Apple, Microsoft, Google Attacked For Evil Plugins

nk497 writes "A Mozilla exec has attacked Apple, Microsoft and Google for installing plugins without users' permission. 'Why do Microsoft, Google, Apple, and others think that it is an OK practice to add plug-ins to Firefox when I'm installing their software packages?' Asa Dotzler asks. 'That is precisely how a Trojan horse operates... These additional pieces of software installed without my consent may not be malicious but the means by which they were installed was sneaky, underhanded, and wrong.' He called on them to 'stop being evil.'"

Comments

Yes

[metrix007]

Yes...I should not have to check addons to firefox to make sure nothing dodgy has been installed. Of course, this behaviour will continue as long as it is technically possible, so why doesn't Mozilla simply make it impossible? Only allow installing addons through firefox, with explicit prompts.

Re:Yes

[Anonymous Coward]

Yeah, this shouldn't be too hard. My understanding is that there's a directory that Firefox explicitly reads to load extensions. To "install" an extension, all you need to do is dump an extension in there, and it's "installed."

But you can disable extensions that have been installed and prevent them from being loaded.

So all you have to do is swap that blacklist for a whitelist. Problem solved.

Why is this a problem?

Re:Yes

[drachenstern]

Because not all extensions can be "disabled" from the UI. Then there's others, like Java, which don't remove old versions... go figure.

Re:Yes

[Krneki]

Exactly, lock the plug-ins with a password. This is something I'm waiting since a long time ago.

It's my browser and I don't like changes being made without my explicit confirmation.

Re:Yes

[140Mandak262Jamuna]

These dumped extensions can be disabled and uninstalled only from a root account. If you are using a lower privilege account for day to day ops, the uninstall button is grayed out. These extensions are assumed to be installed for "all users" and one low privileged user would/should not be able to take them out. It is a pain to log out, and log in as superuser just to disable one extension that some corporate creep decides to shove on my machine.

Re:Yes

[swillden]

So all you have to do is swap that blacklist for a whitelist. Problem solved.

Unless the installer automatically adds the plugin to the whitelist.

You also need to find a way to secure the whitelist against alteration by anything other than the browser.

Re:Yes

[hey]

Java's behavior is weird and annoying. I can only guess that they keep old versions just in case some website request it. But that seems unlikely. Hopefully they only keep they last, N, version of Java on your box and eventually start deleting.

Re:Yes

[mellon]

You are right in principle, but not in practice. The problem is that the security model for software package installations allows for privilege escalation in an unconstrained (not chrooted) environment. This means that the installer can do whatever it wants to Mozilla, and there's nothing Mozilla can do to stop it.

The solution to this problem is to use a different installation model and a different security model. Two examples are Bitfrost and iOS. Both use a security model where apps are constrained as to what they can access, and how they can access it. Installers aren't allowed to scribble all over the filesystem. Consequently, app installers would not be *able* to modify the Mozilla install, so this simply wouldn't be an issue.

So basically what's going on here is that these companies are taking advantage of a broken security model while they can. Hopefully as technology marches forward, this broken security model will become obsolete, although I see no evidence that Microsoft or Apple are working on it.

Re:Yes

[mysidia]

so why doesn't Mozilla simply make it impossible?

Because they shouldn't have to? Due to understood ownership of the application's own files by that application and the system admin?

Apple, Google, Microsoft should list their plugins in the Addons directory, just like everyone else has to. If they think users will strongly benefit from a plugin and want to make things easy, they should at least prompt first, before messing with a different application's files.

Because the functionality Microsoft/Google/Apple are abusing is important useful functionality for system administrators to deploy plugins system-wide or network-wide. Or install a plugin once globally, without each user needing to maintain and update their own copy of every popular plugin that is needed.

Just because Microsoft has no business using this functionality as an underhanded way to try to hoc their own plugins does not mean the easy deployment of browser with plugins pre-loaded should not be allowed.

Re:Yes

[wierd_w]

Encryption might not be necessary, as long as some other form of authentication security is implemented. EG, filesystem (and on windows, registry) security ACLs.

Similarly to how you can't change /fstab without being root.

The format of fstab is well documented, but changing it without permission is still hard-- etc.

Re:Yes

[Anonymous Coward]

I can only guess that they keep old versions just in case some website request it.

Java updates are largely security-related. Allowing any website to request the old, vulnerable version would be beyond stupid. We'd actually need to invent a new word to convey the stupidity of it.

Re:Yes

[QuoteMstr]

This approach is doomed.

The browser has to somewhere remember that a user approved an extension. It does this by writing state to disk. A malicious extension installer can simply modify this saved state to make the browser think the user installed and approved the payload. The same goes for a startup message advertising extensions that have been installed since the last browser run.

You can't win this fight without OS involvement. The correct solution is application-level sandboxing, which quite a few people are working on.

Re:Yes

[mysidia]

Mozilla needs to add a global configuration directive which must be set to enable plugins through any method other than XPInstall. That would take care of home users, who don't need to deploy plugins "globally". Quick plugin deployment is a developer / sysadmin feature.

Unless enabled, the user when they start the browser should be prompted one time to approve/reject each new plugin found in the directory. A Mozilla whitelist/blacklist should be checked before prompting.

And a list of plugins approved/disapproved should be part of the encrypted portion of each user profile.

Unauthorized deployments of plugins by OS vendors (instead of sysadmins), unless they use an approved mechanism to offer the user "approval based" activation of plugins, should result in blacklisting.

Mozilla is Open source, but that means YOU can modify your browser. Not, Everyone from the OS vendor on down to the PC manufacturer is allowed to do whatever extensions they want to your browser

Re:Yes

[Corporate Troll]

True, but keep in mind that only a privileged user would be able to install anything that has such a payload. So... Not a problem.

Re:Yes

[balbus000]

In my experience, installing software from the above companies usually has a checkbox to determine if you want to install a plug in (admittedly and annoyingly checked by default).

But off the top of my head, Skype does not give you and option to leave out the plug in. These practices are very frustrating indeed.

Re:Yes

[David_W]

We'd actually need to invent a new word to convey the stupidity of it.

"Java-esque"?

Re:Yes

[Sancho]

This kind of problem can be significantly mitigated through the methods suggested by the GP, though. Encrypt the list of enabled plugins with a user password. Now other software may be able to add plugins, but they can't enable them. You could go farther and encrypt the entire plugin directory, but I think that's probably overkill.

Re:Yes

[Tharsman]

Exactly what I was thinking. How about they stop being enablers and turn those stealth instals into install requests the user can turn down immediately?

Re:Yes

[Tharsman]

The limitation of not being able to disable add-ons from the UI is not something that HAS to be so, besides, the activation off the plugin can be put off until a user agrees to it's presence.

After all, if Google, MS and Apple are doing it, imagine what more malicious software can sneak in.

Re:Yes

[theCoder]

Normally, I'd agree, but the OP specifically talked about a user supplied password to be able to add a plugin. That password could control access to a private key that is used to sign a hash of the valid list of plugins. On startup, Firefox could use the public key to validate the list of plugins, and throw up a big error if the list is invalid (because someone snuck one in).

Of course, recovering from this state would be difficult -- maybe Firefox could provide a way to disable plugins until the new list matched it's hash? But it would at least alert the user that something fishy was going on. Think of it as a tripwire for plugins.

Re:Yes

[asdfghjklqwertyuiop]

Because they can't make it impossible. If they do that installers will simply start directly modifying whatever file contains that list of explicitly approved plugins to add theirs to it.

Re:Yes

[guanxi]

Exactly, lock the plug-ins with a password. This is something I'm waiting since a long time ago.

It's my browser and I don't like changes being made without my explicit confirmation.

Good idea, but impossible to enforce. If you give a program rights to install local code, it can modify or bypass any security Mozilla implements.

Re:Yes

[asdfghjklqwertyuiop]

Encrypted with a key stored where?

Re:Yes

[Sancho]

Turn off the computer right away. The key is stored INSIDE THE FILESYSTEM!

Re:Yes

[The Moof]

It also doesn't help stealth plug-in installations. Not to mention Firefox has no method to remove installed plug-ins, only disable them. Mozilla's official method is to hunt down the file on your system and delete it.

Needless to say, Mozilla's Plug-in handling leaves a lot to be desired.

Re:Yes

[QuoteMstr]

Encrypt the list of enabled plugins with a user password

"Encryption" is the wrong word here. What we're talking about is digital signing. The way it would work is that upon installation, the browser would generate a public-private keypair, encrypt the private key with a password of the user's choice, and save the resulting public key and encrypted private key to persistent storage.

At all times, the browser would store the list of enabled plugins and sign it with the encrypted private key. Nobody can generate a valid signature for a list of enabled plugins without the password, and the browser will not use a plugin list unless it comes with a valid signature.

All this is fine as far as it goes, but it'll only work until our malicious plugin installer patches the browser binary and makes it skip the key check; the malware could also replace both the public and the private key with replacements of its choosing. Either way, the user may or may not eventually notice that something is wrong, but if he does, it probably won't be a while, and he probably won't be able to track the malfunction back to the evil installer.

Malware vendors can also wait for the user to type his password when installing a different plugin, then use that password to generate a valid signature for a plugin list that includes anything desired.

The moral is that applications still need to be sandboxed. They're not protected from each other. Without OS-level protection, applications can do horrible things (often without needing elevated privileges at all). Half-measures aren't the answer.

Re:Yes

[Sancho]

What you're talking about is digital signing. What I was talking about was encryption. Both would work just fine to mitigate the problem (as I said.) The GP to my original post said nothing about encryption or signing, just "password protecting."

Neither approach solves the problem (as implied by my use of the word "mitigates."

It's the height of arrogance to assume that I didn't mean what I wrote.

Re:Yes

[QuoteMstr]

My interpretation was in the spirit of intellectual charity, not arrogance; i.e., I gave you the benefit of the doubt, employing the only interpretation that makes any sense.

Encryption without authentication is worthless. Either you're using symmetric encryption and you make the user enter the password every time the browser wants to read the plugin list (or worse, store the key on disk), or you're using asymmetric encryption and creating a message that can be decrypted by a given public key is simple.

Encryption *and* authentication is pointless in this case because the browser needs to be able to decrypt plugin information at all times using only information in persistent storage. Encryption does not provide any security properties in this context.

So we're left with authentication itself being the task at hand, which I assumed is what you meant. But instead of having an adult conversation about the issue, you have a temper tantrum. I'm through.

Re:Yes

[canajin56]

Encrypted with a key stored where?

In the user's mind. If you use public key encryption, Firefox only needs to store the public key on-disk in order to read the list. If Microsoft or Apple or Google reads the public key, all they can do is read the list of installed plugins and extensions. They cannot add to the list without using the public key to crack the private key, which is incredibly resource intensive just to install a browser toolbar on ONE SINGLE USER'S machine.

Of course, you are still correct in that this can be trivially defeated by just by generating a new keypair, re-encrypting the list with your new private key, and replacing Firefox's stored public key with the new one. But this will reset the user's password to whatever you have chosen. If the user is occasionally (or always?) prompted for their password, and it suddenly doesn't match, this will immediately alert them. And at any rate, Microsoft, Apple, or Google wouldn't want to have headlines about how they are erasing user passwords just to install obnoxious toolbars. It wouldn't protect against actual trojan attacks, though periodic password prompting would at least make the user aware of the tampering.

