1795927 - New SitePerms add-ons surfaces previously-silent WebMIDI fingerprinting by sites

Status: RESOLVED FIXED

(Toolkit :: Add-ons Manager, task)

Description

[William Durand [:willdurand]]

On Nightly (Bug 1790620), users might get prompted when navigator.requestMIDIAccess() is used, with or without sysex: true (contrary to Chrome), and for various purposes (not just to interact with MIDI controllers for instance...). For example: https://twitter.com/jonrandy/status/1582217349704187904

This is the expected behavior at the moment but let's see if we should change this behavior or not.

Note: if the user chooses "Never allow" from the install flow dialog related to the third party install dialog, then further calls to navigator.requestMIDIAccess will not prompt the user anymore, and there is a visual feedback of that being the case.

Comment 1

[Bobby Holley (:bholley)]

And to be clear here: silently allowing enumeration of connected MIDI devices (and non-sysEx access to those peripherals) without user consent is not something we'd consider. It's pretty bananas that Chrome allows this this.

Comment 2

[Nicolas Chevobbe [:nchevobbe]]

Attachment: Bug 1795927 - Add SitePermsAddon blocklist. r=rpl,willdurand,bholley.

This is adding a very simple, in-tree, domain blocklist that is being looked up during the
Site Permissions addon install workflow.
The blocklist is pretty broad at the moment, as it would prevent a given domain to install
any of the gated permission.
We can re-evaluate this behavior in the future when we introduce new gated permissions.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/805e15f2b0b8
Add SitePermsAddon blocklist. r=willdurand.

Comment 4

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/805e15f2b0b8