Feature request: disable unused permissions

[ZeroUnderscoreOu]

I think it's no news to anyone that websites sometimes go down and domains may change ownership over time. A website I used to visit 5 years ago may not be the same website today, and I wouldn't necessary trust it the same way that I used to.

It would be nice to be able to see when was the last time given permission was used, to get an idea whether I still need such permission or not. It would also be nice to automatically disable (or mark somehow) permissions that were not used for a certain period of time.

As much as I dislike Google, what I want can be compared to what happens on Android - permissions get revoked if an app wasn't used for 3 months.

[barbaz]

It would also be nice to automatically disable (or mark somehow) permissions that were not used for a certain period of time.

nope.

For people who always run browser in a disposable sandbox, the permissions only get used in a disposable environment, so their use never gets recorded. So the feature would, at some point, automatically wipe out the entire permissions list.

Also, you would be more vulnerable to allowing Unicode look-alike domains, incorrectly thinking your old expired permissions are needed again

(Just to be clear, none of this is about having an opt-in "last used" column in the Per-site Permissions list that you could sort by: I can see how such column could be helpful, and it wouldn't be a security issue. Though it would need to be opt-in due to the level of privacy Tor Browser users can require.)

[ZeroUnderscoreOu]

I'm not saying this feature should be enabled by default and/or the only mode of operation.

As for expired permissions, they should be inactive and marked as expired, but not completely deleted.