The limitations are not entirely without reason, from my point of view. With app installation, there’s explicit consent involved — apps can never run unless I have requested such. On the web, all it takes is a redirect in an unexpected place to open an “app” that I want absolutely nothing to do with, at which point it’s free to slurp up all the unpermissioned data it wants.
That’s not to say that browser vendors have a bad track record when it comes to permission dialogs, but there’s still a ridiculous amount that they just hand over to sites without any prompt whatsoever.
This is easily fixable, however: just restrict the greater bulk of API access to “installed” PWAs, where the app runs in its own little easily manageable container with zero access to my main browser and specialized permissions UI.
That’s not to say that browser vendors have a bad track record when it comes to permission dialogs, but there’s still a ridiculous amount that they just hand over to sites without any prompt whatsoever.
This is easily fixable, however: just restrict the greater bulk of API access to “installed” PWAs, where the app runs in its own little easily manageable container with zero access to my main browser and specialized permissions UI.