Re:Yes

[Lucky75]

+1 if I could. Not sure if it should be modded funny or insightful though.

Re:Yes

[metrix007]

Your reply is equivalent to arguing that people should be able to leave their houses completely open and unlocked, because it's wrong to steal. This is true, but completely irrelevant from a practical standpoint. As long as people *can* do something that benefits them, they *will*.

Re:Yes

[Lucky75]

Then the installers just need to go through your files and change the flag on the addon to enable it. Unless it's encrypted somewhere, but then the programs just need to go through your files and look for the key. The only way to prevent this is to have the user enter a password or something. However, most users are too stupid to understand what they're doing anyway.

Re:Yes

[asdfghjklqwertyuiop]

They cannot add to the list without using the public key to crack the private key,

Or trojaning the program that prompts the user for the passphrase to intercept the passphrase or just install their malware at that time.

Microsoft, Apple, or Google wouldn't want to have headlines about how they are erasing user passwords just to install obnoxious toolbars.

I don't give them quite so much faith. You'd think they wouldn't want headlines about secretly installing obnoxious toolbars at all, yet here we are...

Re:Yes

[VortexCortex]

"Encryption" is the wrong word here. What we're talking about is digital signing. The way it would work is that upon installation, the browser would generate a public-private keypair, encrypt the private key with a password of the user's choice, and save the resulting public key and encrypted private key to persistent storage.

No, what you are talking about involves Public-Key Cryptography, aka Encryption. Ergo, Encryption was the correct word in the GP, and you talk about using it extensively yourself.

Digital signatures can be generated without public key algorithms. The algorithms commonly used for signing data are called Message Digest or Fingerprinting algorithms.

MD5, SHA-1, SHA-256, and other such message digest algorithms can be used to digitally sign data.

Hashed Message Authentication Code (HMAC) can be used along with any digest algorithm in order to provide a keyed digest; An identical passphrase and input data is required to generate an identical digest/fingerprint.

Digital Certificates use both public key cryptography and message digest algorithms.

In any event, Encryption is involved, and is therefore not "the wrong word here".

Re:Yes

[Culture20]

I should not have to check addons to firefox to make sure nothing dodgy has been installed

...after every Patch Tuesday. I'm still angry about how the FF .Net plugin got installed via automatic updates of .Net Framework.

Re:Yes

[Sancho]

You think that was a temper tantrum? The Internet never ceases to amaze me.

Good day to you.

Re:Yes

[pthreadunixman]

Access control lists down to the atomic level along with encryption is the answer to every security problem. Neither one of these things work when the user himself is responsible for maintaining them. Installer: Do you want to install cute bunny screensaver overriding all security measures that would otherwise prevent said installation? User: Clicks YES button. Types in admin password.

Re:Yes

[Rob Riggs]

Doesn't FIPS mode do this? How is FF even remotely secure if it allows this in FIPS mode?

Re:Yes

[Your.Master]

You can make that impractical, though. They aren't really talking about defending against actively malicious code, but rather obnoxious code.

Re:Yes

[mcgrew]

Aren't car keys, door locks, and bank vaults technical solutions to social problems?

Re:Yes

[david_thornley]

I hate to break it to you, but there are worse people than Microsoft, Google, and Apple out there. The big corps want to give you something you'll find useful, in a way that suits their interest, and as a way of collecting useful public information from you. The real bad guys want to give you something so they can control your computer to do many illegal things, and collect useful private information on you. Google wants to know everywhere you browse and everything you buy; they aren't after your bank account access information. Apple wants you to do things the Apple way, which doesn't include launching DDOS attacks.

If Firefox was hardened to stop the real black hats, Microsoft couldn't install whatever they wanted.

Re:Yes

[QuoteMstr]

simply force the user to re-approve all plugins

Do that when the signature doesn't match. No need for encryption.

The only thing that's important here is ensuring that the browser, on behalf of the user, is the only one that can write the manifest to disk. There's no harm in other applications reading the state of the manifest

And that's *precisely* why encryption is pointless here: it provides confidentiality and nothing else, and we've already established that the plugin list is not confidential.

Re:Yes

[QuoteMstr]

You are clueless. Nothing about a digital signature system requires encryption. "Cryptography" refers to the broader field that encompasses the topic under discussion. Part of that field deals with digital signatures. These provide authenticity: i.e., proof that a message is actually from who it's purported to be from. Encryption is another, different part of the same field. It concerns providing confidentiality that prevents a message being observed. Another field is the study of digest algorithms, including keyed hashes. These provide integrity: i.e., proof that a message has not been tampered with. These are all separate and distinct areas, and you are conflating them. A keyed hash is not a digital signature system.

Re:Yes

[hairyfeet]

Why would it be difficult to recover? There is already FEBE which can automate backups of just about any part of Firefox INCLUDING extensions, so the logical route would be to simply roll a version of FEBE into Firefox and have a backup of either all data or just extensions and have them signed by the same key pair.

Personally I think it would be better to have FEBE backup everything at shutdown, along with backup of extensions upon user alteration. Then you could have a simple GUI so if the user goes "whoops" and deletes a bookmark he/she didn't mean to or some other accident they could have an easy "previous versions" style restore. This would not only protect from extension jacking but could be used to keep the home page from being altered without user permission, protect their Firefox Persona, etc. You could even have FEBE set to backup a second copy to a USB key if they wanted to be able to carry their settings between workstations. Sounds like a win/win to me.

Re:Yes

[ThatMegathronDude]

The first two only serve to show that you locked your house and car for insurance purposes, and the design shows it. Bank vaults get broken into much less frequently, since the people that work in such places won't let you sweet-talk your way into the bank.

Re:Yes

[c 0xFF]

All this is fine as far as it goes, but it'll only work until our malicious plugin installer patches the browser binary and makes it skip the key check

The real problem is that we can't even trust the OS to behave. Once that trust is broken, there's really not that much you can do. DRM hits the same wall.

Those that would install "evil plugins" fall into two categories: normal companies and malware writers. If the problem you're trying to solve comes from malware writers (and leaving the Windows == malware discussion aside), then I wish you good luck on some sort of digital signature system.

On the other hand, if you're worried about Microsoft, Apple, and Google then the solution could be much simpler: the court system. (But simpler is a relative term...) At what point would a third-party patch (not just a plug-in) be considered a derivative work subject to copyright laws?

Re:Yes

[mellon]

Yup, using the master password key would solve the problem. However, this only protects people who are smart about security, which is to say almost nobody.

Re:Yes

[mellon]

The key here is "secret." Most people don't notice that they're doing it, so they don't get any bad press. The average user isn't likely to see the significance of the issue unless you take the time to explain it, so the headline by itself doesn't do much damage.

Trojaning the passphrase would actually be criminal, plus it's unnecessary in almost all cases, so there's no point in them doing it.

Re:Yes

[asdfghjklqwertyuiop]

Trojaning the passphrase would actually be criminal

Oh I'm sure the sheysters in their legal department could come up with some weasel words to throw into the license blab to make it "consensual".

plus it's unnecessary in almost all cases, so there's no point in them doing it.

In the hypothetical situation the last poster came up with where some list of authorized plugins is singed or something...

Re:Yes

[RobertM1968]

These dumped extensions can be disabled and uninstalled only from a root account. If you are using a lower privilege account for day to day ops, the uninstall button is grayed out. These extensions are assumed to be installed for "all users" and one low privileged user would/should not be able to take them out. It is a pain to log out, and log in as superuser just to disable one extension that some corporate creep decides to shove on my machine.

Not quite true. Microsoft has disabled the uninstall option for ClickOnce (something since resolved) regardless of account permissions.

Even after that, I've noticed (during a scan with ComboFix) that even after UNINSTALLING .NET CrapOnce stuff, there's a hidden key located on the system still. Is the plugin simply being hidden from the plugins tool in Firefox, or is the key still in Firefox for a different reason?

Considering I was running ComboFix on this machine because of a drive-by exploit that targets .NET/ClickOnce, I'm "not sure" but I have my suspicions. Which brings up the question, "Can a plugin uninstall be faked and the plugin status be hidden from Firefox (whilst the plugin is actually still active)?"

That aside, back to the point at hand: plugin manufacturers can disable plugin uninstallation, regardless of account privileges.

Re:Yes

[mysidia]

I hate to break it to you, but there are worse people than Microsoft, Google, and Apple out there.

Yes, there are. And those people couldn't care two cents about the ability to add extensions to Firefox.

They think in broader terms... capture account information from the computer. Hint: keylogger.
Hint: COM Objects
Hint: Internet Explorer Hacks
Hint: Forcing user to use whatever browser the malware author wants
Hint: Modifying firefox itself in .EXE or in memory, without the need to use any bloody "addon libraries" the browser has control to approve or that Mozilla could add to the blacklist.

Re:Yes

[mysidia]

Your reply is equivalent to arguing that people should be able to leave their houses completely open and unlocked, because it's wrong to steal.

No.. my argument is lock manufacturers should not have to drop some master keying system, just because the local hardware store might make an unauthorized modification to the lock (in the form of keying everyone's lock so the hardware company has a master key that opens all locks).

No... my argument is equivalent to stating that door lock manufacturers should not be forced to stop making thumbturn locks.

Since thumbturn locks can be circumvented by door manufacturers who could include an unauthorized addon to the lockset in the form of an additional hole bored in the door that cannot be secured.

Resulting in easy bypass of the lock, unless there are keyholes on both sides of the door (no thumbturns)

Re:Yes

[DJRumpy]

That doesn't remove the need for updates to Firefox to prevent such an easy hack. It's interesting that the folks at Mozilla are pointing fingers and calling others 'evil' when the flaw exists in Firefox. Simply drop the addon into a folder and it's a done deal. Not exactly the hight of PC security. It should be a simple matter for them to simply have the browser keep the list of 'validated' addons stored away and encrypted. At each launch, scan the folder as it does now, and if it finds a new one, prompt the user to allow it. It doesn't need some complicated enable/disable dialog hidden in some preferences and that already exists for most. This type of simple workaround would work with any addon, including those that have no UI equivalent for enabling/disabling.

Re:Yes

[harryjohnston]

Most of (all of?) these plugins don't "mess with" the Mozilla files. They simply create a registry key, as documented by Mozilla, to ask Firefox to load an available plugin from the associated application. I don't see that they're doing anything wrong, from a technical standpoint at least.

I don't recall Mozilla's documentation suggesting that the global add-on functionality was intended only for sysadmins. Do you have a reference? Are there even instructions for how a sysadmin can use this functionality to globally install an add-on that was designed for individual installation? I thought it was up to the developer to choose between individual installation and global installation.

Re:Yes

[harryjohnston]

I don't believe mainstream software developers would. I think they're currently providing global rather than per-user plugins primarily because that's easier on the average user. For example, most people would find it counter-intuitive to install, say, Adobe Reader, but then have to also separately download and install a plugin for Firefox in order to use it on the web.

In any case, deliberately bypassing an opt-in mechanism would be obviously malicious behavior, and would be stomped on immediately - whereas global plugins have been used for years and this is the first time I've seen anyone complain about the practice (as opposed to certain specific instances of it).

Re:Yes

[AmiMoJo]

So surely then it is at least partly Mozilla's fault. Everyone condemned Windows for blatent stupidity like autorun and setting the default account to admin level, and when other people abused those flaws Microsoft ware held partially to blame. It is even more surprising that Firefox, an internet app, would make the same mistakes as Microsoft did back when Windows was not a network OS, i.e. trusting local software and not even bothering to report when it changes something important.

