[tor-bugs] #24072 [Applications/Tor Browser]: Block Web Extensions from controlling crucial privacy preferences

[Tor Bug Tracker & Wiki]

#24072: Block Web Extensions from controlling crucial privacy preferences
--------------------------------------+--------------------------
 Reporter:  cypherpunks               |          Owner:  tbb-team
     Type:  defect                    |         Status:  closed
 Priority:  Medium                    |      Milestone:
Component:  Applications/Tor Browser  |        Version:
 Severity:  Major                     |     Resolution:  wontfix
 Keywords:  ff59-esr                  |  Actual Points:
Parent ID:                            |         Points:
 Reviewer:                            |        Sponsor:
--------------------------------------+--------------------------
Changes (by gk):

 * status:  new => closed
 * resolution:   => wontfix


Comment:

 Replying to [ticket:24072 cypherpunks]:
 >
 > By https://bugzilla.mozilla.org/show_bug.cgi?id=1397611 Web Extensions
 may be able to control crucial about:config prefs such as
 `privacy.resistFingerprinting`. This shouldn't happen (what if user
 installs an addon that actually disables that pref?)

 They should not do that. That's the same as with the current XPCOM-based
 extensions. Even though WebExtensions are less powerful than XPCOM-based
 ones there is still risk of interference that can lead to privacy
 loss/information disclosure. I think that's nothing Tor Browser can and
 should enforce without messing with extensions the users explicitly wants
 to have installed.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/24072#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online