Security/Reviews/F1 (round 2)

From MozillaWiki
Jump to navigation Jump to search
The printable version is no longer supported and may have rendering errors. Please update your browser bookmarks and please use the default browser print function instead.

Items Reviewed

F1 :: retooled version of the link sharing service we looked at in May (https://wiki.mozilla.org/Security/Reviews/F1)

Introduce Feature (5-10 minutes)

  • Initial release will be "Firefox Share (alpha)
    • F1 team is considering this as a labs alpha release
  • method for allowing users to share content on their social networks & later email
    • Twitter, Facebook and GMail will be in the initial release
      • Twitter uses oauth1, secret will be in the addon
      • Facebook uses oauth2, requires no secret
      • GMail uses oauth1, but we're using the "anonymous" secret
        • UX is not great with the anonymous secret
      • GMail uses smtp with xauth (oauth token in place of password)
        • smtp is provided in chrome code, an injected api provides access
  • F1 is now a mediator for the "share" activity
    • installs specialized webapps for facebook, twitter and gmail to bootstrap sharing

Differs from OWA (Open Web Applicaiton) because:

  • mediator for F1 is more elaborate than default for OWA
  • provides OAuth as an authentication api
    • pops up a login dialog
  • we would prefer to not use OAuth where possible (depends on service providers)
    • it is not possible at this time to get away from oauth, it is still a goal over time
    • Yes, just "native" OWA if possible.

Goal of Feature, what is trying to be achieved (problem solved, use cases, etc)

  • Attempting to make the sharing of web data easier for users
    • remove the NASCAR effect of sharing buttons on an item (longer term goal)

What solutions/approaches were considered other than the proposed solution?

  • Client-Server arch of previous has been abandoned for a browser only solution using OWA
  • possibly build F1 into OWA directly to avoid cross application issues
    • F1 currently includes OWA and oauthorizer addons, both jetpack based

Why was this solution chosen?

  • better privacy protection for users
  • does not put Mozilla in a postition to hold possibly private data / auth secrets for the user
    • this data is currently stored in localstorage of each app (for alpha release)
    • data to be stored chrome-side in future releases

Any security threats already considered in the design and why?

  • ^^ see previous discussion & OWA items

Threat Brainstorming (30-40 minutes)

  • Screenshot image leakage (potentially sensitive data shows up in screenshots that are shared)
    • page screenshot has been removed
    • only works for email which is not in current implementation, might be dropped due to privacy concerns
    • Shane says probably it will just be pulled out.
  • Can arbitrary content invoke the OAuth flow/dialog ?
    • the login flow/dialog is a part of the flow of the mediator now and cannot be initiated from content
    • IF content has oauth tokens for the service/user, they can initiate oauth API calls, this will be changed soon
    • as of right now yes, this is a property of the injector that needs to be fixed
    • by design no, this is due to reuse of injector code
      • good thing to test during implementation review/penetration testing
  • potential clickjacking due to dialog being displayed over content, possibly phishing also by mimicing the experience (particularly in full screen mode)
    • potential mitigation - exit fullscreen mode when dialog is shown
    • I don't see this as an F1/OWA problem, but rather a generic issue with panels. we could mitigate in F1/OWA, but the problem still exists for lots of other features in firefox (shanec)
  • Starting Share/F1 (or any activity) could be the "new window.open()"
    • jstenback is the person to talk to about trusted events being required for startActivity

Conclusions / Action Items (10-20 minutes)

  • [scaraveo]Need to figure out if the temporary part for Twitter OAuth will end up in the product, or if we can cut it out before the first release.
  • [scaraveo]Final decision on screenshot thumbnail sharing
    • This decision will need to be communicated back to secteam
  • [scaraveo] bug to track fixing the of OAuth flow/dialog/injector
Retrieved from "https://wiki.mozilla.org/index.php?title=Security/Reviews/F1_(round_2)&oldid=383698"