253840 - Mozilla/Firefox needs to always have a status bar for ALL windows...

Status: RESOLVED EXPIRED

(SeaMonkey :: General, enhancement)

Description

[Frank C. Earl]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040614 Firefox/0.8
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040614 Firefox/0.8

As you've already surmised, the word is out on Slashdot and elsewhere on the XUL
spoofing exploit- and as it's already got a bugzilla entry I won't talk to that
one.  To make it more difficult to make such exploits work in the future, all
windows should have the status bar at the bottom.  The XUL exploit wouldn't be
anywhere near as effective and would have diminished the security risk involved
with it.  As it stands, I can't effectively suggest Mozilla OR Firefox for my
clients since what we're seeing here is a potential national security risk until
you fix the XUL problem and it's security image has been diminished because of a
convienience feature to allow "webapps".  

Reproducible: Always
Steps to Reproduce:
1.
2.
3.

Comment 1

[Bogdan Stroe]

See Tools->Options->Web Features->Advanced

There you choose not to allow scripts to "Hide the status bar".

Comment 2

[Frank C. Earl]

How can I put this nicely.  The feature to HIDE that bar is a SECURITY RISK.  
Let's not be doing things the MS way for convienence sake, forsaking security 
as a result.  Just because you can turn that feature off doesn't mean that 
it's an acceptable thing to 1) leave on if you keep it, 2) something you 
should even be doing in the first place. 
 
You don't get it.  I'm going to be in the position to be reccomending DHS 
related security reccomendations to a VERY large segment of the US industry as 
a whole as well as a lot of their customers.  If this is in there, it's going 
to be harder to sell everyone on using Mozilla/Firefox as a result of this- 
the feature allows for an exploit that is right on up there with some of the 
latest IE based malware and exploits.  This allows for someone to trip up the 
exploit or any future XUL based ones (Because you're sure as hell not going to 
be able to 100% secure THAT feature so that the browser's usable...) 

Comment 3

[Gervase Markham [:gerv]]

This is an automated message, with ID "auto-resolve01".

This bug has had no comments for a long time. Statistically, we have found that
bug reports that have not been confirmed by a second user after three months are
highly unlikely to be the source of a fix to the code.

While your input is very important to us, our resources are limited and so we
are asking for your help in focussing our efforts. If you can still reproduce
this problem in the latest version of the product (see below for how to obtain a
copy) or, for feature requests, if it's not present in the latest version and
you still believe we should implement it, please visit the URL of this bug
(given at the top of this mail) and add a comment to that effect, giving more
reproduction information if you have it.

If it is not a problem any longer, you need take no action. If this bug is not
changed in any way in the next two weeks, it will be automatically resolved.
Thank you for your help in this matter.

The latest beta releases can be obtained from:
Firefox:     http://www.mozilla.org/projects/firefox/
Thunderbird: http://www.mozilla.org/products/thunderbird/releases/1.5beta1.html
Seamonkey:   http://www.mozilla.org/projects/seamonkey/

Comment 4

[Gervase Markham [:gerv]]

This bug has been automatically resolved after a period of inactivity (see above
comment). If anyone thinks this is incorrect, they should feel free to reopen it.