3 ms·

> Now, SmartBlock 2.0 in Firefox 90 eliminates this login problem. Initially, Facebook scripts are all blocked, just as before, ensuring your privacy is preserv

> Now, SmartBlock 2.0 in Firefox 90 eliminates this login problem. Initially, Facebook scripts are all blocked, just as before, ensuring your privacy is preserved. But when you click on the “Continue with Facebook” button to sign in, SmartBlock reacts by quickly unblocking the Facebook login script just in time for the sign-in to proceed smoothly. I wonder how it does that, and if it's open to exploitation by a malicious website like Facebook.

simlevesque 5y ago
Maybe on mouse over or something like that.
- wnevets 5y ago
  Could be related to the isTrusted[1] property to signify the event is caused by an user's action. https://developer.mozilla.org/en-US/docs/Web/API/Event/isTrusted https://developer.mozilla.org/en-US/docs/Web/API/Event/isTru...
wisniewskit 5y ago
Basically, if a site uses the Facebook SDK to start the authenticaion flow, it will be broken because it's blocked. SmartBlock just stands in for that blocked script, acting just enough like the real API to prevent some common site breakage. This lets it detect when sites try to open the popup-based authenticaion flow, unload the stand-in script, load the real one, and continue the login flow. It only unblocks some Facebook resources, as listed here: https://searchfox.org/mozilla-central/source/browser/extensions/webcompat/data/shims.js#198 https://searchfox.org/mozilla-central/source/browser/extensi... It only unblocks it for that specific website (the domain in the tab URL), and only until Firefox is closed. Other trackers continue to be blocked, and other tracking protections stay in place (as opposed to turning off ETP for the site entirely).
- cassianoleal 5y ago
  > This lets it detect when sites try to open the popup-based authenticaion flow, unload the stand-in script, load the real one, and continue the login flow. I guess how it detects the "when sites try to open the popup-based authenticaion flow" is the attack vector. If it's Javascript, it's likely to be easily exploitable. If it's in the browser's chrome I suppose it would take a malicious add-on or similar device.
  - wisniewskit 5y ago
    Lead dev here. Yes, this is a give-and-take that probably will never be "perfect" for everyone. Right now a site could disingenuously call the relevant Facebook SDK API to unblock the Facebook resources listed here, and only on that site: https://searchfox.org/mozilla-central/source/browser/extensions/webcompat/data/shims.js#198 https://searchfox.org/mozilla-central/source/browser/extensi... I'm not too sure why that would be worthwhile as an attack, though. If you have anything in mind that would make it so, please let me know. In the meantime, I'm working on a way to further tighten this a bit so the unblocking will only happen if a popup is successfully opened (so that at least if the popup blocker kicks in, nothing will happen unless the user intentionally allows that popup). I'm not 100% sure if that will work well, but I hope so.
    - cassianoleal 5y ago
      Thanks for your response! Also thanks very much for your efforts! I've been using Firefox exclusively for quite some time, and it's by far the best browser for me. The focus on privacy and user protections (like this one) has also already helped me convince a few people to switch over. I think the main attack vector I'd be worried about is if the SDK itself implemented a way around this protection, rendering it relatively useless. If that's not a feasible exploit, then I wouldn't be overly worried about as it would take effort on each website maintainer to implement and maintain the exploit. The "real popup" detection sounds like a great addition if it works well!
      - wisniewskit 5y ago
        Right. We'll just have to see if and how Facebook reacts, but I would hope they prefer this kind of opt-in to their login buttons simply being broken in strict/private mode on many sites. In fact I think they're already getting sites to use an alternative login method which doesn't have to be blocked in the same way.
hypertele-Xii 5y ago
Am I reading this right? Firefox now implements special logic just for Facebook?
- Hallucinaut 5y ago
  They have had a special logic AGAINST Facebook for a long time now, via Facebook containers
  - gpvos 5y ago
    That's a separate extension, with Facebook clearly in its name.
- wisniewskit 5y ago
  Yes, though in this case it's for sites relying on Facebook's login authenticator, not really Facebook itself. SmartBlock also contains special logic for Google Analytics, Google Publisher Tags, and other trackers that cause sites to break when blocked. It's not meant for their benefit, but the user's. In fact all browsers have special web-compatibility interventions for sites which don't work correctly in them. Even Chrome. And sometimes even for major sites and services, especially when it comes to anti-tracking features.
- opheliate 5y ago
  If you're interested in special logic for specific websites, the WebKit Quirks.cpp [0] is well worth a look over. 0: https://github.com/WebKit/WebKit/blob/main/Source/WebCore/page/Quirks.cpp https://github.com/WebKit/WebKit/blob/main/Source/WebCore/pa...
- zinekeller 5y ago
  Uhm, there's about:compat, edge://compat/, WebKit Quirks (https://trac.webkit.org/browser/webkit/trunk/Source/WebCore/page/Quirks.cpp https://trac.webkit.org/browser/webkit/trunk/Source/WebCore/...), and Chrome (https://source.chromium.org/chromium/chromium/src/+/main:content/renderer/render_thread_impl.cc https://source.chromium.org/chromium/chromium/src/+/main:con... and https://source.chromium.org/chromium/chromium/src/+/main:components/shared_highlighting/core/common/disabled_sites.cc https://source.chromium.org/chromium/chromium/src/+/main:com...).

