Source
r/privacy•
Subsumed

Security and privacy WebExtensions can silently debilitate each other without the user knowing under Firefox due to 2 year-old CSP header modification bug: raising awareness and pushing to fix

If you don't already know about this issue, here's a summary and tl;dr of it and the Mozillian response.

Mozilla is unkeen to fix this longstanding bug which can impair the security and privacy of Firefox users that rely on multiple WebExtensions to protect them or block content, probably because this bug is silent and unknowable to the masses, as when an extension fails to do its job due to it, no warning, notification or any special indication is given to the user. It seems that Mozilla therefore feels no conflict in completely ignoring this bug for months and years while going ahead with their proclamations of caring about users' privacy and security on the web, making their browser better, and more... actions aside from words. Perhaps Mozilla normally doesn't care very much for extensions and their users and developers, no matter what... there's no small amount of potential evidence that may point in that direction. However, leave that aside: either way, in contrast to this, remember that in the recent, unforgettable extension apocalypse and fiasco, because it was immediately noticeable by users worldwide and so rightfully created a huge backlash and public outcry, Mozilla scampered to do all that they could to fix the issue as fast as they could.

I believe that the only reason this current longstanding issue and the neglect of it is not already a public fiasco is because of a lack of awareness of it due to it being so unclear, silent and hidden, as mentioned. It is periodically brought up and then summarily buried again due to lack of new info or any updates. Even affected users don't know about its existence. Let's make people aware of this problem and spread knowledge of it around, as right now because of it, affected Firefox users are in the bad situation of being less secure in practice than they think they are. Share this in any relevant place you can. If you have friends that use Firefox or you are a part of a community or group that uses it, let them know. Friends don't let friends be unknowingly vulnerable! Unfortunately, the only thing you can do to protect yourself until this is fixed is to either switch from Firefox or to turn off as many CSP-using features as you can find in all of your extensions but one, which will be the one guaranteed to have its CSP features work. Most likely, on your FF setup, this will be either uBlock Origin (many CSP rules are included in filterlists) or NoScript (which currently includes a hack to make sure its features take precedence over all your other extensions; otherwise, which extension "wins" is completely unpredictable and virtually random). This bug doesn't exist in Chromium browsers, but please don't switch to Google Chrome because of this: Chrome is actually that awful.

And if you are a Firefox user that uses more than one extension for security/privacy/content blocking and you are opposed to leaving this problem unfixed for even longer, let Mozilla know! If you think, like me, that this continuing situation is ridiculous, unbecoming and even user-hostile, voice your opinion, don't shut up about it! There's a simple solution that has been offered to solve this bug, but somehow Mozilla seems to just not wish to do it - funny that they otherwise seem keen to follow after and imitate Google Chrome, but insist on staying behind it when it comes to this one, important issue. Vote on the Bugzilla bugs and make constructive comments, bring this up to Mozilla on their social media and IRC or wherever you can, and send Firefox feedback about this. They will only bother to fix this if we take action and show them that we are NOT unaware of this issue and consider fixing it necessary.

​

Links to further reading (on github.com, bugzilla.mozilla.org)

​

previously on Reddit:

r/privacytoolsIO: "Could we raise awareness of CSP issue in Firefox?"

r/uBlockOrigin: "Has there been a follow-up to the CSP issue in Firefox where extensions might interfere with each other?" (no)

r/firefox: "Firefox bug causes addons (uBlock Origin, HTTPS everywhere, Canvas Blocker, uMatrix) to override each other, causing critical features, such as JS blocking, to stop working with no notice or warning. This bug has been open for 1.5 years with no traction from Mozilla. This does not happen on Chrome."

r/firefox: Firefox CSP Issue may cause extension conflicts (link to https://www.ghacks.net/2019/05/23/firefox-csp-issue-may-cause-extension-conflicts/)

Posted Nov 29, 2019, 12:43 AM UTC

19057
Morcas•

Unfortunately, this has been a shit-show for a while. It's made worse by the fact that most users, using more than one addon that modifies CSP headers, will be completely unaware that anything is not working as it should be.

Best thread to read for a succinct status is Bug 1462989

40
SubsumedOP•

I know. It would've never gone this far otherwise. Share this, expose the issue, spread the word, and tell your friends or online friends. And anyone who doesn't like this should send feedback to Mozilla to let them know that this issue and not fixing it have impact and show them that it is most definitely NOT a dormant issue that nobody knows of or cares about.

10
bantheodor•

I can't wait to find out what excuses the Mozilla devs come up with in order to not fix this.

15
shklurch•

They don't need any excuses. What are you going to do, switch to Chrome Pale Moon?

11
bantheodor•

No I already switched to the Tor browser.

-3
JetAndreiva•

It has the same bugs, it's based on Firefox too

9
[deleted]•

[deleted]

3
MrWhitex75•

What I find sad is that if we dont have Mozilla who do we have? Considering most other browsers are based off Chromium.