Re:Yes

[DigitalCrackPipe]

I think both sides should be worked - FF should prevent this kind of thing, and ALL reputable companies should be held to a moral standard to not try shady actions like that. Perhaps if that was the case, any company/individual that tries to circumvent security measures (and that arms race will always have temporary imbalances) should be considered malicious and be flagged by malware software.

Re:Yes

[lpq]

They can't -- Mozilla SW isn't even running when these addons are installed.
The addon's modify mozilla's code-base so it looks like a valid addon from the start. Some of them even make themselves uninstallable (MS)....

There's not alot an application can do to defend itself against the people who wrote the OS...

Re:Yes

[man_of_mr_e]

That's a cop-out.

Mozilla provides only one way for plug-ins to be installed by third parties, and that's the global plug-in folder. If Mozilla created a way for plug-ins to be installed via installer (rather than through the plug-ins dialog) that allowed users to opt-in or out then Apple, Microsoft, and Google would likely use them.

Re:Yes

[man_of_mr_e]

That's ridiculous. Mozilla provides no way to install plug-ins in any other way (other than user going to the plug-ins dialog and searching for one to install, not practical for many situations such as those where you install Java, Acrobat reader, etc..).

If Mozilla provided a way for them to do it nicely, and they went around it anyways that's one thing. But to not do it because they claim they won't use it and will bypass it is just plain whining.

Re:Yes

[asdfghjklqwertyuiop]

Re-read. I did not say that Mozilla shouldn't provide an automatic plugin installation method because it would be bypassed. I said it is impossible for Mozilla to _prevent_ automatic installation of plugins.

Re:Yes

[mysidia]

Mozilla provides only one way for plug-ins to be installed by third parties, and that's the global plug-in folder.

Yes, and there's nothing forcing or encouraging third parties to just drop files there without the third party implementing a proper installer.

Re:Yes

[Karellen]

it'll only work until our malicious plugin installer patches the browser binary

Um, that's why as a user you don't have write access to installed binaries, and binary images are loaded by the OS into write-protected memory regions, which is enforced by the CPU.

anti-trust!

[alphatel]

But MS, G and A all have our best interests at heart. No program should be able to circumvent this explicitly allowable behavior!

Solution: Warning box

[GodWasAnAlien]

Warning: A third party plugin, PluginNameHere, has been installed without user consent:

DELETE KEEP

Re:Solution: Warning box

[X0563511]

That verbiage is bad. You can't know if it was with consent or not.

Re:Solution: Warning box

[baka_toroi]

"Son, what should I do?" I will remember you forever when my mom calls me about that dialog box. Thank yo, GodWasAnAlien (BTW, don't you mean "Christ"?)

Re:Solution: Warning box

[thePowerOfGrayskull]

You could if you tracked which ones were installed through the browser, vs which ones simply showed up in the plugins directory and were never 'approved' by the user. It doesn't seem difficult.

While you couldn't offer to delete them (because priv acct might be required) you *could* only enable them after explicit user approval.

Re:Solution: Warning box

[Darkinspiration]

So, hum never install any software ?

Re:Solution: Warning box

[X0563511]

Yea, or.. you know, a fucking checkbox or Y/N question during some install.

Re:Solution: Warning box

[X0563511]

I'm just saying the wording was bad. Just find a more neutral way to say it, is all I meant. (something like "the addon 'SuperHappyKittySearchbar' was installed in an unusual manner. Do you wish to enable it?")

Re:Solution: Warning box

[d3ac0n]

The thing is, nontechnical users don't WANT "neutral" verbiage. Part of the problem with many computer dialogs is not that they don't make sense, it's that they don't help you assess the VALUE of the warning they are giving.

Since most computer users don't have a frame of reference or knowledge from which to assess the value of warnings they receive, we have to supply that for them in the dialog message.

I think that we can all agree that installing something, ANYTHING, into our browsers without explicit user permission is BAD. Thus, the warning should reflect that. An overly neutral warning will just produce, at best, confusion and at worst, blind "yes" clicks.

Something along the lines of: "Alert. The following add-on [name of add-on] was recently installed without your explicit permission by [program] Do you wish to approve or deny this plugin access to Firefox? [approve] [deny]"
  Is far more useful to the average user than your "neutral" message.

Re:Solution: Warning box

[Chelloveck]

You could if you tracked which ones were installed through the browser, vs which ones simply showed up in the plugins directory and were never 'approved' by the user. It doesn't seem difficult.

How does the browser track this, and where is that tracking stored? What keeps the plugin from spoofing the tracking record to make it look like the plugin was in fact approved? In other words, how does the browser trust its own record of which plugins have been approved?

If it doesn't seem difficult, then you're insufficiently devious. :-)

Re:Solution: Warning box

[thePowerOfGrayskull]

True. The originally suggested wording is a bit confusing.

Re:Solution: Warning box

[Stray7Xi]

Warning: A third party plugin, PluginNameHere, has been installed without user consent:
DELETE KEEP

And if you click Keep, you have to save that setting somewhere. If I'm going through the trouble to do an plugin install (for the good of my users of course) why would I not save that setting (it saves my user a click). If someone wants to add a toolbar to firefox they will make it happen. They'll patch the binary, they'll clobber configs or setting files. Why? they're doing it for the users of course. Those users want your dancing hippo buddy and why should a bunch of unix hippy nerds stop them.

Keep in mind, toolbars existed before browsers implemented toolbar capability. They didn't do it by cooperating with the browser.

Re:Add Yahoo as well

[PNutts]

Just last night I was testing something that required Yahoo messenger. After accurately deselecting all the various optional bullshit software it still installed the fucking Yahoo toolbar and who knows what else. What a scam.

I installed Yahoo! Messager last week and it did not install anything I deselected. But since you posted as AC all I can say is you did it wrong.

Don't stop them from adding, auto remove...

[gurps_npc]

Not that difficult to code in a startup screen "X addons installed since last restart. Should I remove?"

Re:Don't stop them from adding, auto remove...

[Anonymous Coward]

One could write a plugin that does just that!

Re:Don't stop them from adding, auto remove...

[gurps_npc]

A plug in to detect plugin changes and ask to remove them? Sounds like a good idea to me. Of course, the pop up should have an optional auto-cancel itself if you don't respond to it within 5 seconds.

Re:Don't stop them from adding, auto remove...

[Anonymous Coward]

How would you prevent, say, Microsoft, to write into the file which keeps track of the changes in the plugins?

Re:Don't stop them from adding, auto remove...

[MobyDisk]

Only slightly less difficult than that, is making the installer mark the add-ons as already approved. Even so, it is still a good idea because while installing a plug-in without permission is a gray area, pretending that the user clicked "yes I want this" when they didn't is probably illegal.

Re:Don't stop them from adding, auto remove...

[tokul]

Not that difficult to code in a startup screen "X addons installed since last restart. Should I remove?"

IMHO plugin can modify user preferences and hide the fact that it is newly installed.

Re:Don't stop them from adding, auto remove...

[skiman1979]

The problem with that is, what about the time between install and auto remove? Perhaps a plugin could be written to do the "bad" things it needs to do quickly before the user has a chance to see the prompt and click 'remove'. I shouldn't have to let a plugin get installed on my system, see it, and remove it. Just don't put it on there in the first place.

Re:Don't stop them from adding, auto remove...

[BitZtream]

How are you going to mark your plugin as 'approved' when it requires a digital signature to be added to the list of approved plugins for the plugin you want approved? The only way to add the digital signature is with the encrypted private key, which requires a password to do so?

No digital signature? Warn the user and sign if its okay, or throw the plugin out, or whatever the user wants.

Its really not difficult, it just requires that you don't store some vital piece of information in a way that other software can access it without the users permission.

Kind of how OS X and Windows already have provisions for prompting users to allow changes rather than allowing them to be changed by any app. Those OSes both have protected storage mechanisms that apps can access only if the user authorizes it using built in mechanisms that applications can't access directly themselves.

UAC prompt to the rescue.

Re:Don't stop them from adding, auto remove...

[gurps_npc]

Use the DMCA in some way. Not that hard to copyright part of the file.

Re:Don't stop them from adding, auto remove...

[spauldo]

Easy. Use a mork format file.

Re:Don't stop them from adding, auto remove...

[MobyDisk]

You certainly could do that. A fair bit of work, especially in a cross-platform application. But then again, I don't know if this problem exists outside of a Windows world (yet).

Isn't the real question...

[Anonymous Coward]

...why is your software so crappy that it allows anyone to install plugins without notifying the user?

people don't seem to mind

[Anonymous Coward]

One thing I've slowly come to realize is that most people do not mind a big company or other entity controlling their computers. They're quite happy to run javascript trackers, download web bugs, run any executable without knowing whether it's safe, and so on.

Many of us here have an aversion to these things. If we see a plugin installed without our permission, we'll figure out how to remove it. But most people do not place any value in having control over their own hardware, so they see no value in doing that.

The end result of this is going to be a highly controlled internet, because the number of people who care about its freedom and openness is very tiny compared to the number who don't. The market forces will decide, and those are clearly on the side of the "you may control my computer in any way you want, Mr Multinational Corporation".

PS - my CAPTCHA for this message was "disallow".

Re:people don't seem to mind

[spacefiddle]

I would alter "do not mind" to "have no clue and don't understand the potential implications of." The end result will be a highly controlled everything, because people are neither taught nor encouraged to think about things that don't relate to their immediate button-pushing responsibilities, coupled with a fair amount of casual despair about having any control over their own lives.

Most enduser types I've talked to about such things tend to give me lines like "Ah, none of this stuff affects me," "Whaddyagonna do, they'll do what they want anyway" and "Pfff, they wouldn't do anything really bad."

Re:people don't seem to mind

[erroneus]

There is much truth in what you speak here. But it gets worse.

Turns out that this is all done because Apple, Microsoft and Google (and more) have all done studies to determine the preferences of most users. The goal is to make things easier. It doesn't matter if easier makes them more vulnerable, easier is preferred by the general public. (Now if only the TSA and government would get this message! We don't care to be "safer" if it's inconvenient!)

If they have to be bothered to install or even be prompted to install things, this will add to the level of frustration a user will experience.

Does anyone remember the period of time in which you could hear the words "computer illiterate" spoken with a certain level of pride? "Oh, I'm computer illiterate..." Seriously? It's true and there is still a small number of people out there who wear their ignorance as a badge of honor. We have a HUGE world of user psychology to overcome before we can get to a place where people are aware and cautious.

For the moment, "ignorance is an excuse" for the problems they experience. If they actually take control of their own machines and something bad happens, it becomes THEIR OWN fault which is a responsibility they do not want to accept. It is far easier for them to curse and blame the faceless others out there rather than blame themselves for their own lack of interest.

TL;DR? Users want to blame anyone but themselves when they have problems. If they learn anything, it becomes a burden of responsibility they simply do not want.

Re:people don't seem to mind

[shadowofwind]

Many of us here have an aversion to these things...But most people do not place any value in having control over their own hardware...

People are that way about what they ingest into their bodies also.

Re:people don't seem to mind

[Anonymous Coward]

The CAPTCHAs are themed to the article. Slashdot has been doing this for a long time now. People like you keep posting their CAPTCHAs as if it is some humorous and unlikely coincidence that the word has a contextual applicability to the article topic.

