\Program Files\Opera\opera.exe" --disable-features=DIPS
If Opera gets started some other way (by clicking a link in another app etc), it runs without the flag.

[MichaIng]

MichaIng @ss9227 last edited by

@ss9227
I'll try it out.

But for everyone else: DIPS, renamed to BTM in the meantime, is a privacy feature of Chromium, which mitigates bounce tracking, i.e. if links do not point to the actual target website, but an intermediate website, which only sets a tracking cookie, and redirects you further to the actual target website, that way bypassing 3rd party cookie blocks. Chromium e.g. prevents this tracking cookie to be set, and it might also reset permissions for websites detected for bounce tracking. More details: https://github.com/chromium/chromium/blob/main/content/browser/btm/README.md

It is possible that Opera breaks this feature with downstream patches, so that it detects regular websites as bounce tracker ones, and then resets their permissions.

But I would not recommend to disable this feature for production, as it makes you vulnerable for being tracked across websites.

[ss9227]

ss9227 last edited by

Update: in my case there is a "second" way to stop the permissions from disappearing. Instead of using --disable-features=DIPS, I switched Settings > Privacy & security > Third-party cookies to "Allow third-party cookies". I ran Opera like that for a week and no permissions were lost.

When I switched back to "Block third-party cookies", they were wiped again within about two hours.

So the DIPS / Bounce Tracking Mitigations cleanup is tied to blocking third-party cookies: it only runs when they are blocked. With third-party cookies allowed it does nothing and permissions are not deleted. Keep in mind that allowing third-party cookies makes cross-site tracking easier, so the flag is the more privacy-friendly workaround.

This looks like a wired bug in Opera: the cleanup should only clear data of the tracking sites it flags, but it removes notification, location, camera and microphone permissions for all sites. I have just reported it to Opera with the details.

What puzzles me is how few users report this. Do people simply not notice, or are there other, rarer conditions involved that I'm not aware of?

[MichaIng]

MichaIng @ss9227 last edited by

@ss9227 I tested --disable-features=DIPS, and it increases the time until permissions are lost, or adds some one-time longer delay, until permissions are lost again, but it does not "solve" the issue. When I added this to my Opera startup link, permissions remained stable for maybe a week, before the issue reappeared. Afterwards, it happened again much sooner, though I did not test yet whether every 1-2 hour like before.

Allowing 3rd party cookies is even worse than disabling DIPS, as the latter is meant to make disabling 3rd party cookies more reliable. I won't test this, as I do not want to make it too easy for advertisement networks to track me across websites.

But that this has an effect as well for you, shows that the bug is somehow tied into the 3rd party cookie/privacy protection stuff. But while it has an effect, it does not seem to be the exact trigger for the lost permissions.

[ss9227]

ss9227 @MichaIng last edited by

It is very strange that this problem keeps coming back, just when things seem to be going well.

@MichaIng You said that

I installed Opera stable completely freshly, did not migrate my profile, setting or any such, and after some days/weeks of usage, the issue reappeared.

that's why I don't even feel like trying to set up a new profile

When I added this to my Opera startup link, permissions remained stable for maybe a week, before the issue reappeared.

I can check that, I'll try running the browser that way for as long as possible. It might not work, however, because the browser can be launched via other triggers without the -disable-features=DIPS flag.