565565 - Don't let apps install add-ons without my consent (ie. Skype, Norton)

Status: RESOLVED DUPLICATE of bug 476430

(Firefox :: General, defect)

Description

[John Wayne Hill (UX Intern)]

(Note: this is filed as part of the “Paper Cut” bugs — we assume that there may be multiple existing bugs on this. Please make them block this bug, and we will de-dupe if they are indeed exactly the same. Thanks!)

To reproduce:
1. Install Norton
2. Restart Firefox
3. Notice that Norton has installed an addon

Recommendation:
We should not allow for applications to auto-install addons to Firefox. If an application wants to install an addon the user should be allowed to chose whether or not they want the application installed.

Comment 1

[Jesse Ruderman]

From a technical standpoint, Firefox cannot prevent other applications from modifying it.  But modifying the Firefox binary would be a sure sign of malware, something Norton doesn't want to be accused of.

What we can do is make the only API for adding extensions involve UI that allows users to undo easily, or even requires users to opt in.  And state clearly that if an application goes around this API to install a Firefox extension silently, we consider it to be malware, and request anti-virus vendors to block it.

Comment 2

[Jesse Ruderman]

I guess much of that is covered by bug 476430.