This is on purpose. The system is explicitly designed to do this. Stop acting surprised.

Re:people don't seem to mind

[Anonymous Coward]

Last week, after setting up a new HP box for my dad, I became convinced that the reason so many people fall for malware scams is because they never get to see a clean system to begin with.

The boxes come preloaded with absolute filth.
Major software packages sneakily adds more filth.
How are users supposed to tell when a new malware toolbar suddenly shows up? Or a fake virus warning?

The amount of garbage on that HP was astounding.

Re:people don't seem to mind

[mlts]

From what I see with dealing with users, it is less despair, but more than a nonchalance of "this is just a machine, why can't I push a button and have the pr0n pop up for me to ogle?"

Companies know this. Google has this user designed exactly in mind when designing ChromeOS (where the user will never have root on the desktop.)

I fear this path, although it is forced upon us in some ways by users who have zero interest in security and who then complain to companies (and Congress) about the lack of security in products. I wonder in 10-15 years, that having a "#" prompt on the desktop would be as much a memory as being able to desolder through-hole ICs without a wave soldering station so a whole board wouldn't need replaced because of one bad chip.

Re:people don't seem to mind

[BitZtream]

Most people place less value on 'managing their computer' than they do on 'living their life', that I'll agree to.

Saying people place no value in having control over their own hardware is retarded. You have 0 control on how your processor operates internally don't you? Or do you work for Intel or AMD and have some sort of direct control over it?

Most people don't care about what slashdot users care about. A 'perfect computer setup' is not anywhere on their list of priorities, which I realize is completely blasphemy to most slashdotters, but the reality of it is, most other people have other things in their lives that they value more than dicking around with their PC.

You place a high value on controlling your PC, they place a high value on something else.

You live in a hypocritical fantasy where you pretend you have complete control over your PC, while you utterly ignore all the aspects of it that you have absolutely no control over.

Re:people don't seem to mind

[drcheap]

You live in a hypocritical fantasy where you pretend you have complete control over your PC, while you utterly ignore all the aspects of it that you have absolutely no control over.

The difference is that he isn't moaning about how he wished the processor wouldn't stop making "assumptions" about the order of instruction execution and such. Yes, we have "no control" over the internal functions of our hardware, but we aren't complaining about it left and right.

Perhaps a closer analogy to the subject of TFA is if your GPU was going around and shoving random bits into your RAID cache slowing down and/or corrupting your disk transfers. You sure as hell wouldn't be happy about that, and would probably begin to dislike the GPU vendor for having such bad actions, and the RAID vendor for allowing it to happen.

Re:people don't seem to mind

[mcgrew]

You place a high value on controlling your PC, they place a high value on Lindsay Lohan's drug problems.

Look, people know that they have to change their car's oil and have routine maintenance, even if they have no clue how an internal combustion engine works. It's our job to educate them about their computers, just as it's a mechanic's job to make sure their customers know that not changing their oil will screw their cars up.

most other people have other things in their lives that they value more than dicking around with their PC is why they take it to the Geek Squad, or call you.

They want their computers like their cars -- they want it to perform its function with a minimum of hassle.

Oh okay, but what about Mint

[SmallFurryCreature]

The Mint Linux distro installs a default custom search that not only removes a lot of functionality from google but also takes up half the page size on a 12.1 inch netbook with a plain ugly design, just to make some cash. Fixing it is possible but come on! I donate cash already to various projects, but Mint can kiss my hairy ass. I need that left column in Google search because else it gives me results from the beginning of the ice age on any query related to current events.

But companies just can't accept that we don't want their crap. Especially American companies. Please ATI, I know about WoW, if I wanted to play it, I would have played it by now. So stop trying to slip the trial on my gaming machine. No thanks MSI, I do NOT want a dumb virus checker with my windows, I do not even want windows. And if I want games I get the one with my ATI card not some god awful free game with god knows what installed along with it.

I would love to serve one of the execs.

Bill Gates: "One milk shake please"

Me: *FAP FAP FAP*. *HATCHOO*. *SPIT*.

Me: "Sure, and enjoy the free extra I added in regoniztion of the quality software you shovelled on me."

Anyone knows if the McD at Redmond is hiring?

Re:Oh okay, but what about Mint

[drachenstern]

So your aspiration in life is to work at McDonalds and hope to serve Bill Gates? Wow, what an aspiration...

Re:Oh okay, but what about Mint

[Windwraith]

Why Bill? Didn't he retire?
Perhaps more can be read on the fact that you want to feed Bill Gates your seed, though...*cough*

Re:Oh okay, but what about Mint

[couchslug]

"But companies just can't accept that we don't want their crap. "

Yeah, I hate all that unwanted shit Debian installs. Oh, wait....

Re:Oh okay, but what about Mint

[slackbheep]

Clearly you didn't see the genius of his plan, once he gets Gates pregnant: BAM.

Re:Oh okay, but what about Mint

[slackbheep]

Actually he and his wife have given a couple talks at TED (TED.com) about the foundation he and his wife have setup.
http://www.ted.com/speakers/bill_gates.html and http://www.ted.com/speakers/melinda_french_gates.html for reference.

Re:Oh okay, but what about Mint

[internewt]

I would love to serve one of the execs.

Bill Gates: "One milk shake please"

Me: *FAP FAP FAP*. *HATCHOO*. *SPIT*.

Me: "Sure, and enjoy the free extra I added in regoniztion of the quality software you shovelled on me."

Anyone knows if the McD at Redmond is hiring?

The jingle from the CrackDonalds adverts that goes "du du du da da, I'm lovin' it" also fits perfectly with "du du du da da, There's cum in it". And is probably much more descriptive.

Hell, a mate of mine swears a local SmackDonalds was closed down after Trading Standards found semen in food from the place (allegedly 7 different peoples'). I have tried to track the story down, but there doesn't seem to have been anything in the press about it, so I count it as an urban legend.

But I bet there are rumours like that about WhackDonalds all over the world! And lets be honest, WankDonalds is hardly the kind of place where employees are likely to have job satisfaction, and so someone ejaculating into a FuckMuffin is more than plausible.

Re:Oh okay, but what about Mint

[Jah-Wren Ryel]

Actually he and his wife have given a couple talks at TED (TED.com) about the foundation he and his wife have setup.

Yeah, he went from being the 800lb gorilla in computers to being the 800lb gorilla in charities.
I predict the same level of destruction to that ecosystem too.

Misread title

[Anonymous Coward]

When I read the title I understood: "Apple, Microsoft, Google Attacked by Evil Penguins ". I should not have tried to read it again, it completely destroyed the original effect.

Re:Misread title

[o'reor]

Ditto ! I need more sleep...

Re:Misread title

[drcheap]

I read that as "Ditto ! I need more sheep..."

And I read penguins at the home page, too.

It's definitely a Monday.

Re:Add Yahoo as well

[Bert64]

As a long time user of third party instant messaging clients, i was horrified to see just how much crap comes with most of the official clients for the various IM networks...

Beyond Firefox

[Amorymeltzer]

As a Mac user, I don't have to deal with Microsoft's stuff, and I haven't really noticed anything shady from Apple (maybe because my iTunes was grandfathered in?) but the fact that Google forces me to install a Google uploader daemon as part of Google Earth means I won't upgrade the software, and haven't for the past few years. Things like this need to be optional - don't make us choose between an unhappy version of software or none at all.

Re:Beyond Firefox

[Tridus]

Apple does the same stuff on Windows. iTunes wants to install an apple updater, Quicktime, and Safari (but you can turn Safari off).

They're not yet at the Adobe level of evil though... "hey lets install an addin before we let you download our software! Yeah, that's genius!"

Re:Beyond Firefox

[Amorymeltzer]

Good point, and now that I think about it OS X has some of that as well. I've always felt that Apple software relies too heavily on Quicktime, and I had to delay updating things like iTunes or Safari simply because I refused to download the Quicktime update that broke Civ4.

Re:Beyond Firefox

[phyrexianshaw.ca]

Try buying google earth.

THEN allow/disallow whatever part of it you don't like. till then, either use the free software or don't: it's up to you.

Re:Beyond Firefox

[Rockoon]

Dont forget that all Apple software stealthily installs "Bonjour!" on windows.

Re:Beyond Firefox

[EvilMonkeySlayer]

Actually, if you go to the google earth download page undernearth the TOS there is an "advanced setup" option that expands to some tick boxes you can untick to download a version of google earth that doesn't include the horrible updater and a version that doesn't require admin rights that can install to the users directory.

Re:Beyond Firefox

[Binestar]

Hint: ftp://ftp.adobe.com/pub/adobe/

Re:Beyond Firefox

[chemicaldave]

As a Mac user, I don't have to deal with Microsoft's stuff, and I haven't really noticed anything shady from Apple (maybe because my iTunes was grandfathered in?) but the fact that Google forces me to install a Google uploader daemon as part of Google Earth means I won't upgrade the software, and haven't for the past few years. Things like this need to be optional - don't make us choose between an unhappy version of software or none at all.

Any slightly savvy user can just disable any unwanted processes associated with installed software, i.e. googleupdater, applemobiledeviceservice, etc. Then just start them when you want an update or whatever it is you need to do.

Re:Beyond Firefox

[joeyblades]

Under what conditions? Windows 7 only? I have QuickTime, Safari, and iTunes all installed under XP, but no Bonjour...

Re:Beyond Firefox

[Rockoon]

It is normally named mDNSResponder.exe, because thats the way apple rolls with its Bonjour! service.

Re:Beyond Firefox

[joeyblades]

That is "stealthy"... or rather, would be... I don't find mDNSResponder.exe installed either... However, Googling, I see that it's the key to iTunes library sharing functionality, which I deselected/disabled in my initial configuration, so maybe that's why it never got installed.

Nevertheless, I'm not a big fan of stealth installs, which a lot of software does. That's why I keep a regular watch on my installed programs and services, especially after I add something intentionally, to make sure I didn't add something unintentionally.

Re:Beyond Firefox

[walshy007]

yes, Rockloon, Zeroconf networking is in fact a nice thing to have if you want to write applications which discover other apps/devices/services across a LAN without the need for the user to configure anything

Not if the computers on your lan are on multiple subnets.

Re:Add Yahoo as well

[Monkeedude1212]

Maybe in his configured UI the Checkboxes were actually X's - and he thought an X beside the item means "Do Not Want" - a common mistake when using X-indicative checkboxes.

But really, it's no different than when I want to Install Adobe PDF Reader and work, and it's all "Hey, do you want the Google Toolbar? I'll just go ahead and check the box for you. I know that you waste a fraction of a second each time unchecking that box, and that frustrates a lot of IT professionals, but thats just how I roll. I mean, IE already has a built in "Search Bar" which most people who use Google will switch it to google instead of Live search, but the important thing is to find all the technically illiterate masses who use computers and make sure they have the Google Toolbar so they use Google more. God forbid if they don't like Bing as their default search provider they actually set Google as their home-page and just use Google anyways - THEY NEED THAT TOOLBAR.

Honestly, I used to be completely and utterly serenely happy with Google. They provided just the right services I wanted and genuinely stayed out of my way. I didn't really care if they were collecting information on me, they were so clever about it I didn't notice.

But nothing makes me angrier than this silly ridiculous "Add My Browser Toolbar" Bull that ALL these companies are working together on. I mean, if you already have the google Toolbar installed, instead of asking you if you want it again, Adobe Reader Installer knows that and will ask "Hey, do you want this free version of Norton?" Seriously? As if cramming 1 optional program down my throat was bad enough.