12
shklurch•

You have Pale Moon, whose UI is like a sane desktop application, i.e. pre Australis, and which continues to support full customization, XUL/XPCOM extensions, full themes and does not violate your privacy with the excuse that you can always dig around in about:config to fix it.

It runs on a fork of Gecko called Goanna, and is the only browser on the market that isn't dependent on either Google or Mozilla, and is community supported rather than being run by a profit and marketshare obsessed megacorp like Mozilla.

So no telemetry, no tracking or analytics, no integrated 3rd party bloat, and it's continuously updated and patched, so ignore the idiots who try to dismiss it as a 'fork'.

11
Welteam•

Yeah you should definitely use a community developed, pretty much untested software for the most critical part of your computer. PaleMoon is good but it will never be safer than Firefox until enough competent people start to care about its safety.

5
shklurch•

PaleMoon is good but it will never be safer than Firefox

Newsflash, only one of these browsers has had a rash of malicious extensions, was vulnerable to Spectre and fubared its userbase by an idiotic expired certificate that does nothing to prevent malicious addons and it sure as hell isn't Pale Moon.

And it also isn't Pale Moon that's vulnerable to the bug described by OP either. Take a look at the release notes and you'll find stuff like this -

  • Sec bug fixes: CVE-2019-15903, CVE-2019-11757, CVE-2019-11763 and several potentially exploitable crashes and memory safety hazards that don't have a CVE number.
  • Unified XUL Platform Mozilla Security Patch Summary: 6 fixed, 6 DiD, 1 rejected, 24 not applicable.

The browser has cut down on unnecessary bloat and exploitable features like WebRTC so that lowers the attack surface, and entire classes of exploits simply don't apply because it hasn't jumped onto the multiprocess bandwagon that has made both Chrome and Firefox memory hogs.

6
Dogway•

Maybe that answers why it is so slow. There's more to it than only security and UI.

1
[deleted]•

[deleted]

4
shklurch•

Soon as in?

1
TopdeckIsSkill•

wow, this UI is so old. No thanks, I just stick with firefox.

2
vargasgetulio•

With Pale Moon, you have custom themes.

4
shklurch•

And those are complete themes, not simply changing the background of the toolbar, so it changes the button icons and application colors as well.

You can make your browser look like Netscape or Safari, or like the old Firefox if you want (among others).

7
shklurch•

Facepalm.

Suit yourself.

3†
TopdeckIsSkill•

It's nearly 2020. I get that ugly and old UI are nerdy and fancy, but can we start to deliver a decent UI? The tech expert usually doesn't care that much, but I have plenty of friends that don't want to use LO only because is so ugly and old compared to everything else (including onlyoffice that is open source).

5
[deleted]•

[deleted]

1
therealbravokilo•

If looks are all that matters to you, you have a lot more problems than you know about.

Appearance judgements are personal to you. Since the look of PM is your choice, you demonstrate that it doesn't matter to you, so why comment about it?

0
xoxidometry•

another for the con list of Firefox if it's not already there. it seems there's no perfect browser. maybe tor is the best candidate.

https://reddit.com/r/privacy/comments/axkhox/should_mozilla_software_still_be_recommended_for/ehui1oy?context=3

11
dakta•

ToR isn't a browser, unless you mean "ToR Browser" which is actually Firefox.

16
[deleted]•

It's Tor, not ToR.

6
xoxidometry•

what the hell do you think

-2
ubergeek77•

How can I check if functionality is being effectively canceled out? I'm using uBlock Origin, uMatrix, and NoScript, and I can't say I've run into a situation where one of those wasn't working properly.

11
[deleted]•

[removed]

13
Morcas•

You really don't need NoScript and uMatrix. Choose one.

How can I check if functionality...

Unfortunately, there are no simple and easy checks, it's really a matter of reading through the links the OP posted to see what's already known.

5
Ten7ei•

why don't ask developers of the security add-ons just add a prompt to the user if they detect that other add-ons are active.

or even better and easier. they just make a warning if you use them in Firefox to let the users know they aren't working properly and where they should complain to Firefox

7
shklurch•

Very happy to report that 'old and insecure' Pale Moon doesn't suffer from this bug, same as linked in OP.

Now go ahead and predictably downvote this while repeating the mantra that Web Extensions are far superior and secure compared to 'outdated' XUL/XPCOM.

4
BitchesLoveDownvote•

Web Extensions are far superior and secure compared to outdated XUL/XPCOM.

4
shklurch•

Oh yes, clearly both superior and secure.

I've used Firefox for over a decade, from the beginning when it was called Phoenix, until they started fucking with the UI in 2011, when I switched to Seamonkey and much later Pale Moon. If the first time you used Firefox was only after that, you have no idea what you're missing, and if not, you probably used the browser as it was without any extensions anyway.

Enjoy the Koolaid.

3
BitchesLoveDownvote•

I just gave you what you wanted.

I am aware that webextensions can do less, but bring security and stability to the platform. Your example of an extension doing tricksy things (is this no longer an issue? I know extensions are not allowed to interact with those page currently) does not prove it to be less secure than the far less limited addons. If you are arguing that people unjustifiably feel completely secure, when they’re only more secure, then sure. A relaxed user can be much more dangerous than a weary user when it comes to security.

