862204 - Security Review: In-product about:support API

Status: RESOLVED WONTFIX

(mozilla.org :: Security Assurance: Review Request, task)

Description

[Matt Grimes [:Matt_G]]

Initial Questions:

Project/Feature Name: In-product about:support API 
Tracking  ID:https://bugzilla.mozilla.org/show_bug.cgi?id=732527
Description:
Looking to get the ball rolling on a privacy review for getting the about:support API baked into the browser. We've been experimenting with this on the SUMO forums using an addon and the results have been amazing. This allows us (with the user's permission of course) to automagically pull the about:support information so they don't have to provide it manually. This helps us to better understand the user's issue and ultimately to help resolve the issue faster. It also provides us with more data for investigating issues. We can make correlations between types of issues and information provided in about:support.

The next phase of this plan is to implement this feature permanently in the product. We would then use a whitelist to restrict access to the data. That way we can use this data on the SUMO forums, Input, and any other sites that may benefit from this info.
Additional Information:

Urgency: 2-4 weeks
Key Initiative: Firefox Desktop
Release Date: 
Project Status: development
Mozilla Data: Yes
New or Change: New
Mozilla Project: General
Mozilla Related: 
Separate Party:

Security Review Questions:

Affects Products: Yes
Review Due Date: 
Review Invitees: 
Extra Information:
We would like to use a whitelist to prevent other sites from trying to access this data.

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

unhiding & marking for triage

Comment 2

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

this mostly needs an implementation review just to check for security issues that may arise

Comment 3

[David Chan [:dchan]]

Matt:
I'm guessing that this bug is for a review of the code for bug 554174? If so I can finish this up by end of week.

Comment 4

[Matt Grimes [:Matt_G]]

This is actually for the next logical evolution of about:support as described in 862203. We want to be able to pull the information automatically for a couple of whitelisted websites so that we don't have to rely on the user's ability to find and provide that information.

Comment 5

[David Chan [:dchan]]

Thanks Matt,

Is there an ETA when the new API / whitelist will be implemented?

Comment 6

[David Chan [:dchan]]

Resetting the target dates until more is known

Comment 7

[David Chan [:dchan]]

Resetting triage for this flag until bug 862203 is further along. It appears to be at wireframe stages

Comment 8

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

please do light weight risk review and we will slot this for sprint 2

Comment 9

[:Gavin Sharp [email: [e-mail]]]

We're going to do this in bug 1079563.