Has anybody tried uninstalling and Re-installing adobe reader with all of the Auto-Opted-In "Side Packages" to see exactly how many companies have kissed Adobes ass? I'm now curious but I wouldn't want to do it on my machine. (I totally need to virtualize my workstation...)

Re:Not to mention Adobe and everyone else

[Yvan256]

Because Adobe are extremely confident in the security of Adobe Reader?

Why is it called Adobe Reader anyway? Can it read PSD and AI files too?

Bill Gate != Microst anymore. Re:Oh okay,

[140Mandak262Jamuna]

Bill Gates: "One milk shake please"

Guys, it is time we quit picking on that pitiable guy. Was bad, was responsible for (what passes for) culture in Microsoft. But that was a long time ago. May be he did not know the evil he was unleashing on computers. But now he is mostly out of Microsoft and is trying atone for his sins by spending his money in charity.

Re:Bill Gate != Microst anymore. Re:Oh okay,

[imakemusic]

But that was a long time ago.

I still have to fix IE6 bugs.

The vast majority of companies still use Windows PCs, largely due to the lock-in which started in Bill's time.

Gates may no longer be in charge at Richmond but the effects of his thirty-odd years leading one of the most powerful tech companies in the world will be felt for a long time yet.

Microsoft, Apple and Google

[bradgoodman]

See no evil, Hear no evil, Speak no Evil

Re:Microsoft, Apple and Google

[ArsenneLupin]

Indeed. We want to keep our Firefox like it is! We don't want it to become Internet Explorer, Safari or Chrome!

So because Mozilla's security model is flawed

[hsmith]

It is the fault of others for exploiting it?

Now, I am not saying Apple/Google/MS are in the right here, but Mozilla shouldn't allow just anyone to install extensions.

How about they fix their exploits instead of pointing fingers.

Re:So because Mozilla's security model is flawed

[Lundse]

Yes. It is the other's fault.

The human body is very easy to puncture with a knife, this does not make slashing open your neighbour OK.
Cars can drive beyond the speed limit, houses can be broken into, people can be swindled, telephones called by telemarketers, etc. etc.

None of this makes it OK to do any of these things, and just because Firefox is built around a certain design principle (that it should be easy to modify) does not make it OK for others to modify it against the user's wishes.

Re:So because Mozilla's security model is flawed

[amRadioHed]

Agreed. This is a social problem, not a technical problem. As long as you can back up your home directory and restore it to your new computer without having to reconfigure your browser then any installer will be able to do the same. It is good that this can be done, companies just need to stop abusing it.

Re:So because Mozilla's security model is flawed

[VortexCortex]

It is the fault of others for exploiting it? ...
How about they fix their exploits instead of pointing fingers.

IMO, this is not an "exploit". Dropping files into the plugins directory is easy by design.

Unwanted application side-effects are the fault of our current computing model whereby any application can see and touch any other application's junk.

To stop this sort of thing we need to change our application model to a sandboxed one, such as: *nix chroot, Android, iOS, etc. I really like Android's "Intents" (Applications can have a public API for talking to other applications).

The real issue at hand is that applications have access to data that we may not want them to access. Currently there is no option to tell our desktop OSs that we want all applications sandboxed, and any cross sandbox activity must be approved by the user.

With a sandboxed approach it will still be simple for the OS, users or developers to drop files into an application's plugin directory.

I can't trust that all applications will strictly follow the Filesystem Hierarchy Standard, and stay out of places they don't belong. Until then I'll keep using the chroot command and/or Virtualbox to create my own sandboxes.

Re:So because Mozilla's security model is flawed

[harryjohnston]

They are using a documented mechanism provided by Mozilla to install global add-ons. They aren't circumventing anything.

Re:So because Mozilla's security model is flawed

[Geminii]

However, this doesn't mean it's a good idea to use skinless bodies, brakeless cars, houses with huge holes in the walls etc. Just because people 'shouldn't' do things doesn't mean they won't - and it doesn't mean that other items in the environment won't cause more unintentional damage to things which aren't protecting themselves, either.

Re:So because Mozilla's security model is flawed

[Lundse]

All true.

Of course Mozilla has to make some judgement call here; openness/ease or security (from installers granted filesystem access).

And I for one do not want a world where every house is an armed fortress, nor one of paranoid software that has to assume even root is up to no good.

But you are all too right. Doesn't mean MS, A and G aren't to blame :-)

that's the price of popularity

[bl8n8r]

when you have 300 jillion people using your product, you can afford not to care.  No it's not fair, but that's capitalism.

Re:Uhh...

[clang_jangle]

Quiet, you! OS X users have enough baggage to schlepp as it is, without your clueless rating.

And

[ISoldat53]

Make it easier to remove them.

Why does FireFox allow install without confirm?

[theNAM666]

I'm repeating what someone has already said-- but why do we not have reasonable protection (security) against this, at the browser level?

Re:Why does FireFox allow install without confirm?

[Enderandrew]

All Firefox does is scan a directory for extensions. Anyone can write to your profile even when the browser isn't running. You just need to dump files there. How can Firefox protect a directory when Firefox isn't even running?

If extensions were handled 100% through an online Mozilla service, then no one could touch that. And your extensions would travel from computer to computer.

Re:Why does FireFox allow install without confirm?

[Enderandrew]

An insightful post from an AC?

Re:Is this guy on crack?

[Haedrian]

Not really.

I installed skype the other day and I got a plugin for firefox automatically - no choice to not have it installed. Will I use it? Nope.

Remember the days when people would install toolbars on your PC? This is just like it. Plugins do help the experience - but only if I want them to. I don't want my browser checking for updates to Google Earth, or having quicktime stuff installed.

Google but not Adobe?

[Enderandrew]

I have Google Chrome and Google Earth installed. I don't have any Google plugins installed in Firefox. So I'm not sure what he is talking about, unless something changed with Google Earth recently.

Adobe demands to install an extension just to let you download Flash, because downloading normally is out of the question.

Microsoft is the worst offender here, where they use Windows Update to push a Firefox .NET Assistant extension, don't ask your permission, and don't allow you to remove it.

Re:Google but not Adobe?

[tokul]

Adobe demands to install an extension just to let you download Flash, because downloading normally is out of the question.

http://fpdownload.adobe.com/get/flashplayer/current/install_flash_player.exe
http://fpdownload.adobe.com/get/flashplayer/current/install_flash_player_ax.exe
Try to avoid installing Adobe download manager harder.

Re:Uhh...

[Lundse]

Ignore the dir, but use another one? And what will MS, A and G do next?

Non-standardisation as a way to make it harder for others to do something to your installation is... just not the way to go.

Others respecting the standards would be preferable. I shouldn't have to not pick up my phone until the third ring to make sure no telemarketers got through - telemarketers should stop calling.

Firefox Plug-in Support

[@madeus]

Interestingly, from the PoV of a plug-in developer, I have found Firefox has possibly the most annoying environment to deploy plug-ins in. Granted it's open, and uses the NPAPI naturally - (as do Safari, Chrome and Opera) but how the browser handles installations and in particular upgrades makes it very annoying, even compared with MSIE and their ActiveX approach (and that's even given IE doesn't have a working navigator.plugins implementation).

Of all those browsers Firefox (on Windows) is the only one that requires that if you upgrade your plug-in it is not enough to increase the file version and rename the DLL and then register that with Firefox, you also have put your new DLL in a directory that has a name it hasn't seen before (e.g. including the file version in the directory name) because it refuses to look for a new DLL in a directory it thinks it's already looked in for plug-ins. You then need a JavaScript shim to refresh and check it's upgraded.

Even with MSIE all you have to do is give the control a new GUID (which is not unreadable).

Note: The official Firefox line on this is "you should always restart the browser after installing an upgrade to a plug-in". This is what their API for installing plug-ins does (or one of them, they have two, and have deprecated one in favour of combing it with the same installation method as for extensions now, but that and the quality of the documentation is a whole other issue).

Technically, no other browser documentation suggests or requires that and logically there is no good reason to need it. It listens to Restart Manager message (in Vista/Win 7) but you need to suppress those when upgrading because Firefox will invariably display a dialog then crash instead of restarting when it sees an upgrade is happening.

They also have odd rules like "the plug-in file name must begin with 'np' and the filename must be 8.3 format" (thought the documentation just seems incorrect on the latter - and would be super-inconvenient given you need to prefix it with 'np' and include a release number in the filename).

Lastly, Microsoft & Google both install "ClickOnce" and "GoogleOneClick" which, while not the same, perform not dissimilar functions, which kind of hints a market demand for a specific set of functionality.

That Microsoft include a ClickOnce plug-in is actually very helpful for Firefox in the enterprise. Apart from being a very cool and useful deployment mechanism on Windows (that in theory is a lot safer than having everyone always have to run apps with full user level privileges), Firefox doesn't current offer anything that could be an alternative (in either of it's two installation API's) and without it internal IT software teams would, I'm sure, just say "you need Internet Explorer to use that intranet app / HR tool / customer support tool / etc".

The best way to address the perceived problem of "sneaky plug-in installation" is for the Firefox team to come up with a decent, user friendly way of installing (& upgrading) and allowing plug-ins to work that doesn't suck (i.e. no yellow bar along the top [ awful usability ], and certainly no browser restart required). Something like a one-time dialog box displaying the digital signature details of the plug-in on first-run would work for everyone.

* I know most plug-ins, including Flash, suffer from requiring mandatory browser restarts and yellow bar popups, no I don't know why (other than they suck at writing installers). Especially in IE (which is evil in not supporting NPAPI, but *is* fairly well documented).

Re:Firefox Plug-in Support

[@madeus]

Not unreadable? == Not unreasonable

Re:Firefox Plug-in Support

[0123456]

I know most plug-ins, including Flash, suffer from requiring mandatory browser restarts and yellow bar popups, no I don't know why (other than they suck at writing installers).

Really? On Linux I just kill the Flash process and Firefox restarts it with the new plugin when required.

Re:Firefox Plug-in Support

[Aldenissin]

Have any alternative ideas to the yellow bar of poor usability?

Re:Firefox Plug-in Support

[@madeus]

Yes really, with Firefox on every operating system you must restart the browser after upgrading an existing plug-in, that is what the documentation says... as I say, unless you fudge the installer (killing an active process also counts as 'fudging the installer' by any definition). However. MSIE, Safari and Chrome have no such issues handling upgrades, as they have better plug-in handling in that regard.

Shift-refreshing a page with the plug-in multiple times (and interrupting plug-in loading the process) will also cause Firefox to falter and reload a plug-in (but simply calling navigator.plugins.refresh or refreshing about:plugins will not).

Re:Firefox Plug-in Support

[@madeus]

I do. I think requiring a Digital Certificate on all plug-ins then displaying a Microsoft ClickOnce type dialog (name of the application / plug-in, certificate owner, etc) and a "Do you wish to allow this plug-in to run?" message on first run. I guess it's about the same as the popup for permission request from a signed Java applet (only the latter is a bit horrible).

Possibly options could be something like "Yes, Always", "Yes, On This Website" (domain based?) "Not Now" and "Never" (Uninstall/Disable) if a user friendly dialog with enough useful options could be devised.

