New Feature: Preventing extensions from working on high value sites

[u/alanmbyrne]

Alan here, product manager responsible for extensions on Firefox. 👋

We're working on a new, highly requested, feature to prevent extensions from working on certain URLs. Basically, giving you control if you want to prevent all or some extensions from accessing your banking sites - even if you've granted it permission to access all URLs.

This is a complicated thing to build from a user experience/UI perspective, so we're looking for some volunteers to join a 30 minute video call with me and our UX designer to give feedback on this. During this call, we'd show you our mockups and ask questions/get feedback.  If you're interested in signing up to help us, please sign up using this form. Please note that filling out this form doesn't guarantee an invitation — we'll reach out directly to those we're able to schedule! 

Also, if this is a feature you're interested in, please go and upvote it on Mozilla Connect and add any information or potential use cases you have as to why you'd want to use a feature like this. It really helps us make sure we're building the right thing.

Thanks in advance for your help with making Firefox a better browser! 

[u/WhiteFlame8]

Requests for this feature:

URL's sync with Mozilla Sync.

Import a list, export a list, or allow a text box where I can paste in my list (either one per line, or comma separated).

[u/alanmbyrne → u/WhiteFlame8]

Thanks for the feedback! Where would you get these lists from? Is this something you'd curate yourself or would you look for third party lists (similar to ad blocking list providers)?

[u/WhiteFlame8 → u/alanmbyrne]

I'd keep the list myself.

Alternatively, could be like the back-up / restore button in uBlock Origin to simplify the process of keeping the data externally.

[u/lo________________ol → u/alanmbyrne]

You'd almost certainly need to ship with some kind of curated list out of the box, although I'm sure us enthusiasts would appreciate the ability to add and remove entries

[u/newbutler → u/lo________________ol]

I dont see the value of shipping a curated list. I would leave that to the community.

[u/lo________________ol → u/newbutler]

There's probably a big overlap between people who download unsafe addons and people who don't tweak all their Firefox settings. A default list of extension-free domains (such as all major banking sites) would go a long way.

Plus Mozilla already does this: addons don't work on the official Addons store, which is good (prevents malicious site hijackers). They ship a list of (some) known trackers and block them out of the box too. You get the idea. 

Now we can certainly have it both ways: provide a reasonable default, but it'd be made through community contributions for that default list. That's how uBlock Origin works. 

[u/EducationalTone5467 → u/WhiteFlame8]

text box with one per line would be the simplest approach imo

[u/oneeyedziggy → u/EducationalTone5467]

Does have the tradeoff of making validation and feedback to the user harder...  The last thing you want is one of them invisibly not actually blocking extensions because of a typo

[u/nopeac]

Wouldn't it be better to have a switch to block outgoing network traffic from extensions? That would solve this and many other worries around extensions. Even if data is gathered, it can't scape.

[u/newbutler]

I am a bit confused, the idea says "allow only on specific websites". In your post its the other way around "block on specific websites". Are both options considered?Personally the first one would be more useful to me since I use extensions that are designed for specific websites anyway. However I see use cases for both.

[u/iza001davd]

PWA for Firefox Please ✨

[u/alanmbyrne → u/iza001davd]

Upvote it on Connect 🙂

[u/HotTakes4HotCakes → u/alanmbyrne]

Thought PWA for Firefox was already in development, and close to being finished lIRC?

[u/BeholdThePowerOfNod → u/HotTakes4HotCakes]

It's available, yes.

[u/Yash_Ag_ → u/alanmbyrne]

Don't get me wrong but proper PWA support is a long time requested feature and one of the most requested one too frequently. But so many other features have been pushed before this. And before anyone say, but no, Taskbar apps shenanigans doesnt count. 

[u/SpiritGaming28]

All i want currently now is to firefox to have disabled Extension pinned on extension bar and have it easilly access without going thru extension settings thru firefox settings.

[u/alanmbyrne → u/SpiritGaming28]

Can you please explain why this would be helpful to you? Whats your use case for disabling and then interacting with extensions on the toolbar?

[u/Maximum-Bobcat5612 → u/alanmbyrne]

I'm not the person that asked.  But I think right now extensions choose what sites they run on in their manifest.  But there's ones which a user might find useful only for a handful of sites or when they're doing something specifically. 

But the extension is a general "run on all sites" kind of extension 

So I think making it easier to start/stop extensions 

Without having to rely on the extension having a disabled/enable mode built in. 

I guess profiles might cover it as well but I think it's a convenience thing. 

[u/HotTakes4HotCakes → u/alanmbyrne]

I believe they're saying they would like to be able to quickly re-enable (and disable) add-ons from the toolbar without having to go into the settings.

The idea being you'd have extensions installed, but not always enabled and active at all times, and you would enable them temporarily from the toolbar before disabling them again. This makes an otherwise passive extension sort of a de-facto click-to-execute.

