413739 - warn against opening blocked URLs in another browser

Status: RESOLVED WONTFIX

(Toolkit :: Safe Browsing, defect)

Description

[Dave Camp (:dcamp)]

In the safebrowsing security review it came up that people might (out of determination or curiosity) be motivated to load a blocked URL in a browser that won't block the site.

We discussed a few possible changes:
* Adding text to the blocked page site warning against this
* Disabling Cut/Copy in the URL bar on a blocked site.
* Popping up a "seriously don't paste this somewhere else" dialog if someone tries to cut/copy from the url bar.

Comment 1

[Johnathan Nightingale [:johnath]]

Would it make any sense at all for the cut-copy code to watch generically for urls being copied to the clipboard, and doing a phish/malware lookup on them?  I guess that if you're a phishtank volunteer, which requires people to do that, this could get pretty tiresome, but we could pref it out, if we went this way.

The lowest risk way of doing this would be to add another line of text to the warnings, of course.  That's also the lowest impact, since those error pages are already wordy, but the page is scary and jarring enough, I think, that a surprised user *might*, at least the first time, actually read through.  Maybe something short and sweet at the end like:

<p><b>Do not open this link in another program.</b></p>

Would be enough?  Quietly disabling cut-copy doesn't give people the feedback I think we'd like them to have - we just look broken, and they go back one page and copy-paste, or they type the url in.  I think the approach here really is to make it clear that yes, we anticipated that response, but it's still a bad idea.  My hope is that, as I mention above, this warning is stark and surprising enough that it breaks them out of their task-focus in the way that dialog boxes rarely do, and that we therefore DO have a very rare opportunity to write text they will read.

Comment 2

[Mike Beltzner [:beltzner, not reading bugmail]]

Can we show that dialog when we detect the copy event? That'd be super-slick.

Comment 3

[Justin Dolske [:Dolske]]

I don't think this is worth fixing at this point. If users are driven to try another browser because they don't understand why Firefox is blocking their site, they're going to do that no matter what we say or do to suggest they not do that.