Coupled with an easy-plug-in installation API this would kick ass. I think the Firefox Extensions installation API (which is what they are now saying Plug-in developers should use, since FF ~3.6 I think), is good, and maybe just insisting on a first-run popup for plug-ins installed not using the API would promote both use of the API (even if it's not great - hopefully they can improve it) and keep potentially malicious plug-ins in check.

I would say that better enduser plug-in management interface would be nice too. Firefox is pretty good at this (better than all the other browsers I think), but could still be improved a little. MSIE, in particular, really sucks at this (not so much as an about:plugins - and it has an Extensions/Add-On manager, but things that are only plug-ins are not listed *anywhere* visible to the user, other than by looking in the registry).

Re:Add Yahoo as well

[amRadioHed]

Maybe in his configured UI the Checkboxes were actually X's - and he thought an X beside the item means "Do Not Want" - a common mistake when using X-indicative checkboxes.

Really? I find that a bit surprising. In all my years I've never encountered a single person who was confused by what an X in a box means, not in computers or in the real world where the practice is just as common.

Re:Is this guy on crack?

[Lundse]

Most users (99.99%) "want" the plugins...

No. They want the program that installed the programs against their wishes and without their consent.

The 0.01% who don't are either idiots or live in a mental institution with an aluminum foil hat on their head to keep out the alien and CIA transmissions from their brain.

People who do not want Windows Live Photo Gallery or the Google Update plugin are certifiably insane? Really?

If you think this stuff is evil, sell your computer and stay off the internet.

So I should stop using a phone altogether because I think telemarketers are bad? Or does your reasoning only extend to computers and/or stuff you personally happen to like and want?

Re:Not to mention Adobe and everyone else

[GIL_Dude]

Interestingly, seeing this reminded me that I had planned to install Adobe Reader X. I just went and did that and this time it didn't offer me or attempt to foist off on me any additional crap like the McAfee scan or any toolbars. It also didn't try to install any stupid down loader application. I thought perhaps Adobe was seeing the light for once. So I went back and checked again and found that they don't foist extra stuff off on you if you are using Chrome. If you are using Firefox or IE, they try to foist crap off on you (like the McAfee scan). Perhaps this just means they haven't developed any junk down loader add-ins for Chrome yet.

Re:Add Yahoo as well

[Monkeedude1212]

Common might have been too strong of a word.

I've seen it happen, more than thrice, lets just put it that way.

Because Windows Update has higher privileges

[Animats]

It's hard to fight Windows Update.

Neither Windows nor Linux has per-application compartmentalized security. In theory, you could use something like SELinux to give each vendor their own compartment, preventing an install from vendor A from affecting an install from vendor B. But the installers would have to be aware of this, and carefully stay in their own spaces, or installations would fail. Nobody does that.

(Someday, somebody is going to crack the signing key for Windows update, hijack a router to reroute Microsoft's IP address, and take over every Windows machine in the world.)

Re:Because Windows Update has higher privileges

[drcheap]

(Someday, somebody is going to crack the signing key for Windows update, hijack a router to reroute Microsoft's IP address, and take over every Windows machine in the world.)

Why go through all that trouble when it's so easy to just take the boxen over directly and form a botnet?

It's not just Firefox Plugins

[s7uar7]

I installed iTunes on XP and ended up with about 4 services, a startup entry and an Outlook Add-in (that stops Outlook closing properly, incidentally). WTF does does iTunes need an Outlook Add-in for?

Re:It's not just Firefox Plugins

[Technician]

Apple has been up to those types of hitchhiking installs for a long time. As a Winamp fan, I didn't need itunes at all. I wanted to install Quicktime. For a long time it was not available from Apple without the iTunes installer as part of the package.

I just checked their website to see if this was still the case. They fixed it. You can now get Quicktime with or without iTunes included. The without was not an option a few years ago.

You can see your choices on this download page.
http://www.apple.com/quicktime/download/

Re:It's not just Firefox Plugins

[StuartHankins]

To sync with your Outlook contacts. And, BTW, that's actually Microsoft's sync code that Apple licenses.

Re:It's not just Firefox Plugins

[CyberDragon777]

WTF does does iTunes need an Outlook Add-in for?

Probably to append "Sent from my iDevice" to the end of every mail sent. :)

Re:Solution: Warning box - not so easy

[ratboy666]

Let us look at some use cases -

System plugins in central directory, firefox starts. This is the case after creating a new user, or wiping the firefox local directory, or after a typical install. In this case you don't want endless nattering, because it is just too confusing.

If yum or apt is used to install new software, that software was usually installed with root privilege. It can just drop the new plugins into the central directory, and you are basically at the first point. And, as a "bonus", these plugins are system-wide and apply to all users.

If a local install installs a plugin into the local directory (without have firefox running -- there will not be an API), then the usual is to expect that this action was desired by the local user. However THIS can produce a popup if the local plugin was not installed by firefox.

Its just that most external installers will simply opt to drop the plugin into the system directory (I believe that's where the google toolbar goes -- I could be wrong though).

Or, an API could be generated to force the registration of plugins; the question still remains as to whether the local user should have any say about global plugins (actually, the current policy is to allow the local user to disable, but not delete). Now, the root user may not even exist in a normal Unix sense -- all root-ish stuff could be going through sudo... in which case how is the effective "root user" to be informed of these installations?

In a nutshell -- hard crypto to detect a plugin install EVEN IF DONE BY ROOT. Local comparisions to determine changes -- STILL NOT EFFECTIVE IF A FRESH INSTALL STATE IS ACHIEVED.

And a fresh install state? Assuming that you STILL want bookmark and history portability, this is simply the result of removing a few local files.

So -- if a new plugin is detected on startup, or a fresh install state is detected, a popup can be initiated that would allow enable/disable of plugins. Given, though, that the typical user won't know WHICH to select, it's a complete waste of effort. Might as well just have a script that looks at the plugin locations and reports (a GUI can add NOTHING of value here).

Which is exactly where we are today.

It's more than just add-ons

[PORNorART]

At least in regards to Google. I think they're getting too greedy with gathering information.

I was deploying a new website over the weekend and decided to run some stress tests on it to make sure everything's ok.

I used the record script on the web stress tool to record my interaction with the site using Google Chrome. When I analyzed the requests that were recorded I saw a bunch of requests to toolbarqueries.clients.google.com even though I've turned off all extra services that would require contacting google. I was even browsing in an incognito window.

I also routinely see googlebot trying to access content on some of my sites that isn't in my sitemaps, isn't linked to from anywhere. The only person that accesses those pages are me and I have them bookmarked in my browser. Yet somehow googlebot knew they were there.

Google might need to tone things down a bit.

Re:It's more than just add-ons

[VortexCortex]

Re: toolbarqueries.clients.google.com -- Don't use Chrome. If you like Chrome use Chomium instead (open source base of Chrome minus secret closed source Google juices).

Re: googlebot -- Sitemaps be damned, use "robots.txt".

Old News

[Stan92057]

This is not a problem that Mozilla has alone. Windows,Apple,Real Player and the list goes on and on have been doing this on the OS ever since windows 95. Nothing new here. It will never be a non issue until they are forced by laws and since no one likes more government intervention unless its against Microsoft nothing will ever change.

Here's an addon that does it

[guanxi]

Here's an addon that claims to do just that. It's at version 0.2 and hasn't been updated in a year, but maybe worth a try (or worth helping the developer):

PluginChecker
https://addons.mozilla.org/en-US/firefox/addon/46214/

Re:Bill Gates != Microsoft anymore. Re:Oh okay,

[140Mandak262Jamuna]

I am no fan of Microsoft. But their monumental screw-up is so big it is impossible to credit one man with all of it. May be he got bulk of the benefits and so should bear most of the blame, but still all those clueless CIOs of corporations, shills, contractors, brainless users, useless trade magazines... We should hold the feet of the present day honchos to the fire, instead of allowing them to feign innocence by blaming it all on Bill Gates. Saw him on CNN Christiane Ammanpour yesterday, he has earned Warren Buffet's approval in doing charity work. Give him a break.

This may sound silly...

[Marthis]

But, why don't browsers automatically detect when an addon has been installed from a non-approved way (i.e. through the browser's own plugin install system), disable it at app start, and prompt the user on what to do with it? Would seem a much easier, and better use, of resources, than complaining about people who take advantage of your broken system.

Re:This may sound silly...

[0123456]

But, why don't browsers automatically detect when an addon has been installed from a non-approved way (i.e. through the browser's own plugin install system), disable it at app start, and prompt the user on what to do with it?

And how do you do that?

Somehow you have to store information about which addons were previously being used. That means putting it in a file somewhere on the system. That means that the plugin installer will just add itself to that file so that it won't trigger the message.

You could try to do clever tricks with signing the file, but then the signing key has to be on the computer somewhere so the installer can find it and use it to sign the file again.

If you run as root to allow some random software to install then it has complete control over your system. That's the real problem.

Re:This may sound silly...

[BitZtream]

Its pretty easy to do with public/private keys. A password to decrypt the private key, so it can be used to sign the 'accepted plugins' list ... which the browser can verify on startup using the unencrypted public key.

The only way new plugins can make it into the digitally signed, accepted/known plugins list is if the user provides the password so the private key can be used to sign the list. Sure, they might be able to 'add' to the list, but the signature wouldn't match and the browser could blow its top and disallow all add ons until the user corrected the problem. Store a backup copy of the list in OS provided secure storage and you can even revert when tampering is detected by simply prompting the user for the password.

I've done it myself, you won't get around it without the private key so you've either got to make one hell of a guess or get the password. Add to that on Windows and Mac you have built in places to securely store the data and let the OS deal with the details, well it becomes trivial really.

I've seen other apps that do so as well, I want to say netbeans does it, but I don't recall of the top of my head.

Re:This may sound silly...

[Marthis]

I'm sorry - but having a control file (signed/encrypted/whatever), in the user's profile folder, showing what stuff was installed through the app's plugin system, and comparing to what's installed isn't rocket science...

Re:This may sound silly...

[harryjohnston]

OK, so the installer could bypass the opt-in mechanism. That's a given, for conventional operating systems at least. But this would be an obviously malicious action, which I'm sure would generate bad PR from day one, and could easily lead to a lawsuit. By comparison, the current situation (mainstream application developers choosing to install global add-ons rather than per-user add-ons) is perfectly reasonable to many people and has been happening for years with almost no fuss.

For most folks, having to install a browser add-on separately after you've already installed the application that provides the underlying service is an annoying and seemingly unnecessary step. (Not to mention the number of people that would just say "oh, it doesn't work" and give up.)

original article

[Eil]

Here's Asa's blog post, so that you don't have to click through the "news" article, which is almost entirely a copy-and-paste of Asa's post.

and not just browsers: Adobe PDFmaker in Office

[cellocgw]

Where was all the screaming when Adobe's PDF-making add-in for Office (Windows only, of course, since Apple did it right) turned out to force menus and a toolbar to appear in each Office app? There's no excuse for allowing an external app this kind of power. Under XP & Office2k/2003 (and maybe others, but I don't have a platform to check here), you can try deleting the toolbar&menus but they come right back next time you open Word/Excel/PPT.

Doomed to failure.

[davev2.0]

This solution requires Mozilla to fix things on their end rather than complaining about big companies doing something Mozilla didn't bother to prevent.

Re:Doomed to failure.

[Zumbs]

No, it requires Mozilla to hack Windows and OSX to ensure that programs running with administrator rights cannot change resourses used by Firefox. Which will get pretty messy.