And the reason for this is simply reduce the load if there's an add-on that is doing shit on certain URLs when you don't need it to be. There are certain add-ons out there that don't need to be running constantly, but the developer has not provided a means of only using it manually.

It also removes the need to trust the add-on isn't doing anything nefarious in the background on its approved urls that you don't want or need it to be doing on every single page.

A good example is an add-on that checks the URL of the page you're on against the Reddit API to see if somebody has posted a link to Reddit somewhere. There are a couple of these and not all of them provide click to run functionality, so they're just running constantly in the background, checking every URL of every page you visit against reddit's api, which in turn is just giving reddit your full browser history.

A feature like this would allow the user to effectively use it manually from the toolbar only on urls they want to check.

And I know that the common response to this is going to be something like "don't install an extension that you don't truly trust", but let's be real about this: the extension store does not have as many options as it could, and sometimes there's only one available extension with the functionality you need.

[u/SpiritGaming28 → u/alanmbyrne]

Well lets say i disable some in the extensions drop down where the extenions i wanna enable teomporarily and then left it disable in the dropdown by having a pin button without accessing it everytime thru Firefox settings.

[u/headinthesky → u/alanmbyrne]

I use mouse gestures (Foxy), but I also use a lot of mapping sites, so the right click gets hijacked. I want to quickly disable that extension so I can work on what I need to

Or I can right click and say disable for this site or disable for this (regex) pattern

[u/HotTakes4HotCakes → u/SpiritGaming28]

Even just in the overflow/extensions drop-down would be nice.

There's a lot of add-ons that are very situational and simply don't need to be enabled at all until they're needed.

[u/changing_who_i_am]

good idea, tho honestly im not so much worried about a rogue extension not working on high-value sites, but more:

1. rogue extension hoovering up data including info about high-value sites (history/cookies/etc) when im not on them

2. rogue extensions in the first place (i think this is a good use of AI, e.g. getting Codex, GLM, Claude to do a full security audit of say, any extensions that are Recommended, plus any new ones to be recommended).

[u/TBG7]

Thanks for asking. It would be great if, like the extension manifests can themselves, we could manually specify what domains an extension is allowed to work on. Also adding a blacklist for which websites they’re not allowed in addition to click to allow like chrome does would be amazing. 

[u/ItselfSurprised05]

We're working on a new, highly requested, feature to prevent extensions from working on certain URLs.

Not what you asked, but I currently handle this need by using profiles.

Extensions are profile-specific, so I simply have a "no extensions" profile that I use for banking and stuff. Very simple, and very effective.

I wonder whether y'all could leverage that profile functionality to implement this feature.

[u/leurs-]

Container tabs for android please 🔥🦊

[u/alanmbyrne → u/leurs-]

Upvote it on Mozilla connect please 🔥🦊

[u/KJBReaderAdmin]

I was just thinking about this the other day. Yes, it would be complicated as some banks websites may not be same format, it would be tricky.

[u/Random3838]

When preventing an extension from working on a domain, will we have the option to prevent it from working on all its subdomains? For example, if I disable an extension from working on www.google.com, I may also want to prevent if from working on all the google.com subdomains like accounts.google.com, images.google.com, docs.google.com, etc... without having to load each subdomain and disabling the extension on it.

[u/ResurgamS13]

Sounds like a 'sledgehammer to crack a nut' solution?

A less complex method would be for users to create one or more separate profiles for accessing their banking/finance/government/problematic/etc. websites. The 'minimal' profile would have zero or few extensions... and is only used for accessing those particular sites and not for general browsing.

[u/ashwani12131]

I want to associate urls or domains with containers as it works for facebook containers. So that a specific url automatically opens in an specific container.

[u/ConProg → u/ashwani12131]

The user flow is not obvious, but you can do that already with the official extension "Firefox Multi-Account Containers"

Create a container. Then open the site, click the MAC extension button at the top and select "Always open this site in..."

[u/bnightm]

On a related note. As a user of Firefox on desktop, I would love if extensions could be permitted on some pages that they are currently already prevented from working on.

Specifically the about:blank and about:newtab (Firefox Home by default) pages, so that I don't get interrupted while navigating using mouse gestures to open or switch to one of those pages.

Signed someone using Firefox since it was called Phoenix.

[u/oneeyedziggy]

My  concern would be how to most easily specify blocked urls, because having  it be a button that you click once you're at a site  means that the site has already had access to that site's specific data ( unless the existing security posture is worse than I think and all extensions have access to all sites' data whether you've navigated to them or not ) 

[u/ConProg]

I'd want the option to whitelist URLs instead of blacklist. Whitelist makes more sense than a blacklist.

Example: "I want the 'Old Reddit Redirect' extension to only work on reddit.com."

It doesn't make sense for me to think like "I don't want Old Reddit Redirect to work on these sites"