6 ms·
The fact that third-party addons can even touch sensitive settings in the user.js prefs is a massive security flaw in Mozilla's implementation of the WebExtensi
by mechnesium 7y ago
The fact that third-party addons can even touch sensitive settings in the user.js prefs is a massive security flaw in Mozilla's implementation of the WebExtensions API. Addons should be sandboxed/containerized or require privilege escalation before touching files on the disk.
- gruez 7y agoThis. The whole point of this security feature is to prevent extensions from interfering with Mozilla pages. What's the point of this when addons can bypass turn it off themselves?
- cmcaine 7y agoOnly extensions that have a native messenger can do this (which requires users to accept a scary sounding permission and install a separate application on their computer)
- Mathnerd314 7y agoIt uses native messaging with a Python script: https://github.com/tridactyl/tridactyl/blob/master/native/native_main.py#L406 https://github.com/tridactyl/tridactyl/blob/master/native/na... I don't think anyone who uses Tridactyl is worried about its security, it has a permissions list 15+ lines long.