1305789 - Vimeo Player Blocked in FF 49.x iFrames if the TP strict list is used

Status: RESOLVED WONTFIX

(Firefox :: Protections UI, defect, P5)

Description

[sara]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36

Steps to reproduce:

Go to FF preferences, Privacy, and set "Use Tracking Protection in Private Windows".
Open up a tab (private window or regular window-- issue in both)
Go here: http://saravimeo.tumblr.com/post/146767161591/more-videos-outro-219-video-embedcinemawide
Notice that the player will not load.



Actual results:

Player doesn't load
Console shows that the player is blocked due to Tracking Protection, but vimeo respects tracking settings as they are set by the user. So this should not happen.
Also note that this happens in both a regular window, and a private window.


Expected results:

Player should have loaded/played back. Vimeo does not track users if their "do not track" setting is enabled.

Comment 1

[Anthony Jones (:ajones, :kentuckyfriedtakahe, :k17e)]

I can't reproduce the issue in Firefox 49 or nightly 52.

Comment 2

[Anthony Jones (:ajones, :kentuckyfriedtakahe, :k17e)]

Francois - can you shed any light on this?

Comment 3

[François Marier [:francois]]

(In reply to Anthony Jones (:kentuckyfriedtakahe, :k17e) from comment #1)
> I can't reproduce the issue in Firefox 49 or nightly 52.

vimeo.com is indeed on the Disconnect list:

https://github.com/mozilla-services/shavar-prod-lists/blob/12e0ffbfb3bb02a038002cf638a0f2a0f5de03d6/disconnect-blacklist.json#L8295-L8300

but in the "Content" category:

https://github.com/mozilla-services/shavar-prod-lists/blob/12e0ffbfb3bb02a038002cf638a0f2a0f5de03d6/disconnect-blacklist.json#L7234

which we only include if the user has selected the "Strict" list (Preferences | Privacy | Use Tracking Protection | Change Block list). In the default configuration, it's not blocked.

Comment 4

[François Marier [:francois]]

(In reply to sara from comment #0)
> Player should have loaded/played back. Vimeo does not track users if their
> "do not track" setting is enabled.

Marshall, what's the procedure for a site to be annotated with the correct DNT setting on the Disconnect list? Should they use the Disconnect feedback form at https://disconnect.me/trackerprotection or do we need to email Disconnect about it?

Comment 5

[Merwin]

Sara, can you send me a link to to Vimeo's Do Not Track Policy?

Regarding Francois question, we do not make changes to the list and instead ask people to use Disconnect's feedback form (https://disconnect.me/trackerprotection). However, if you point me towards your DNT policy, I can help identify whether it is in compliance with Disconnect's tracking list policy.

Comment 6

[Peter Dolanjski [:pdol]]

Given that a user needs to enable the strict list and there is a warning about breakage, we won't spend time trying to fix this issue.