1058007 - There should be a way to turn Prefer:Safe off

Status: RESOLVED WONTFIX

(Core :: Networking: HTTP, defect)

Description

[Manish Goregaokar [:manishearth]]

I think that when an administrator sets up Parental Control for an account, there should be a way for them to disable Prefer:Safe on the Firefox profile connected to that account.

The rest of this post might sound a bit paranoid -- I'm trying to gauge the worst case scenario here. I see how this feature is useful and improves safety — but I find that it can be misused too.

Basically, Prefer:Safe broadcasts to everyone that a child is using the computer (or a child uses that computer often). This is valuable information to scammers — knowing your demographic can help you customize the scam. Children are already prone to Internet scams, but many of them are not noticed by the child. Bait-and-switch scams now can improve their bait and make it more enticing to the audience ("Win a ticket to Disney Land" vs "here's something to help you lose a pound a day"). Similarly phishing sites can be modified to focus on children (perhaps asking them to install an addon or run some software). A demographic that usually misses all scams since they aren't enticed by it now can be specifically targeted.

Again, this is a great feature and I love that Mozilla has come up with this. I just think that there should be a way to opt out of it — a way for the admin to say "I want to enable Parental Controls for this account, but I don't want it to percolate to Firefox"

Comment 1

[Manish Goregaokar [:manishearth]]

Not sure about the bug categorization, a quick search didn't turn up any bugs related to Prefer:Safe.

Comment 2

[Joe D]

I'm having this issue, too.  My kids started to not be able to see some Youtube videos.

The only reason we have parental controls enabled is to put time restrictions on the computer use.  There are no content filters enabled.  You should not assume that just because parental controls are enabled that I want to filter web content.  That is not necessarily the case.

There really needs to be a way to turn it off, if for no other reason than to allow me to make the decisions on how to parent my children, not you, and not some website.

Comment 3

[Gervase Markham [:gerv]]

Joe D: your issue is not the same. I think what you are seeing is a valid bug - Prefer:Safe should only be sent when there are actual content restrictions set in the Windows parental controls. That's very different to saying "there needs to be a way of turning it off"; that latter request may get WONTFIXed because the entire point is that it's hard to turn off. But you don't need that, you just need your bug fixing.

So I suggest you file a new bug.

Gerv

Comment 4

[Joe D]

I disagree.  There should be a way to turn this behavior OFF.

Firefox should allow any content restrictions to be made by the parent, and not assume that the user wants to filter EVERYTHING.

Ideally, it would be a three-state about:config setting: 
auto - send prefer:safe if parental controls are enabled
always - always send prefer:safe 
never - never send prefer:safe

Comment 5

[Jason Duell]

I've opened bug 1087182 for turning off sending Prefer:Safe unless Web Filtering specifically is turned on (vs Parental Controls in general).  Alas, it looks like it will only really work on Windows >= 8.

Comment 6

[Jason Duell]

Given that Windows is borken about letting us know that web filtering is on or not in windows 7 and earlier, I suppose that might be construed as a vote for implementing this bug (esp if we, as planned, interpret "Parental Controls on" == "filtering on" when we're on Windows 7).  OTOH it would provide a way for anyone capable of using google to find out how to circumvent Web Filtering by changing an about:config pref.  I can imagine it would still be useful for children under a certain age.  Not my call to make...

Comment 7

[Patrick McManus [:mcmanus]]

rely on bug 1087182 (and its limitations)