1925236 - www.drupal.org - Captcha doesn't load with ETP Strict

Status: RESOLVED FIXED

(Web Compatibility :: Privacy: Site Reports, defect, P3)

Description

[railioaie]

Environment:
Operating system: Mac OS X 10.15.7
Firefox version: Firefox 131.0

Preconditions:
Clean profile
ETP Strict

Steps to reproduce:

1. Go to Firefox browser and
2. Browse to about:config
3. Dismiss the warning
4. Create a new preference item
5. Type the name that stores the custom user agent (general.useragent.override)
6. From the three choices select String and press +
7. You will see an input box where you can type: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/601.1.54 (KHTML, like Gecko) Version/9.0 Safari/601.1.54*
8. press Enter
9. Navigate to: https://www.drupal.org/user/login
10. Observe the page

Expected Behavior:
The Captcha is loading as expected

Actual Behavior:
Captcha is not loading

Notes:

• Reproduces in ETP Strict Mode only
• Reproduces in Firefox Nightly, and Firefox Release
• Does not reproduce in Chrome

Created from https://github.com/webcompat/web-bugs/issues/142647

Comment 1

[railioaie]

Attachment: Screenshot_1.png

Comment 2

[railioaie]

Attachment: Screenshot 2024-10-17 at 12.14.38.png

Comment 3

[Bryan Becker]

This is caused because Strict-Mode is blocking the domains that serve this captcha. Before reporting this bug, I checked with Disconnect.me (who I think provides the lists that inform Strict Mode) - they told me that these domains are classified as "anti-fraud", and that Firefox needs to have an exception for loading content from domains with that category.

Comment 4

[tim]

Following as the leader of the team that manages Drupal.org's infrastructure. Tools like this are incredibly helpful in spam prevention, but the incompatibility with tracking protection is causing a real headache.

Comment 5

[Dan Mehic]

Hi folks, Dan from privacy team here. We'll be looking into this.

Comment 6

[Manuel Bucher [:manuel]]

(In reply to tim from comment #4)

Following as the leader of the team that manages Drupal.org's infrastructure. Tools like this are incredibly helpful in spam prevention, but the incompatibility with tracking protection is causing a real headache.

Thanks for reaching out. Will look into what we can do to resolve.

(In reply to Bryan Becker from comment #3)

who I think provides the lists that inform Strict Mode

Yes, we are using the list from disconnect.me.

they told me that these domains are classified as "anti-fraud", and that Firefox needs to have an exception for loading content from domains with that category.

Is this conversation publicly link-able? I'll reach out to them if not to see whether they can remove this list from the tracker list (conditioned that they don't classify it as a tracker) as the first step and take a look what at the "anti-fraud" list otherwise.

I looked if I can find discussions on px-cloud on disconnect, but couldn't find any. Found one unrelated similar request to a different list: https://github.com/shreyasminocha/shady-hosts/issues/11

Comment 7

[Bryan Becker]

(In reply to Manuel Bucher [:manuel] from comment #6)

Is this conversation publicly link-able? I'll reach out to them if not to see whether they can remove this list from the tracker list (conditioned that they don't classify it as a tracker) as the first step and take a look what at the "anti-fraud" list otherwise.

It's an email thread. Opening an submission on their github ends up in an email "appeal" process over email.

I'm happy to share it with you in a non-public forum if it's important, but the short version is that they insist that they keep these domains in the list and that "Our partners, like Firefox, have their own policies for integrating the categories on our list including the Anti-fraud category."

Comment 8

[Manuel Bucher [:manuel]]

Hi, yes the context would be interesting. I would appreciate if you could forward the mail to [e-mail] and include the bug number to the subject. Would make it easier to review the lists we subscribe to with the team. I'm new to this, so don't have background information on our current choice, but would bring up with the team for discussion. Thanks!

Comment 9

[Manuel Bucher [:manuel]]

Setting needinfo for the context from disconnect. If you can share, that would be greatly appreciated.

Comment 10

[Bryan Becker]

Hi @(In reply to Manuel Bucher [:manuel] from comment #9)

Setting needinfo for the context from disconnect. If you can share, that would be greatly appreciated.

Hi Manuel -- just forwarded the thread.

Comment 11

[Bryan Becker]

I received this auto-reply, FYI:

We're writing to let you know that the group you tried to contact (privacy-team) may not exist, or you may not have permission to post messages to the group. A few more details on why you weren't able to post:

• You might have spelled or formatted the group name incorrectly.
• The owner of the group may have removed this group.
• You may need to join the group before receiving permission to post.
• This group may not be open to posting.

If you have questions related to this or any other Google Group, visit the Help Center at https://support.google.com/a/mozilla.org/bin/topic.py?topic=25838.

Thanks,

mozilla.org admins

Comment 12

[Manuel Bucher [:manuel]]

Hm, that mailing list seems to be currently configured for internal mails only. Can you forward it to me ([e-mail]) instead, please? I'll forward to the team then.

Sorry for the inconvenience. I'll take a look at what is necessary to fix the permissions on the list.

Thanks!

Comment 13

[Bryan Becker]

Done, thanks for the help!

Comment 14

[Daniel Holbert [:dholbert]]

:manuel, do you think there's anything we can do here, in light of whatever information you gleaned from the aforementioned email that Bryan forwarded along?

I ran across another site that's broken in the same way, tracked in bug 1948146. I imagine every site using this captcha provider would be similarly-broken for Firefox users with strict ETP.

Comment 15

[Daniel Holbert [:dholbert]]

Ah I see manuel has recently filed bug 1946377 on captcha breakage associated with px-cloud.net and px-cdn.net; canceling needinfo and adjusting this to be associated with that bug.

Comment 16

[Christian Holler (:decoder)]

This bug has been fixed by a permanent intervention.

This is an automated assessment, if this bug still reproduces for you in the most recent Nightly version, please reopen.