Allow users to change the default Icon URL, to avoid leaking too much to faviconkit.com

GREETINGS&THANKS:

Hi,

Thanks for this great add-on that resurrects a functionality that died somewhere between Firefox 20 and 50, and improves on it while remaining lightweight, fast and fully configurable. I really have no idea why no variant of such an empowering feature is not included in vanilla browsers, so thanks for this really smooth implementation!

 

ISSUE:

As described in the title, the URL for the search engine icons is retrieved through faviconkit.com by default, which means this website can get up to the full list of search engines a person uses, especially if they load them through search.json.mozlz4. I understand the purpose of this site, but IMO it would be nice to be able to change the default.

In particular, an empty icon URL field should probably translate to SSS using the sphere icon Firefox displays when it doesn’t have a proper icon. This icon can be seen with URLs such as about:networking. (Additionally, this issue’s suggested default URL field being left empty should probably translate to the sphere icon being default)

Thanks for your time

 

SIDE QUESTIONS:

1. Can you confirm that the network requests for icons occur only once, and icons are then stored permanently on the user’s computer as long as the extension’s permanent storage isn’t deleted ? (I assume SSS uses the kind of extension storage that doesn’t get wiped with the CTRL+SHIFT+DEL data clearing UI)

2. Which API are you using to create the small panel on text selected ? Does it involve injection into the page, or something on the browser level merely covering the page, like the right click menu ?

[CanisLupus]

Hi @LegitLlama! SSS version 3.44.0 adds a new option:

When it passes the Mozilla review everyone should be able to set it to None to avoid sending information to faviconkit.

Two things to note:

1. “None” is really “none”, so it doesn’t try to create any default icon with a letter or anything. Unfortunately that would be quite a lot of work at this point, so I figured I would allow people to fix the privacy issue for now, if they wish, and set the icons themselves.
2. Some of the default icons (the ones that come with SSS) still use favicon kit and some requests will be triggered when first entering the options page. I intend to change those as well later.

[CanisLupus]

Hi! Thank you for the kind words, I appreciate them and I’m glad that you like it. 😃

So, onto the issue:

This is an interesting request. Despite the fact that you can change the icon URL while adding a new engine (by writing anything in the icon URL that is not an empty string), you cannot do that for the search.json.mozlz4 import, so this is an extra-valid concern. For cases with an unknown URL the best would probably be to generate an icon with a letter, though.

For the side questions:

1. Yes, one request. SSS always uses its own icon cache when displaying the popup or the context menu. It also comes with pre-created caches for the icons enabled by default. When it downloads an image for the first time in the options menu, it compresses it to a max of 48x48 pixels and then stores it in the settings for constant reuse.

2. I’m injecting the popup into the pages as a page script, though I’ve recently thought it would be better if it was a browser panel to avoid compatibility issues with some websites and eventual privacy problems. Not sure if such a panel can be created with WebExtensions or not, though. It’s something I’d have to research. 😃

Cheers! Daniel