787326 - Babylon software inject Firefox addon that changes preferences without the user authorization

Status: RESOLVED FIXED

(Firefox :: Extension Compatibility, defect)

Description

[Tomer Cohen :tomer]

Attachment: extracted BabylonToolbar.xpi

I am seeing a huge spike in users who complains that Babylon translation software changes default preferences in Firefox without the user authorization and without an easy way to revert it. While Babylon is a valuable application to its users, these tactics are used by malware addons and we don't expect that good guys will use it. 

For example, the new tab page that was added to Firefox just recently is one of the most complained feature — users report that it was taken over by Babylon Search and its removal instructions require manually editing about:config preferences. 

I'd suggest talking to Babylon and request them to remove this code, and if they won't do it, we might want to block their addons from installing. 

URL to their toolbar updater XML file: https://img.babylon.com/mntr/bbyln/ffxtlbr/update/update.rdf

Their supplied addon seems to be newer than what they provide in the updater. I can't find it online, so I'm attaching the addon XPI bundled in their installer for further investigation.

Comment 1

[Jorge Villalobos [:jorgev] (he/him)]

This is related to bug 780280

Comment 2

[Tomer Cohen :tomer]

(In reply to Jorge Villalobos [:jorgev] from comment #1)
> This is related to bug 780280

I am aware of the other bug. While it is about reverting preferences when uninstalling the extension, I'd prefer they won't mess with these preferences at the first place.

At the big picture, both bugs have negative impact on Babylon, because people who are bother because their take over are completely uninstalling Babylon instead of just uninstalling or disabling the addon, thus Babylon are losing users while doing these nasty tactics.

Comment 3

[Dron Rathore]

@tomer: I will stand with you for this.
Seriously the Babylon Toolbar mess up the browsers preferences and even if i uninstall it, the injected script still remains there.
These all are pitfalls of it:
1. On Win 7, everytime you start the system, there is a popup saying "Browser Settings Changed"(for IE, firefox don't even bother about it.)
2. The Loading time of Firefox is increased(with several 10+ seconds).
3. The toolbar messup the nav bar of firefox and the default search engine and new tab preferences.
This all conclude that, its good to have a community of addon developers but in turn, user experience should not be costed.

Comment 4

[Dron Rathore]

How about editing the firefox script to restrict the addons on changing things on their own?
Before init() an addon we should ask the user for the settings to be changed and if the addon forcibly try to change things everytime, it should be "BLACKLISTED".

Comment 5

[Jorge Villalobos [:jorgev] (he/him)]

The latest version of Babylon asks users about the preferences being changed, and they need to opt in before continuing with the install process.