55030 - Default is to send user's email address as anon. FTP password

Status: VERIFIED FIXED

(Core :: Security, defect, P1)

Description

[Ben Bucksch (:BenB)]

Reproduce:

- The following might work (I cannot test, because I have anon FTP server sat up
right now):

<html><body>balblabla
<img src="ftp://www.mysite.com/get-the-email-address/banner.gif">
blablabl</body></html>

- The following will most likely work:

<html><body>balblabla
<a href="ftp://www.mysite.com/get-the-email-address/page2.html">Next page</a>
</body></html>

If we s end the user's real email address (which we know through Mailnews) as
FTP password, a website owner quickly and easily get knowledge of the user's
identity and email address. Ideal for spammers and information sellers. This is
a tremendous privacy threat. The assumption is that the web site does not know
your identity. Yes, you can disable it via prefs, but how many people check all
prefs, before they start to surf? 4.x Win and Linux default to "do not send the
email address". It is enabled by default in Mozilla.

Disable this pref by default.

Comment 1

[Ben Bucksch (:BenB)]

Patch will follow. mstoltz, please review.

I think, this must be in fixed in N6.

Comment 2

[Ben Bucksch (:BenB)]

Attachment: Fix, version 1

Comment 3

[Ben Bucksch (:BenB)]

> I have anon FTP server

I have *no* anon FTP server

Comment 4

[Mitchell Stoltz (not reading bugmail)]

I concur. Let me see if I can get this approved.

Comment 5

[Mitchell Stoltz (not reading bugmail)]

r=mstoltz. Fix looks good to me. Can we get this approved?

Comment 6

[Ben Bucksch (:BenB)]

I sent mail to [e-mail] (brendan and scc in particular).

Comment 7

[Brendan Eich [:brendan]]

a=[e-mail], for sure.

This pref seems like a bad idea.  Doesn't the wallet help to memorize the fact 
that one often types one's email address as an anonymous ftp server password?

/be

Comment 8

[Ben Bucksch (:BenB)]

Checked into the trunk. Tnx for easy r=/a=.

PDT: Can we get this also into the N6 branch, please?

Brendan, I think, we send a dummy email address (like <[e-mail]>),
if the pref is sat at "do not send". I guess (but I don't know), because some
FTP server admins really want a real address (some actually vrfy it, IIRC).

Comment 9

[John Morrison]

Um, I don't think that pref is even used. LXR says no, and looking through
the FTP code, it will send USER/PASS if given in the URL, or will prompt if
this is not an anonymous FTP server, otherwise sends 'anonymous'/'mozilla@'
as USER/PASS.

http://lxr.mozilla.org/seamonkey/search?string=advanced.mailftp

http://lxr.mozilla.org/seamonkey/source/netwerk/protocol/ftp/src/nsFtpConnectio
nThread.cpp

Comment 10

[Ben Bucksch (:BenB)]

heh, you're right
<http://lxr.mozilla.org/seamonkey/source/netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp#887>.
Good catch :).

What should we do? Remove the pref UI or add the backend?

Marking FIXED. I don't think, Netscape will add the backend for N6, so this is
not needed for N6.

Comment 11

[John Morrison]

I would guess|agree that there is no way that the backend code would be 
accepted onto the branch. 

However, as currently configured, the Prefs UI suggests that we are
broadcasting the end-user's email addresses to anonymous FTP sites by
default. (Note that in Nav4.x, this preference was explicitly defaulted to
false.)

I think that gives a terrible impression of disrespect for end-users'
personal privacy. We should flip that preference to false in the branch bits
as well (and possibly just remove the obsolete, inactive UI). So, reopening
to, at minimum, change the pref in the branch bits as well.

mstolz,brendan: comments? (cc: don, to see if he wants to completely remove the
prefs UI for this non-existent feature (it is non-existent, right Jud?)).

Comment 12

[Ben Bucksch (:BenB)]

OK...

I would need help to land on branch - I have no branch tree (yet).

Comment 13

[Mitchell Stoltz (not reading bugmail)]

I agree. Flipping the default on a pref that's never used is certainly a
low-risk change, and it will give users a better impression. I'll see about
branch checkin approval.

Comment 14

[Phil Peterson]

PDT marking [rtm++] to change the default pref only. Please do not change the UI
for Seamonkey.

Comment 15

[Jim Roskind]

Ben asked for help getting this landed on the branch.
Don: Can you find someone to help with this one-liner?
..or Mitch, do you have a brach build to land this?

Can whoever takes this, please change ownership on the bug, resolve it, and then
mark it fixed.  Thanks! ;-)

Comment 16

[Blake Ross]

I would check this in but in my current, updated branch tree, that pref is 
already set to `false'....?

Comment 17

[John Morrison]

Can you check again, Blake. Bonsai doesn't show this change to all.js on the
branch:
http://bonsai.mozilla.org/cvslog.cgi?file=mozilla/modules/libpref/src/init/all.js&rev=Netscape_20000922_BRANCH

Comment 18

[Blake Ross]

Yeah, sorry, I <erg> apparently checked out the trunk tree into my branch 
directory, thereby rewriting my entire branch tree.  I'm repulling now, and 
unless someone else gets to this first, I'll check this in tomorrow.

Comment 19

[Jesse Ruderman]

*** Bug 27973 has been marked as a duplicate of this bug. ***

Comment 20

[Blake Ross]

ok, fix checked in to the branch.  why we didn't just remove this non-working 
UI (an equally riskless change) is beyond me, though...

Comment 21

[lchiang]

czhang no longer working on this - reassign to paw

Comment 22

[John Morrison]

verified fixed, branch and trunk: advanced.mailftp is set to false in all.js,
in cvs, and in what is being shipped in the product.