Re:Doomed to failure.

[davev2.0]

See the below comments about how to control this without having to do anything you suggest.

illogical!

[Thud457]

"I'm sorry Dave, I can't do that...
there is no win in adobe reader."

He said it himself

[davev2.0]

He says these plug-ins install themselves like trojan horses.

If MS, Apple, and Google all decided to stop doing it, the real problem would still exist and be dangerous. What is to stop someone from coding up a malicious plugin, and a free, fun little game, and distributing them together, installing the plugin as a trojan horse.

This is a security issue with Firefox. Why isn't there any outrage this is even possible? If this were IE, everyone would be ripping on MS and complaining that MS made a product where something like this is possible and on the tactics to distract from the real issue. Why isn't that happening here?

Re:He said it himself

[Vegemeister]

It's not a Firefox security issue. It's an OS security issue. The problem is that installers are routinely given root privileges. There is absolutely nothing Mozilla can do about a third party program rampaging through the file system.

Asymmetric encryption? A malicious installer can clobber the public key and re-sign all plugins with its own key.

Symmetric encryption? A malicious installer can wait for the user to input the password, or clobber the encrypted trusted plugins list (making the assumption that all installed plugins are set as trusted) and patch the executable to show a bogus password prompt. That's a substantially smaller attack surface, but how many users would put up with a password prompt every time they opened their browser?

Re:He said it himself

[davev2.0]

Really? All Mozilla has to do is keep a list of the installed plugins, which is then hashed to create a signature. If the installer adds a plugin, when FF starts up, the list of plugins does not match the signature of the previous list and asks the user if he wants to keep the new plugins. Conversely, it could provide a list of all plugins to the user when it finds a plugin that is new.

The problem is a Firefox problem. As long as a third party can install plugins without the user's consent, it is a Firefox problem.

So, when the malicious software clobbers the public key and re-signs all the plugins, what happens when FireFox uses the private key to check the signatures?

So the installer is going to start and run until the user inputs which password where?
No trusted plugin list == make all plugins trusted? That is even more stupid than not having any plugin security at all.
Patch which executable to show a bogus password prompt? Firefox? And, why would a user have to put up with a password prompt every time they opened their browser? They would only have to do enter a password to add a plugin or if there was a change to the trusted plugin list.

You can try to defend them all you want, but the end result is the same. Mozilla could easily prevent this, but they would rather claim the issue is not with their security but rather with what other companies are doing because of their lack of security.

Everyone used to slam MS for blaming hackers for it's security problems. But, when it is Mozilla blaming people taking advantage of poor security in Firefox, it is fine. That is hypocrisy in action.

Re:He said it himself

[Vegemeister]

Really? All Mozilla has to do is keep a list of the installed plugins, which is then hashed to create a signature.

And where is the correct hash stored? Ah, yes, in a filesystem which is writable by the malicious installer with root privileges.

So, when the malicious software clobbers the public key and re-signs all the plugins, what happens when FireFox uses the private key to check the signatures?

In the context of digital signatures, it is the private key that is used to create the signature and the public key that is used to verify it.

When Firefox checks the signatures it finds that they are correct, because the malicious installer has generated a key pair, signed all the plugins (including the undesirable one) with the private key, and overwritten Firefox's verifying key with the public key.

The only thing that Firefox could do to prevent this sort of attack would be to encrypt the public key used to verify the integrity of the plugin list with a password supplied by the user every time he/she started Firefox. From the user's perspective, this is no different than encrypting the trusted plugin list with a symmetric cipher and asking for a password on each start and to edit the trusted plugin list.

So the installer is going to start and run until the user inputs which password where? No trusted plugin list == make all plugins trusted? That is even more stupid than not having any plugin security at all. Patch which executable to show a bogus password prompt? Firefox?

If Firefox asked for a password on every start as described above, a malicious installer could wait for firefox.exe to appear in the process list, then keylog the password and perform the aforementioned attack.

Or, it could simply overwrite firefox.exe with a patched version that assumes all plugins are trusted and throws up a bogus password prompt so the user doesn't suspect anything.

And, why would a user have to put up with a password prompt every time they opened their browser? They would only have to do enter a password to add a plugin or if there was a change to the trusted plugin list.

See above.

You can try to defend them all you want, but the end result is the same. Mozilla could easily prevent this, but they would rather claim the issue is not with their security but rather with what other companies are doing because of their lack of security. Everyone used to slam MS for blaming hackers for it's security problems. But, when it is Mozilla blaming people taking advantage of poor security in Firefox, it is fine. That is hypocrisy in action.

The best Mozilla could do is to store Firefox and all of its plugins in an encrypted container that is decrypted in memory with a password the user enters every time Firefox starts. A manual implementation of this method is standard when browser security is paramount (hacking the DoD, legitimately accessing the DoD, uploading child porography, etc.). A browser is stored inside an encrypted container which is mounted read-only.

If the unwanted plugin is installed by an entity that claims to be a legitimate company, any of the discussed measures should allow Mozilla to sue their pants off under the circumvention provisions of the DMCA.

The fact of the matter is that SOP for installing software on Windows involves running untrusted code with superuser privileges. There's a lot of good Windows-exclusive software, but frankly, that's fucking ridiculous.

The sensible format would be a LZMA archive with a header containing the name of the software in unicode. A trusted program running with superuser privileges (let's call it a 'package manager') would create \Program Files\$name_of_software\ and $home\AppData\$name_of_software for each user, and extract the archive into \Program Files\$name_of_software\. The installed program would then only be allowed to al

Re:He said it himself

[davev2.0]

You assume that the public key has to be stored on the local machine, which is false.

Re:He said it himself

[Vegemeister]

Where else would it be stored, aside from the user's mind?

Re:He said it himself

[davev2.0]

key.mozilla.org

Re:He said it himself

[Vegemeister]

key.m0zi11a.org

Re:He said it himself

[davev2.0]

And, that is going to do what exactly? The key will still be retrieved from key.mozilla.org. The address is not something that has to be put in by the user. It doesn't even have to be stored as a domain name.

Re:He said it himself

[Vegemeister]

But the address does have to be stored somewhere. Unless that somewhere is on hardware write-protected media, keeping the key on a remote server does not protect from an adversary with root privileges.

In fact, this is a solution you can implement yourself, right now! Download portable Firefox. Configure as desired. Disable disk caching. Burn to DVD.

Even that isn't perfect. A determined, knowledgeable, and well-funded adversary could copy the contents of the DVD to a local directory, make any changes they desired, and mount that directory at the usual mount point of your DVD drive (or replace the DVD drive with a symlink).

I don't think you fully comprehend the implications of executing untrusted code with root privileges. Mozilla could make it so hard to install plugins without user permission that any company doing so would forfeit legitimacy. Mozilla could--finances permitting--instigate a war of attrition with malware authors. Microsoft, however, could solve the problem in one fell swoop if they would just get their shit together.

Re:Uhh...

[Gilmoure]

For some reason, I hear Prof. Farnsworth's voice in my head.

And F-Secure installs trojans now

[plj]

Funny thing here is that F-Secure's Client Security does the same; it automatically installs an extension to Firefox that adds a toolbar reporting whether a particular site is safe.

OK, you can avoid that by choosing custom install and not installing the “browsing protection”, and even if installed you can turn it off from their GUI, but the installer does not explicitly tell you that it will install a Firefox extension.

(And yeah, others too. At least Skype and Nokia PC both do this.)

Re:And F-Secure installs trojans now

[plj]

Shit. “Nokia PC” should have been “Nokia PC Suite”. But anyway.

Re:And F-Secure installs trojans now

[Khyber]

'but the installer does not explicitly tell you that it will install a Firefox extension."

Guess what I sued EA for and got them to settle on PDQ?

That EXACT same behavior with SecuROM.

I think, given how easily EA settled, that one would have a winnable case against any other company. EA settled to stop irreparable damage to their shady business model, I can only imagine every other company doing the exact same thing if you took them to task over it.

Well, Asa, why?

[jopet]

Why is it even possible to make a plugin/addon install without the user getting asked? I see it as a shortcoming of Firefox if that is possible at all. There are probably lots of other ways how FF could be made more modern and more secure (sandboxing, declarative plugin/addon rights, proper separated processes for plugins etc.) so how about stop bitching and get something done?

Re:Well, Asa, why?

[VortexCortex]

Why is it even possible to make a plugin/addon install without the user getting asked?

Because all the apps can see eachother's junk.

It's not Firefox's job to sandbox all the applications, that's really the OSs job.

In most desktop OSes, Much like the Internet, security was not a consideration among peers on the platform.

We've sucessfully migrated to multi-user security. The next step is already being taken via sandboxed applications: chroot, Android, iOS.

On an OS that sandboxes all applications, Firefox doesn't have to worry about protecting itself from outsiders, and it shouldn't have to worry about that now.

Applications shouldn't have to focus on features you require from your OS.

Besides, as long as all apps can touch eachother's junk you can't have a proper sandbox as you describe. Certificates and Signing? Pfft. My malicious installer will just replace FF's keys and certs with ones I generate during installation, and I'll just re-sign the whole plugin system with the new keys. FF will see that everything is valid upon start up.

The only other option is requiring the user to input a password to "unlock' Firefox at startup. I already do this because my homepage has a password box, and I use a master password with my saved passwords, but for most users that is a big usability problem -- Remember Vista?

Re:Well, Asa, why?

[VortexCortex]

I don't "claim" anything. I'm stating facts.

Fact: The firefox installer can see & write to your whole hard drive.
Fact: MS, Google & Apple installers can see & write to your whole hard drive (including directories containing FF's data).

Yes, I'm absolutely positive that neither Firefox or Google/MS/Apple/Any applications are truly sandboxed on your OS. Proof? This Article Exists.

Define sandbox.

In my idea of a "sandbox" typing file:///sys/kernel/slab into the address bar should bring up an error page instead of my slabs...

Yeah, I know I can manually run FF under a chroot to create my own sandbox, but NO, FF DOES NOT DO THAT ITSELF.

You should have seen this coming.

[Lilith's Heart-shape]

It used to be that every piece of shitware for Windows wants to install IE toolbars, but nobody tried to install trojans targeting Firefox because Firefox's market share was too small to be worth the effort. That has changed. Firefox is now relevant to malware coders, and therefore a target. Frankly, I think coattailware (unwanted software the rides the coattails of desirable or necessary software) like IE toolbars and unwanted FF extensions are nothing but malware, and should be opposed by any honorable means necessary.

Add to that

[phorm]

... can do little about.

Seriously, it's an arms race, and there's only so much time the average or even geeky type person has to find ways in blocking such crappitude while still having their machine able to work normally.

Apple Plug-in

[ThatsNotPudding]

"We think you're gonna love it."

Re:Adware /= trojan

[geminidomino]

This adware is definitely a subset of malware, and seems to make the "desirable" programs that install this garbage the "trojans" -- ostensibly performing a useful (FSVO "useful") function but engaging in hostile activity in the background.

 

Java has quirks.

[Futurepower(R)]

Java has ALWAYS been a badly managed language. Sometimes programs (not web sites) will only run correctly with an old version of Java.

Those who supply Java programs often have to deliver an entire Java run-time package to make sure their programs will run.

The quirky management of Java was extremely strong public relations for Sun. Notice that Sun no longer exists.

Re:Java has quirks.

