Program Management/Projects/SearchHijacking
From MozillaWiki
Contents
Background
Web search is a lucrative business and so the search integration points in Web browsers have become a target for add-ons -- from legitimate, to grayware, to malware. The collection of techniques used to circumvent browser search defaults to funnel search revenues to third parties is referred to as "Search hijacking".
With the increase in search hijacking and it's negative effect on user choice and control, Mozilla is looking into ways to help users defend themselves.
Team
- Support: Cheng Wang
- PM: Sheila Mooney
- Engineering: Gavin Sharp
- QA: Juan Becerra
- Security: Al Billings
- Product: Asa Dotzler
Status/Update
- Strawman for Q1: telemetry probe for scoping the problem, hardening keyword URLs.
- Telemetry probes checked in to m-c 2/7 - bug 724145
- Hardening keyword URLs checked in to m-c 2/13 - bug 718088
- Asa on point to work with Kev to make sure solution in FF13 is going to be ok.
- Considering making a few minor modifications.
- Might decide to backout of Aurora and leave on trunk for a while.
Telemetry
- Simple check 0/1 if pref has changed.
- Tracking in Telemetry Dashboard.
Hardening keyword URLs
- We are going to prompt everyone we see who has changed keyword.URL to a user-set value.
- On search the users will be prompted when we detect the change and be presented with a notification prompt.
- We can have the prompt only include "Yes, reset" and "No, don't ask again" buttons (exact text still TBD), and keep showing the notification bar on searches until we get one of those responses.
- The Bing builds we distribute wouldn't be affected by this (their default value is different, it's not "user-set").
- Extensions that change this value properly (by shipping a different default pref as opposed to programmatically setting the pref) also wouldn't be affected by this.
- Users who manually change the value voluntarily can just ignore the prompt (very small minority).
- We should also be clear about which users we're talking about prompting. The only way to get a user-set value for keyword.URL is:
- Manually change the pref in about:config (or prefs.js in your profile)
- Install an extension that programmatically sets the pref (rather than changing the pref in the "supported" way, by shipping a new pref default)
- Have a third-party installer set the pref in your profile's prefs.js
- We will extend this to all languages builds. We thought of doing en-US only at first but see no real reason to do this.
Bugs/Tracking
- bug 718088 - offer to re-set keyword.URL if it has a non-default value.
- bug 724145 - telemetry for search hijacking.
Next Actions
- Asa - circle back with Kev if we are ok to keep the feature in FF13.
- Sheila will ping Susan Chen in legal again, just to make sure we aren't violating any partner agreements.
