1672344 - Add telemetry for measuring usage of external protocol navigations initiated by third-party iframes

Status: RESOLVED FIXED

(Firefox :: Security, task, P1)

Description

[Johann Hofmann [:johannh]]

In order to understand how to properly handle external protocol navigations in iframes, it would be useful to have some telemetry around how much they actually occur.

Paul, would you like to look into that?

Comment 1

[:Gijs (he/him)]

I'm confused - I thought I answered questions around this in some of the other linked bugs, cf. bug 1606484 comment 34. Specifically, I think all the dupes of bug 1650162 mean we can't really do much to break this. Microsoft Teams, Steam, GoToMeeting, Roblox, and all kinds of other places use the "load the external protocol link into an iframe" technique - probably significantly more given that that bug only broke the ones where the iframe was not connected to the document, or where it was hidden...

Comment 2

[Johann Hofmann [:johannh]]

Ah, right, I wasn't really aware of those :)

Do we still want to have the raw numbers on it or should we close this bug? Maybe Paul has an opinion...

Comment 3

[Emma Zühlcke [:emz]]

I agree, if 3rd party external protocol navigations are so popular, we can't break them. If we only wanted the telemetry for checking if we can block these navigations, we can probably close the bug.
Other than that, deciding whether we want to integrate with permission policy shouldn't really depend on the usage stats?

Comment 4

[Anne (:annevk)]

I think if we want to use Permissions Policy, the default should be that it's disabled in a third party. It also seems that per Gijs' comments elsewhere, there might have been a misunderstanding and those sites are not using a cross-origin frame to navigate (from the perspective of the top-level document), but rather a same-origin frame (i.e., one with initial about:blank)?

Comment 5

[:Gijs (he/him)]

(In reply to Anne (:annevk) from comment #4)

I think if we want to use Permissions Policy, the default should be that it's disabled in a third party. It also seems that per Gijs' comments elsewhere, there might have been a misunderstanding and those sites are not using a cross-origin frame to navigate (from the perspective of the top-level document), but rather a same-origin frame (i.e., one with initial about:blank)?

Yeah, comment #0 doesn't mention third party iframes, and the previous summary doesn't mention "iframe", so I just read "third-party external protocol" as "protocol implemented by a third party". :-\

Comment 6

[Johann Hofmann [:johannh]]

So it would be good to have this Telemetry :)

Comment 7

[Emma Zühlcke [:emz]]

Attachment: Bug 1672344 - Added telemetry for measuring usage of external protocol navigations by iframes. r=johannh

Comment 8

[Emma Zühlcke [:emz]]

Attachment: data-review-request.md

Comment 9

[Tim Smith (inactive) 👨‍🔬 [:tdsmith]]

Comment on attachment 9187483 [details]
data-review-request.md

Thanks!

1. Is there or will there be documentation that describes the schema for the ultimate data set in a public, complete, and accurate way?

Yes, in the probe definition files and the Probe Dictionary.

2. Is there a control mechanism that allows the user to turn the data collection on and off?

Yes, the Firefox telemetry opt-out.

3. If the request is for permanent data collection, is there someone who will monitor the data over time?

n/a

4. Using the category system of data types on the Mozilla wiki, what collection type of data do the requested measurements fall under?

Category 2, interaction data.

5. Is the data collection request for default-on or default-off?

Default-on.

6. Does the instrumentation include the addition of any new identifiers (whether anonymous or otherwise; e.g., username, random IDs, etc. See the appendix for more details)?

No.

7. Is the data collection covered by the existing Firefox privacy notice?

Yes.

8. Does there need to be a check-in in the future to determine whether to renew the data?

pbz will decide to renew the collection as necessary.

9. Does the data collection use a third-party collection tool?

No.

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6fe2e921692a
Added telemetry for measuring usage of external protocol navigations by iframes. r=johannh

Comment 11

[Atila Butkovits]

Backed out for build bustages.

Backout link: https://hg.mozilla.org/integration/autoland/rev/48649c220042d717dd09a2822faade616e54302a

Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception&revision=6fe2e921692a7c49c60128ad967985895fc0cf61&searchStr=build

Failure log: https://treeherder.mozilla.org/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception&revision=6fe2e921692a7c49c60128ad967985895fc0cf61&searchStr=build

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/bdb198051288
Added telemetry for measuring usage of external protocol navigations by iframes. r=johannh

Comment 13

[Emma Zühlcke [:emz]]

Windows builds failed because the enum the telemetry code generated used WINDOWS which seems to be a reserved keyword. I've renamed the label.

Comment 14

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/bdb198051288dfaf5dc1eaaa80fea6d42a0bdc1d