Use fewer permissions

Per https://github.com/browserpass/browserpass-extension/blob/77f6d18f8ea92e68fc0c020cb4065283e45a78c2/src/manifest-firefox.json#L27-L39 , this extension requests a set of permissions on installation.

This extension is a privileged application, since it has access to a password store, so it’d be great if it relied on the web extension permission model to limit its privilege. A code audit could only go so far: it will miss some issues, and doesn’t account for risks in the build and release process (see https://reproducible-builds.org/ ).

Proposals to make permissions optional

Firefox considers the following permissions to be privileged enough to advise the user of: clipboardWrite, webRequest, activeTab, <all_urls>, so let’s focus on those.

webRequest

Used for: injecting username/passwords into HTTP basic auth prompts.

Risk: Medium. This permission can be used to exfiltrate all your browsing metadata.

How to make it optional: set HTTP auth to be disabled by default. If a user chooses to enable it, request webRequest then.

tabs/<all_urls>

Used for: Likely many things, but including: injecting a content script on all pages, to add a pass icon to username/passwords fields.

Risk: High. This permission can be used to exfiltrate all content (incl. input) of all pages you visit, or to inject arbitrary content into all pages you visit.

How to make it optional: don’t add a content script to all pages. Instead, add an option (disabled by default) to control this. If/when the user enables this, request <all_urls>. this extension can use activeTab when this option is disabled, which allows this extension to inject a content script if/when the user chooses to interact with this extension, e.g. via the right click menu, or via the passff browser bar button.

clipboardRead/clipboardWrite

Used for: copying username and passwords to the clipboard.

Risk: Low. A malicious extension could put malicious scripts in your clipboard, hoping that you paste them into a terminal?

How to make it optional: defer requesting clipboardWrite until the user chooses to copy to the clipboard.

Disclaimer: I have opened a similar issue against passff: https://github.com/passff/passff/issues/472.

[maximbaz]

Hello!

Thanks for your effort and detailed explanation, definitely appreciated.

This extension is a privileged application, since it has access to a password store, so it’d be great if it relied on the web extension permission model to limit its privilege. A code audit could only go so far: it will miss some issues, and doesn’t account for risks in the build and release process (see https://reproducible-builds.org/ ).

I completely agree that web extension permission model should be used to not have more permissions than necessary to be able to provide the functionality, provided that it doesn’t harm functionality or user experience.

webRequest How to make it optional: set HTTP auth to be disabled by default. If a user chooses to enable it, request webRequest then.

I don’t think this proposal follows web extension permission model, we shouldn’t cripple extension functionality just for the sake of doing it.

When you want to locate yourself in a maps application on Android, you get a prompt “May I use GPS? Always, This one time, No”, and after you respond with a positive answer you get the functionality. It’s unobtrusive, very easy to use.

Imagine if instead the application showed you a prompt “May I use GPS?”, you tap “Yes” and then you got a different prompt “Ha, but go in application settings and enable this feature, because for security we disabled it”. I feel like it will be faster to delete such application than going through the trouble of making it work 🙂

tabs/<all_urls> How to make it optional: don’t add a content script to all pages. Instead, add an option (disabled by default) to control this. If/when the user enables this, request <all_urls>

Same as above, except this is a vital feature, in my mind it just doesn’t make sense to provide browserpass that out of the box is unable to fill out login forms to some websites, and requires user to search in extension options how to fix the functionality.

clipboardRead/clipboardWrite How to make it optional: defer requesting clipboardWrite until the user chooses to copy to the clipboard.

This I could be sold on, however (a) I even think we wanted to make it optional since the beginning, but users reported that it wasn’t behaving well in Firefox, (b) the risk of this one is quite low, if this is the only permission that we conclude makes sense to make optional, honestly I wouldn’t go through the trouble to implement it, to only have one optional permission, the clipboard… 🙂

[erayd]

Perhaps Firefox’s rationale for developing optional permissions is that they are useful for users that won’t just accept the permission?

Asking for permissions at time-of-use can make it more obvious what those permissions are used for, so that the user can make a more informed decision than just allowing or denying the whole lot upfront. We’ve seen a significant shift in that direction on Android, for example.

That model isn’t a good fit for Browserpass unfortunately - so given that we need them upfront, we do our best to ensure the permissions we do need are all documentated in the README - but I can certainly see a number of scenarios in which the ask-when-used approach would be superior.