Closed Bug 1474199 Opened 8 years ago Closed 6 years ago

Default-enabled OpenVR results in intrusive behavior with no per-site control

Categories

(Core :: WebVR, defect, P2)

Product:
Core
Component:
WebVR
Version:
61 Branch
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
firefox63 --- affected
firefox64 --- affected
firefox65 --- affected

People

(Reporter: boppreh, Assigned: kip)

References

Details

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0 Build ID: 20180704003137 Steps to reproduce: 1) Have a VR system installed (SteamVR + HTC Vive in my case). 2) Have the VR system closed, and peripherals powered down. 3) Visit a website that uses OpenVR, such as https://edition.cnn.com/asia/live-news/thai-cave-rescue-live-intl/index.html . Related: about:config flag "dom.vr.openvr.enabled", and bug https://bugzilla.mozilla.org/show_bug.cgi?id=1343374 , where the flag was set to True by default. Actual results: Firefox will attempt to start the VR system. In my case this means: - Powering up peripherals. - Starting the screen compositor, resulting in screen flashes. - Displaying the SteamVR always-on-top window. - Registering firefox.exe as the application using VR, such that if SteamVR is closed, Firefox will also be closed, albeit after a confirmation prompt. This is helpful when clicking on Sketchfab's "experience this in VR" button, but entirely unexpected and extremely invasive in the CNN case. Having Firefox close when you try to stop this process is also frustrating, and has already led to data loss for me when I had unsaved changes in open tabs. Disabling the flag kills this function for all websites, which is undesired. I'm also concerned about the security perspective, because such integration represents a new surface area for attacks. Expected results: It's the websites fault for invoking this function unprompted, but Firefox should not trust websites to be reasonable. I suggest that OpenVR functions be locked behind a permission system, like notifications currently has. A popup from the address bar asking "Allow cnn.com to start your VR system this time? Allow / Disallow + Remember my decision for cnn.com", plus a way to change previous decisions from the preferences page. Users who want to always deny can disable the flag.
Hi. I had to test a fix for another bug on WebVR and so I used the webvr.info and a-frame.io sites a lot and this bug reproduces 100% every time. It's not just with SteamVR, it also works with Oculus software. I had both of them installed on the machine I was testing on and I was using SteamVR with the HTC Vive; everytime I would open a site that uses WebVR the Oculus software would start up. When both SteamVR and Oculus where shutdown just SteamVR would start. This behaviour was not just for the WebVR sites but also for other sites, like the one from Description. Please let me know if I can help in any other way.
Component: Untriaged → WebVR
Product: Firefox → Core
I can confirm this issue. PS: Oculus Rift does not have this issue.
Status: UNCONFIRMED → NEW
Has STR: --- → yes
status-firefox63: --- → affected
status-firefox64: --- → affected
status-firefox65: --- → affected
Ever confirmed: true

Thank you for pulling the details together here.

The solution to this will involve some changes to the way we initialize OpenVR, some help from Valve, and some additional UX to allow the user to have more control over the browser behavior. I will break this down into a set of individual bugs for each component to track our progress.

Assignee: nobody → kgilbert
Priority: -- → P2
See Also: → 1467003

Bug 1580567 has landed, implementing permission UI, a whitelist/blacklist system, and a less intrusive OpenVR runtime detection system.

Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.