[bberens]

I recall the day when Sun released a new patch for Java. Everyone auto-updated and all of a sudden the transparency of labels in our app was broken all over the place. Luckily for us there were only a hand full of people using our app on a Windows desktop OS (most are CE). So rather than going back and redoing the layout for all of our screens we just handed people a functioning JRE. That was an annoying day when a bug was introduced into our app by the platform vendor.

Re:Is this guy on crack?

[aristotle-dude]

So, they want Quicktime to..... do what exactly? They downloaded Quicktime to be able to watch quicktime content and most of that is on the web which means that they probably wanted a plug-in for their browser. Being able to watch downloaded mov files is just gravy.

Re:Is this guy on crack?

[frostfreek]

All I have to say in response to this is ".NET Framework Assistant". http://www.computerworld.com/s/article/9139459/Sneaky_Microsoft_plug_in_puts_Firefox_users_at_risk

Re:Is this guy on crack?

[spiralx]

I installed Skype about four days ago and after selecting custom install, disabled the install of various browser plugins. Most likely you just selected typical install.

Turning the problem around

[QuietLagoon]

The Mozilla exec is trying to turn a FireFox security hole (i.e., the ability to load plug-ins without the user's knowledge or consent) into something else (other companies are evil for exploiting the security hole).

.
The solution is simple, Mozilla needs to fix the security hole in FireFox, and while they are at it, provide a means to uninstall plug-ins that does not rquire me to go rummaging through the filesystem looking for oddly-named files and deleting them.

Re:!Encryption

[QuoteMstr]

True enough, but encryption works as a digital signature

No, it doesn't. Encryption without authentication is always subject to terrible attacks. Always include an authenticator in an encrypted message. An attacker not being able to decrypt a message is no barrier to his being able to manipulate it for profit.

Re:Bill Gates != Microsoft anymore. Re:Oh okay,

[mcgrew]

"I’ll tell you why I like the cigarette business. It costs a penny to make. Sell it for a dollar. It’s addictive. And there’s fantastic brand loyalty." —Buffett, quoted in Barbarians at the Gate: The Fall of RJR Nabisco (from wikipedia)

If you want me to like Bill Gates, saying he has Warren Buffet's approval won't do it.

An OS security model issue

[La Gris]

Application using storage area should have delegated access as extended object methods.

Let's say Firefox need a storage area for user data and plugins, as it request some space to the OS/filesystem, it get extends on access methods and ACL for the required disk/or whatever device area.
Os has still the release unallocate as root rule but has to go through firefox to read/write/alter any data in that storage area.

Application B want to installs and request its own storage areas to the OS.
If Application B request access to Firefox own storage area, it does so transparently through Firefox methods extended from the base OS storage area object.
It cant access the storage area object belonging to Firefox by calling the base object methods from the OS.

Car analogy like :
- Please can I use that car here ?"
- Its John's car, asks John if he agree to drive it for you
- Don't even try to take it, This car operation is onwly known to John.
- What happend if you dont allow John's car parked here anymore ?
- I can throw the car away but it will throw John's as well. ...

Re:An OS security model issue

[VortexCortex]

I agree.

This is very similar to what Android does.

Apps can only see other app's data through APIs that the apps implement. Apps can only access the data that they create, or that which is on the SD card. All other cross application data access is limited to apps that are signed via the same developer cert. A dev can make multiple apps that work together intimately (can see each other's data), but they must be from the same dev. Any other app from a different developer must use the application's public API.

Yes and No

[huzur79]

When an Automatic Update from Microsoft Update or Apples Software update installs a plugin, I have an issue with that like how .net was added to firefox without users knowing. When something installs from a users explicit decision such as installing iTunes or MS Live and it installs a plugin he's wrong. User initiated installs is the permission granted to Apple or Microsoft or Google to install whatever is being offered. If the user fails to read the finer details of what’s being installed or reads the installer options such as, include whatever plugin, it’s not their fault. There is a difference between Automatic non user initiated plugin installs from updates and user initiated software installs that include a plugin. Firefox could easily just audit its plugins from last start to see if anything has been added in the unofficial way and warn the user or by default disable it and ask the user to enable it. Its in there power to do something about it but instead they take the lazy route or political route to complain about it instead. So one must ask what is the Agenda saying Microsoft, Apple and Google are evil when they have the power to code changes to prevent it vs saying the Maker of Internet Explorer and the Maker of Safari and the Maker of Chrome are evil. Oh I think I just answered the Political question with that last line.

Re:Bill Gates != Microsoft anymore. Re:Oh okay,

[Aldenissin]

Actually, the buck stops with him. When he claims to be in charge, let him take the credit. To put it another way, if HE wanted to have a different style of company, then he could. And charities or not, he could do things different and still affect Microsoft in some way, I think.

    Hell, at the least he could fund Linux, or GNU Hurd until it compares to commercial software. Then, THEN I can leave him alone. Sure, he realizes how hollow his life was being the richest man because of what it took to get there, but if computers were freed, then that would probably be about the best good he could ever do. Maybe I am wrong, but I see the potential of computers, the real potential, not the locked down "selling my soul to the company store" half-broken, bloated POSes that we mainly use day to day.

Ubuntu does it too!

[datakid23]

I love linux and I've been using Ubuntu since 5.10 - but let's not forget that it's not just evil corporations that do this! Ubuntu has a plugin that's installed when you install firefox, without asking.

Shhhhh... Don't Say Anything, OSS Guys Do It Too

[camperslo]

Well if it's the end user that has to be asked, it seems most of our favorite Linux distributions add things too:

openSUSE 11.3
openSUSE Firefox Extensions 1.2 (extension)

Fedora 14
iTunes Application Detector (plugin)

Ubuntu 10.10
Ubuntu Firefox Modifications 0.9rc2 (extension)

I don't expect that any of that is evil. Is the Apple extension really doing anything worse?

Other Apps add things too, I also noted some for Totem that I never got from Mozilla. Good stuff, yes?

Re:Is this guy on crack?

[Aldenissin]

You do have a point, however, I still agree with him not to use it. Making the choice available and having the option to say no by informing me whilst install is in progress are two different things. Only one is the "right" thing to do. This will cost them customers that say, "Man, I got this thing installed, I am just gonna uninstall Skype altogether!" And they do. When you do the right thing, you don't get backlash like that.

Re:Add Yahoo as well

[mgblst]

How the hell would you know that? Do you really ask that specific question to every single person you have met? If you are, which I doubt, then you must have some reason to ask them that question. More likely, you would rarely know if someone you have met knows about this or not. Lots of people manage to get away with believing crazy stuff for years.

Re:Add Yahoo as well

[awshidahak]

Well... the Adobe Reader one with Norton makes sense. I mean, since having Adobe Reader on your computer is a good way to get viruses, you might as well have an antivirus program on there.

Also, as to why they picked Norton over the others... I suppose it's cause it's the crappy but strangely popular one just as Adobe Reader is the crappy but strangely popular one of the PDF readers.

The worst offended

[definate]

Easily the worst offender for me is Sun, or should I say Oracle, then again Oracle is dumping Java, so I guess now no one?

Either way, each time it installs an update, I get a new fucking plugin installed. The old one isn't removed either. The result being a list of all the past versions. So fucking annoying.

OS lets programmers get away with everything

[Anonymous Coward]

This kind of crap is a problem with software in general, not just browser plug-ins.
Seems like many programmers think you bought the computer explicitly to run their software and nothing else.
Or at the very least, they figure they have every right to do whatever they want to your computer.

MS should (at the OS level) never have allowed this kind of behavior, but since they are also one of the offenders, it's not surprising.

Re:why can they do that?

[harryjohnston]

That has a very simple follow up question.

Why can these companies do that?

Because Mozilla deliberately created a mechanism for them to use to do so, because it's easier on the end user.

Re:Add Yahoo as well

[toddestan]

You've never run into the Windows installers that look like this?

http://foundationphp.com/images/install04.jpg

Not additional software

[harryjohnston]

At least on Windows, the plugins in question aren't "additional pieces of software" that are being installed secretly. They're part of the software package you chose to install, both conceptually and technologically.

This doesn't necessarily justify the fact that any particular software package doesn't make its browser add-on functionality optional and/or opt-in. It's just an observation.

Incidentally, I could swear that Firefox has been prompting me lately whenever a new add-on is discovered, and giving me the chance to disable it. Problem solved, I'd think, although I suppose you could argue that it should be opt-in rather than opt-out.

Can't the Mozilla dumbasses call the seatbelt API?

[tlambert]

Can't the Mozilla dumbasses call the seatbelt API?

Sorry to be so blunt about this, and I'm not being an apologist, especially since I don't work at Apple anymore...

I must be missing something; there's an API for this already; why isn't Mozilla using it?

-- Terry

Mozillas Fault

[Tom]

So, why does Firefox then enable and run those plugins, eh? If you really think they are evil, put your money where your mouth is, keep an internal list of enabled plugins, not editable from outside sources, and if a new plugin is detected, throw up a dialog asking the user if he wants it enabled or not.

If you provide the functionality, don't whine if people use it. If your browser will happily activate and use any plugins I throw into its plugin directory, stop crying if I do.

Simple English

[leptechie]

Dear User Firefox/IE/Safari/Opera/Chrome detected that two plugins were recently installed from a source outside your browser. If you were informed about this by the program that installed it, please review this information anyway.

• pluginName has a link to the author's website and a description here, and the process to deactivate, uninstall or upgrade the plugin can be found at this link. If you were not notified by the author that this plugin would be installed, please contact them at this email address or report it to the Development Team at this link.
• OtherPluginName does not appear to have either: (1) information on the author, (2) any links to processes for deactivation, uninstallation or upgrade, and/or (3) a contact address for you to submit problems or questions to the author. The plugin has been disabled as a precaution, you can re-enable it here. You can read more about unsafe or stealth plugins here. Know your Rights.

Disable All, Disable Incomplete, Enable All

Re:why can they do that?

[asdf7890]

Why is there no mechanism in place that demands a new plugin to be confirmed by the end user?

How would Firefox detect a plugin that had not been OKed by the user, if it was installed while Firefox wasn't running in order to be able to capture the event as it happens?

Some file flag? Won't fly - Apple/MS/Google/others will just set those flags as the files are put in place.

Digitally sign the files with a unique signing key (created first time the browser starts) when the user accepts them and check the signatures when the browser starts each time? No joy - the only way to do that would involve the signing key being on the client where other software could read it and use it to fake-sign their files.

Sign the files as above but password/passphrase protect the signing key such that the user must enter their password in order for an addon to get signed? This would work technically speaking (if properly implemented) but would irritate many users so they'd just turn the feature off (or complain loudly that they can't turn it off).

Mozilla can fix it and should.

[niftymitch]

Mozilla is the base code for a lot of browsers and as such both pushes and drags these interfaces into all other Mozilla derived/ inspired browsers.

Mozilla needs to fix it.

There is an advantage in fixing it as it will set the stage for better dirt boxing and better security (enforced by SELinux for example). Today there is both system and ~/.mozilla or the windows equivalent that are in common... The search path for plugins and more keeps growing with no obvious way to narrow them.

Re:Is this guy on crack?

[Lundse]

Agreed. People who download Quicktime probably want the plugin.
One case of a program installing what people wanted is no argument that other programs should install stuff people did not want or request, however.

I don't think people want the Windows Live Photo Gallery, unless they ask for it. That other people did click the "let me watch this video in my browser"-button simply is not relevant.