simlevesque 5y ago

Maybe on mouse over or something like that.

wnevets 5y ago
Could be related to the isTrusted[1] property to signify the event is caused by an user's action. https://developer.mozilla.org/en-US/docs/Web/API/Event/isTrusted https://developer.mozilla.org/en-US/docs/Web/API/Event/isTru...

wisniewskit 5y ago

Basically, if a site uses the Facebook SDK to start the authenticaion flow, it will be broken because it's blocked. SmartBlock just stands in for that blocked script, acting just enough like the real API to prevent some common site breakage. This lets it detect when sites try to open the popup-based authenticaion flow, unload the stand-in script, load the real one, and continue the login flow. It only unblocks some Facebook resources, as listed here: https://searchfox.org/mozilla-central/source/browser/extensions/webcompat/data/shims.js#198 https://searchfox.org/mozilla-central/source/browser/extensi... It only unblocks it for that specific website (the domain in the tab URL), and only until Firefox is closed. Other trackers continue to be blocked, and other tracking protections stay in place (as opposed to turning off ETP for the site entirely).

cassianoleal 5y ago
> This lets it detect when sites try to open the popup-based authenticaion flow, unload the stand-in script, load the real one, and continue the login flow. I guess how it detects the "when sites try to open the popup-based authenticaion flow" is the attack vector. If it's Javascript, it's likely to be easily exploitable. If it's in the browser's chrome I suppose it would take a malicious add-on or similar device.
- wisniewskit 5y ago
  Lead dev here. Yes, this is a give-and-take that probably will never be "perfect" for everyone. Right now a site could disingenuously call the relevant Facebook SDK API to unblock the Facebook resources listed here, and only on that site: https://searchfox.org/mozilla-central/source/browser/extensions/webcompat/data/shims.js#198 https://searchfox.org/mozilla-central/source/browser/extensi... I'm not too sure why that would be worthwhile as an attack, though. If you have anything in mind that would make it so, please let me know. In the meantime, I'm working on a way to further tighten this a bit so the unblocking will only happen if a popup is successfully opened (so that at least if the popup blocker kicks in, nothing will happen unless the user intentionally allows that popup). I'm not 100% sure if that will work well, but I hope so.
  - cassianoleal 5y ago
    Thanks for your response! Also thanks very much for your efforts! I've been using Firefox exclusively for quite some time, and it's by far the best browser for me. The focus on privacy and user protections (like this one) has also already helped me convince a few people to switch over. I think the main attack vector I'd be worried about is if the SDK itself implemented a way around this protection, rendering it relatively useless. If that's not a feasible exploit, then I wouldn't be overly worried about as it would take effort on each website maintainer to implement and maintain the exploit. The "real popup" detection sounds like a great addition if it works well!
    - wisniewskit 5y ago
      Right. We'll just have to see if and how Facebook reacts, but I would hope they prefer this kind of opt-in to their login buttons simply being broken in strict/private mode on many sites. In fact I think they're already getting sites to use an alternative login method which doesn't have to be blocked in the same way.

hypertele-Xii 5y ago

Am I reading this right? Firefox now implements special logic just for Facebook?

Hallucinaut 5y ago
They have had a special logic AGAINST Facebook for a long time now, via Facebook containers
- gpvos 5y ago
  That's a separate extension, with Facebook clearly in its name.
wisniewskit 5y ago
Yes, though in this case it's for sites relying on Facebook's login authenticator, not really Facebook itself. SmartBlock also contains special logic for Google Analytics, Google Publisher Tags, and other trackers that cause sites to break when blocked. It's not meant for their benefit, but the user's. In fact all browsers have special web-compatibility interventions for sites which don't work correctly in them. Even Chrome. And sometimes even for major sites and services, especially when it comes to anti-tracking features.
opheliate 5y ago
If you're interested in special logic for specific websites, the WebKit Quirks.cpp [0] is well worth a look over. 0: https://github.com/WebKit/WebKit/blob/main/Source/WebCore/page/Quirks.cpp https://github.com/WebKit/WebKit/blob/main/Source/WebCore/pa...
zinekeller 5y ago
Uhm, there's about:compat, edge://compat/, WebKit Quirks (https://trac.webkit.org/browser/webkit/trunk/Source/WebCore/page/Quirks.cpp https://trac.webkit.org/browser/webkit/trunk/Source/WebCore/...), and Chrome (https://source.chromium.org/chromium/chromium/src/+/main:content/renderer/render_thread_impl.cc https://source.chromium.org/chromium/chromium/src/+/main:con... and https://source.chromium.org/chromium/chromium/src/+/main:components/shared_highlighting/core/common/disabled_sites.cc https://source.chromium.org/chromium/chromium/src/+/main:com...).