1498635 - FxA should not reveal the user's other email addresses to their email provider

Status: RESOLVED WONTFIX

(Cloud Services :: Server: Firefox Accounts, enhancement)

Description

[b4283]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0

Steps to reproduce:

1. Add new email address to Firefox Account



Actual results:

Received an email notification at the primary email address containing full email addresses of the secondary address.


Expected results:

Received an email notification at the primary email address containing *MASKED* email addresses of the secondary address for privacy reasons.

Evil corporations like Google could easily parse the notification email to track users by getting their email addresses other than gmail.

Comment 1

[Ryan Kelly [:rfkelly]]

Thanks for the report and the feedback.  I'm moving the bug into the "Firefox Accounts" component for further discussion, and attempting to re-word the title to be more general, as I don't think the privacy-from-your-email-provider aspect is something we've considered explicitly in the past.

IIRC, we deliberately send notification emails with the "To:" address as your primary and with the secondary addresses as "CC:", in order to ensure the user has visibility into what emails are being sent and where.  If we do want to make changes here for privacy, we'll need to factor that in as well.

Comment 2

[Alex Davis [:adavis]]

Thanks for the report, we will investigate this request since we believe privacy is very important.

I'm hoping that this may be of some comfort to you. Gmail no longer scans emails for the purpose of Google ad targeting.
https://blog.google/products/gmail/g-suite-gains-traction-in-the-enterprise-g-suites-gmail-and-consumer-gmail-to-more-closely-align/

Quote from Google:
"G Suite’s Gmail is already not used as input for ads personalization, and Google has decided to follow suit later this year in our free consumer Gmail service. Consumer Gmail content will not be used or scanned for any ads personalization after this change."

Comment 3

[Shane Tomlinson [:stomlinson]]

Suggestion - Instead of CC'ing, send the email to each email independently.

Comment 4

[Ryan Kelly [:rfkelly]]

ensure the user has visibility into what emails are being sent and where.

Maybe we can keep (or even improve) this "visibility" aspect by adding some text to say it was also sent to X secondary emails. Or maybe that would just be confusing.

Comment 5

[Wil Clouser [:clouserw]]

I tested this recently. We don't CC anymore but we do include the full email of the secondary account in the email to the first.

Comment 6

[Wil Clouser [:clouserw]]

Aside from not optimizing for privacy from your email provider, I suspect this likely does more good than harm for people with hijacked accounts because they'll see an unrecognized email and start asking questions.

Regardless, this issue is 6 years old and is not on any roadmaps. Thanks for the topic and filing this, but I'm going to close this as wontfix.