737403 - Concerns about B2G privacy

Status: RESOLVED WONTFIX

(Firefox OS Graveyard :: General, defect)

Description

[David Teller [:Yoric] - still alive but not very active]

I have the feeling that our users can be victims of the following scenario:

1. application A (perhaps the Twitter Web Client) implements a Twitter client, authenticates with Twitter and therefore introduces into the user profile the cookies (or other tracking mechanism) used by Twitter;

2. application B (perhaps a web browser) visits a blog with the Twitter button - said Twitter button is actually implemented as an iframe on the same domain as Twitter, and can therefore read Twitter cookies;

3. result: Twitter can track user - much more so than on Android, for instance.

Is this the case? If so, we need plans to mitigate this.

Comment 1

[[:fabrice] Fabrice Desré]

How is it different than what happens when you use firefox to access twitter and other "twitter enabled" sites? Why is it more a concern for b2g?

Comment 2

[David Teller [:Yoric] - still alive but not very active]

On Android, if you use your Twitter native application to access Twitter and Firefox to browse, there is no information leak (afaict). With b2g, I fear that we lose that isolation.

Comment 3

[David Teller [:Yoric] - still alive but not very active]

I should add that this possible privacy leak appears not just in a visible Twitter client but any Twitter-enabled app, such as a game, and works both ways. Use your Twitter identity in the game (to accumulate points) and suddenly, every Twitter-enabled application and any Twitter-enabled blog leak your identity to Twitter. This is of course also true of any other service that features some form of tracking, including many that are certainly less respectable than Twitter.

Comment 4

[Andreas Gal :gal]

I think you are describing the problem I tracking on the web. Nothing here is specific about B2G.

Comment 5

[David Teller [:Yoric] - still alive but not very active]

What I mean is that the problem of tracking on the web is even more pervasive on B2G, as there is nothing but the web.

Note that we might be able to mitigate the problem by allowing per-application/per-website profiles.

Comment 6

[Andrew Overholt [:overholt]]

Jonas says this will be fixed once we have data jars.

Comment 7

[BMO Automation]

Firefox OS is not being worked on