Regardless of the current state of WebExtensions, it was a necessary step forward. You are free to enjoy a fork to maintain use of the addons you prefer.

Out of interest, which addons were left behind which you absolutely could not live without? Or features from extensions which did make the jump?

5
shklurch•

There's quite a few, you'll find them in my reply to this thread.

Other than addons, what I totally hated was the constant screwing around with user interface and gradually restricting what one could do with it. Getting rid of the status bar in favor of a popup when they made the switch to Australis was the last straw, and I started using Seamonkey (2011-12 or so) and finally ditched the codebase altogether for Pale Moon when they announced that XUL was being deprecated for good in 2015.

Web Extensions were supposed to make the browser more secure by limiting low level access killing Firefox's USP, what we have seen is the opposite with an increase in malicious extensions targeting both Chrome and Firefox (since now it's presumably easier to code for both).

Plenty of disgruntled former Firefox users who left it for Chrome, considering they'd rather use that than one trying its best to be a wannabe. At least Pale Moon offers an alternative, it is what Firefox used to be and could've been, but of course it keeps getting shat on with FUD spread by Mozilla shills.

The beauty of Pale Moon and pre Australis Firefox is choice. Even now, if you want to you can turn off UI elements in Pale Moon and make it look like Firefox thanks to full theme support. (Don't like RSS? Hide the RSS detection button from the addressbar. Don't want a statusbar? Hide it. Don't want traditional file,edit, view etc menus on top? Hide them and use a cascading menu like Firefox instead. Want to change the order of navigation buttons? Knock yourself out.)

It thus caters both to the casual and the power user, you only need to use whatever suits you. The new and dandy Firefox has none of that because they decided to cater only to the lowest common denominator of users, and what could be done by extensions earlier is also severely limited now.

3
FusionTorpedo•

Thanks for this. There's absolute zero evidence of FF being more secure than PM. It's all myth and legend.

1
Welteam•

I believe you. However I often have features blocked by uBlock and NoScript. If i don't allow the feature on both, they don't work. That's not what would happen if only one of them worked. I'm sure I'm not the only one in this situation. What is the explanation for that?

Edit: Nevermind, I read the ghacks link and I now understand that only some features use csp, features that I don't use.

4
1_p_freely•

There was once an incident where one Firefox add-on automatically and silently added it's update homepage to the exception list of the ad blocker. :)

This was, so that when an update was pushed out to that particular add-on by it's developer, the ads would load. Not cool. It's one of those things we just never forget. One program silently tampering with another on your computer is WAY uncool.

3
Jonis13•

Sad

2
FusionTorpedo•

Thanks for posting OP. However you seem to be under the wrong impression that Mozilla cares at all. They don't, and their "security" or "users first!" mantra is an illusion. They've even blocked comments on the bug for "advocacy" (https://bugzilla.mozilla.org/show_bug.cgi?id=1462989#c30). What a joke.

2
shklurch•

Get woke, go broke - as they and several other companies like P&G (of the infamous Gillette toxic masculinity ad) never seem to understand.

1
unrulyspeed•

Daily reminder that Firefox by default enables "Allow Firefox to install and run studies" without ever telling the user. Fuck you, Mozilla.

-1†
[deleted]•

[removed]

3†
unrulyspeed•

Those are not the same... ProtonMail cannot install and run studies in my browser. Not to mention ProtonMail collects very little browser metadata in the first place. Knowing what fonts I use vs. installing an extension in my browser without my consent is entirely different. Stop acting like defaults don't matter, they do. Why should the user be required to adjust every product they use so it doesn't violate their privacy? That's insane. There are plenty of products out there that, by default, do not collect any kind of metadata.

5
[deleted]•

[removed]

3†
RabidResponseTeam•

a setting enabled by default, which is a standard with most pieces of software

Installing studies by default is a standard with most pieces of software ? I do not believe this. But what I am sure of is that I will always consider this malicious behavior even in case it actually becomes standard practice in the future (in part thanks to the efforts of Mozilla to normalize it).

Firefox isn't a data-mining clusterfuck like Chrome, Mozilla genuinely cares about privacy and security. the data they use is not sold to advertizers nor is it used in a malicious fashion.

Yes, it is.

1
unrulyspeed•

"Why not just use Tor?" Who said I was using Firefox in the first place?

And what does the existence of an alternative have to do with my criticism? Am I somehow disallowed from criticizing an organization for privacy-invasive defaults because a better alternative exists?

To answer your side note: yes, they did that in 2017. That's what they mean by install and run studies.

0
MPeti1•

Honestly I've looked through ProtonMail settings multiple times and I don't remember ever finding something that. Where is this setting? Maybe I just forgot it

3
en_vil•

Can Protonmail add a study which enables disk cache, which the user had previously purposefully disabled? Because these are the kinds of studies Mozilla runs on unsuspecting users.

2