Santander Brazil Internet Banking relies on (now removed) ogg/theora videos for OTP
Categories
(Core :: Audio/Video, defect)
Tracking
()
People
(Reporter: oliva, Unassigned)
References
(Regression)
Details
(Keywords: regression)
As soon as Trisquel 11 updated Abrowser from 129 to 131, I could no longer log in to Santander Brazil's Internet Banking system. For customers who don't carry tracking devices like me, they offer a hardware offline token with an optical sensor, intended to receive an (encrypted?) OTP from the browser by video. The video is embedded as a base64-encoded ogg/theora video. It used to play with 129, but 131 only shows a black rectangle at that spot, presumably because of bug 1860492.
I've confirmed that returning to version 129, this required authentication step works again, but the older version refuses to use the profile that version 131 had already converted (not nice!)
Is there any setting to restore the ogg/theora feature? Hopefully it was disabled experimentally, rather than removed altogether so abruptly. I'd have hoped for warnings when encountering such a major deprecated feature, for at least one long-term cycle, at some point having it disabled by default, instead of just breaking it on a small upgrade.
Failing that, is there anything that users of web sites that rely on this feature can do, aside from begging web site operators to change the way their website interacts with Firefox specifically?
Surely going back to older versions on security-sensitive scenarios such as Internet Banking wouldn't be a sustainable or recommended path to take.
Please consider restoring the feature and phasing it out in a way that, to users (vs web developers), is more visible and seems less rushed. Thanks,
|
||
Comment 1•10 months ago
|
||
The Bugbug bot thinks this bug should belong to the 'Core::Audio/Video' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.
|
||
Comment 2•9 months ago
|
||
This bug is not yet listed in the regressions of https://bugzilla.mozilla.org/show_bug.cgi?id=1860492
I cannot set the regressed by field in references.
|
Reporter | |
Updated•9 months ago
|
|
|
||
Comment 3•9 months ago
|
||
:padenot, since you are the author of the regressor, bug 1860492, could you take a look? Also, could you set the severity field?
For more information, please visit BugBot documentation.
|
||
Comment 4•9 months ago
|
||
This has been announced jointly by Firefox and Chrome in October 2023, picked up by the specialized press, and removed in May 2024 after a long period of trial and precisely zero complaints. Firefox ESR 128 is maintained until September 2025, plays Theora, so you can use that in the meantime.
Should your bank not update their system and insist on using a codec that hasn't received any meaningful attention in 5 years and has been removed by all major browser, it's possible that you can create a Web Extension that decodes Theora in JavaScript: https://github.com/bvibber/ogv.js. Another solution is of course to download the video and to play it locally with another piece of software.
I understand that this puts you in a difficult situation, and I appreciate raising your concerns, but we're not reinstating this obsolete codec.
Description
•