682455 - Granting permission to a specific site to access geolocation five times should not grant this permission permanently

Status: RESOLVED WONTFIX

(Firefox for Android Graveyard :: General, enhancement)

Description

[Ian Melven :imelven]

It's my understanding that in Fennec, if a particular site asks the user to access their geolocation five times and the user answers 'yes' five times, we then always allow the content to access the geolocation after that without prompting again. 

I'm not sure if it's 'five times per browsing session' (resets if browser is exited/killed) or 'five times ever' (counts across restarts etc.). The former is better, but still problematic, 

There's been some privacy/security concerns raised about this behavior. A potential mitigation suggested is to ask the user the 5th time, along the lines of a dialog saying 'grant access and continue to grant access without prompting', assuming we don't already explicitly tell the user we are doing this and asking them if it's ok. IMO, the best approach is a full 'remember this answer' style dialog (if possible given the mobile UX) and then UI around revoking this permission grant later.

Comment 1

[Mark Finkle (:mfinkle) (use needinfo?)]

I thought desktop did it the same way?

Comment 2

[Doug Turner (:dougt)]

this is what the iphone does.  it is kinda a standard way of doing things if you don't allocate extra space to a 'remember me' check box.

What specific privacy/security concerns were raised about this behavior?

Showing extra text doesn't buy us anything.  If you want to discuss this further, lets use the newgroups/mailing list.

This is not a bug.  Marking INVALID.

Comment 3

[Lucas Adamski [:ladamski]]

Maybe I'm being OCD here but "INVALID" does sound right.  The point being raised is valid (i.e the user may not be aware that the decision is saved permanently after 5 responses).  If we don't have a viable mitigation for this that's fine, but it doesn't invalidate the underlying concern.

Comment 4

[Lucas Adamski [:ladamski]]

Sigh: /does/doesn't/

Comment 5

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

sec-review-complete: no action

Comment 6

[Ian Melven :imelven]

just a note here that this isn't actually what the iPhone/iOS mobile safari does : it does remember the decision after 2 'yes' votes, but then only remembers that for 24 hours, not permanently.

Comment 7

[Doug Turner (:dougt)]

yeah, that changed recently iirc.  we could do something similar, i suppose.

Comment 8

[Ian Melven :imelven]

i'd be in favor of time limiting the granted permission although 24 hrs does seem kind of arbitrary and only the icon displayed lets the user know this has happened, however i'd still prefer a full 'remember this decision' (either checked by default or not, android stock is checked by default which is fine by me) experience if possible. especially since unlike android and ios, we allow users to clear granted location permissions PER-SITE where they only allow 'clear all remembered location decisions' globally, so i think we have a better experience in that regard and could take more advantage of it.

Comment 9

[Ian Melven :imelven]

another note here that Firefox (on desktop and Fennec) prompts much more than the other desktop/mobile browsers i looked at when doing a survey of geolocation permissions across different platforms - other browsers prompt once and then do NOT prompt again if a geolocation API is called (sometimes even across reloading the page for some browsers) - in my testing, Firefox prompted on every call to a geolocation API.

Comment 10

[BMO Automation]

Closing all opened bug in a graveyard component