581774 - Privacy policy of Xmarks SearchTabs fails to describe the real privacy concerns

Status: RESOLVED FIXED

(addons.mozilla.org Graveyard :: Policy, defect, P3)

Description

[Wladimir Palant]

I investigated the privacy of the Xmarks SearchTabs extension. Its way of functioning is injecting a script from xmarks.com into all Google search pages. This isn't a concern by itself since modifying Google search pages is the primary function of this extension. Also, the regular expression used to recognize search pages is hardcoded, this cannot be turned into universal XSS without changing the extension. However, given that this script can be changed at any time it should be expected to see the privacy policy under https://addons.mozilla.org/en-US/firefox/addon/14470/privacy/ describe what that script is allowed to do (in particular - what will happen to search queries that it necessarily transmits to Xmarks). The privacy policy however only describes the Xmarks add-on, Xmarks SearchTabs isn't mentioned with a single word.

The other concern is a persistent client identifier stored in extensions.xmarks.machineId preference. This identifier is unnecessary and its existence is everything but obvious. This client identifier will be transmitted to the Xmarks server on each startup via CheckForServerChanges() function (chrome/content/service.js) and also all other requests, particularly on extension uninstall or disable.

Comment 1

[Jorge Villalobos [:jorgev] (he/him)]

The developer has been contacted.

Comment 2

[Jorge Villalobos [:jorgev] (he/him)]

The developer responded positively but there is no new release yet. Moving to 5.11.9.

Comment 3

[Jorge Villalobos [:jorgev] (he/him)]

Xmarks SearchTabs has been taken down by the developer. Xmarks Sync has a link to a very thorough privacy policy, so I think everything has been properly addressed.

FIXED.