[tor-bugs] #24072 [Applications/Tor Browser]: Block Web Extensions from controlling crucial privacy preferences

Mon Feb 12 05:12:28 UTC 2018

#24072: Block Web Extensions from controlling crucial privacy preferences
--------------------------------------+--------------------------
 Reporter:  cypherpunks               |          Owner:  tbb-team
     Type:  defect                    |         Status:  closed
 Priority:  Medium                    |      Milestone:
Component:  Applications/Tor Browser  |        Version:
 Severity:  Major                     |     Resolution:  wontfix
 Keywords:                            |  Actual Points:
Parent ID:                            |         Points:
 Reviewer:                            |        Sponsor:
--------------------------------------+--------------------------

Comment (by tom):

 Well, there is https://bugzilla.mozilla.org/show_bug.cgi?id=440908 which
 might land in 60 or shortly thereafter.

 When that lands, I would actually suggest that TB consider locking certain
 high value prefs (FPI, RFP, and the proxy ones.) That would help protect
 users from WebExtensions _and_ it ____might____ provide some layer of
 defense in depth from exploits (imagine a vulnerability that allowed an
 attacker to set arbitrary prefs.)

 I'm not arguing that it would be a strong security barrier. I am
 suggesting it could be a low-risk, low-effort mechanism to add some
 protection.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/24072#comment:3>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online