822675 - pref to disable add-ons when entering per-window private browsing

Status: RESOLVED WONTFIX

(Firefox :: Private Browsing, defect)

Description

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

We should have a pref that allows the disabling of some or all extensions and add-ons when entering private browsing mode. We are currently the opposite in that we allow everything when entering PB (chrome is explicit allow). We should decide to either keep the current behavior and allow the disabling or disable all and allow selective enableing

Comment 1

[Josh Matthews [:jdm]]

Note that it's not possible to disable non-bootstrapped addons without restarting the browser.

Comment 2

[Josh Matthews [:jdm]]

Bug 463027 is being used as a tracker for blockers for release of the feature, and I don't believe this qualifies.

Comment 3

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

(In reply to Josh Matthews [:jdm] from comment #2)
> Bug 463027 is being used as a tracker for blockers for release of the
> feature, and I don't believe this qualifies.

Given that the old PB model caused all add-ons to be disabled (or am I wrong), I think this should block release. This could cause a serious privacy breach when in PB that we don't intend.

Comment 4

[Josh Matthews [:jdm]]

You are incorrect in that assertion.

Comment 5

[(no longer active)]

Unless we have a good way of disabling add-ons on a given window, this is WONTFIX.  Adding support for that seems impossible in practice because at the very least we should not assume that we get to change all of the add-ons.

Comment 6

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

we can start the browser without any addons directly with the -saf-mode flag can we not use that code? I think we need a pref that users can control if it's all or nothing for now that is better than not having an option at all.

Comment 7

[:Gavin Sharp [email: [e-mail]]]

(In reply to Curtis Koenig [:curtisk] from comment #6)
> we can start the browser without any addons directly with the -saf-mode flag
> can we not use that code?

That code involves restarting the browser. We can't restart the browser to start a new private browsing window. Short of other major architectural changes (like e10s), it's not really possible to do this currently.

Comment 8

[Florian Bender]

Is it even possible to disable Bootstrapped Addons for certain windows? I guess not. 

How about adding a new Flag to Addons that indicate "PB-readyness"? 
- "undefined" is the default value which indicates that it is not known whether this Addon honors PB mode restrictions. 
- "pb-safe" indicates that an Addon does not "leak" any information at all or honors a document's PB state. 
- "pb-unsafe" indicates that an Addon does not honor a document's PB state and may "leak" private information. 

Such a flag may provide hints (displayed in about:addons and AMO) for users whether they want to use an Addon when they need to rely on PB information not being leaked at all. This flag can also be added to the AMO review process. Plus, if Fx eventually has the ability to disable Addons per-document, this flag can be used to indicate whether an Addon has to be disabled for PB.

Comment 9

[(no longer active)]

(In reply to comment #8)
> Is it even possible to disable Bootstrapped Addons for certain windows? I guess
> not. 

It is but that is not a good idea since those add-ons are not different from a user's standpoint.

> How about adding a new Flag to Addons that indicate "PB-readyness"? 
> - "undefined" is the default value which indicates that it is not known whether
> this Addon honors PB mode restrictions. 
> - "pb-safe" indicates that an Addon does not "leak" any information at all or
> honors a document's PB state. 
> - "pb-unsafe" indicates that an Addon does not honor a document's PB state and
> may "leak" private information. 
> 
> Such a flag may provide hints (displayed in about:addons and AMO) for users
> whether they want to use an Addon when they need to rely on PB information not
> being leaked at all. This flag can also be added to the AMO review process.
> Plus, if Fx eventually has the ability to disable Addons per-document, this
> flag can be used to indicate whether an Addon has to be disabled for PB.

Private browsing readiness is already on the review check-list for AMO reviewers.

Comment 10

[:Gavin Sharp [email: [e-mail]]]

(In reply to :Ehsan Akhgari from comment #9)
> (In reply to comment #8)
> > Is it even possible to disable Bootstrapped Addons for certain windows? I guess
> > not. 
> 
> It is but that is not a good idea since those add-ons are not different from
> a user's standpoint.

I don't see how this is possible. Bootstrapped add-on code is not tied to windows, and many of them use e.g. the window watcher to enumerate windows and run code in them. There's no easy way to stop that.

Comment 11

[(no longer active)]

(In reply to comment #10)
> (In reply to :Ehsan Akhgari from comment #9)
> > (In reply to comment #8)
> > > Is it even possible to disable Bootstrapped Addons for certain windows? I guess
> > > not. 
> > 
> > It is but that is not a good idea since those add-ons are not different from
> > a user's standpoint.
> 
> I don't see how this is possible. Bootstrapped add-on code is not tied to
> windows, and many of them use e.g. the window watcher to enumerate windows and
> run code in them. There's no easy way to stop that.

Oh I thought comment 8 is proposing to disable those add-ons completely without restarting!

To be honest, there is nothing practical to be done in this bug...