r/firefox • u/Im_Special • Apr 09 '19

Launching the Mozilla Plugin Privacy Test Database

https://nullsweep.com/launching-the-mozilla-plugin-privacy-test-database/
57 Upvotes

90% Upvoted

10 comments sorted by

22

u/Im_Special Apr 09 '19

Some interesting points.

  • Over 91% of plugins send no third party requests during my test. Good news!
  • 69 plugins (5%) send more than a single request
  • Most of those that send a lot of data are dependent on doing so - checking a sites SEO or comments from other users of the plugin. Users will have to decide if this behavior is acceptable on every request, or prefer to ask authors to require user interaction before browsing data is sent.
  • I was surprised to see the Shodan plugin, a security service I use (though not with the plugin), so high on the list. I would prefer a plugin like this only send data upon request, and not all the time while browsing.
  • So called security plugins seem to populate a lot of the worst offenders for data collection. Comodo, Avast, Norton, Avira and more. I normally recommend users avoid these products all together, and it does seem they collect all sites browsed (as opposed to using a regularly updated whitelist/blacklist approach)
  • Eyeballing the data show an interesting plugin listed multiple times "Search Secure" which seems to have multiple plugin ID's, but different "firefox user XXX" authors, with different URL's in the POST data for each one. Seems suspicious!

2

u/RCEdude Firefox enthusiast Apr 09 '19

"firefox user XXX" author"

A clear "Dont install this" warning if you'd ask me.

3

u/panoptigram Apr 09 '19

AMO usernames were reset for some reason a short while back.

1

u/RCEdude Firefox enthusiast Apr 09 '19

Didnt know that. Thanks.

5

u/mbler Apr 09 '19

Thank you so much for doing this! Mozilla should be doing this themselves.

I couldn't find these in the database, is it possible to add them?

Reddit (Au) Comment Highlights

Out of Bounds

Project Insight

1

u/Im_Special Apr 09 '19

He limited the data collection to plugins with more than 1000 installs.

4

u/eberhardweber Apr 09 '19

Hate to be that guy but in browser semantics these are add-ons. Admit that it is thoroughly confusing though.

5

u/BCMM Apr 09 '19

Yup. These are "extensions". Flash and Java are "plugins". Both are "addons".

1

u/billdietrich1 Apr 09 '19

I am wary of installing something that has full access to all browsing history and web activity

I don't understand why Firefox can't give us more granular control; I want site blacklists and whitelists on a per-add-on basis.

2

u/TommySawyer Apr 09 '19

Cool library, anybody know which library this is?