{"action":"created","issue":{"url":"https://api.github.com/repos/pyllyukko/user.js/issues/45","labels_url":"https://api.github.com/repos/pyllyukko/user.js/issues/45/labels{/name}","comments_url":"https://api.github.com/repos/pyllyukko/user.js/issues/45/comments","events_url":"https://api.github.com/repos/pyllyukko/user.js/issues/45/events","html_url":"https://github.com/pyllyukko/user.js/issues/45","id":102714483,"number":45,"title":"Adjust FF default permissions for all sites ","user":{"login":"CHEF-KOCH","id":727123,"avatar_url":"https://avatars.githubusercontent.com/u/727123?v=3","gravatar_id":"","url":"https://api.github.com/users/CHEF-KOCH","html_url":"https://github.com/CHEF-KOCH","followers_url":"https://api.github.com/users/CHEF-KOCH/followers","following_url":"https://api.github.com/users/CHEF-KOCH/following{/other_user}","gists_url":"https://api.github.com/users/CHEF-KOCH/gists{/gist_id}","starred_url":"https://api.github.com/users/CHEF-KOCH/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/CHEF-KOCH/subscriptions","organizations_url":"https://api.github.com/users/CHEF-KOCH/orgs","repos_url":"https://api.github.com/users/CHEF-KOCH/repos","events_url":"https://api.github.com/users/CHEF-KOCH/events{/privacy}","received_events_url":"https://api.github.com/users/CHEF-KOCH/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-08-24T06:05:55Z","updated_at":"2015-08-26T07:52:24Z","closed_at":null,"body":"My idea is to (by default) adjust the internal permission system to harden some things for every page. Of course in some situations this is not easy e.g. in case you want to allow Push Notif. and such gimmicks that aren't often used (yet). \r\n\r\nTo get into the permission just type <code>about:permissions</code>.\r\n\r\nWe will see the following in FF40+\r\n\r\nName | Value\r\n------------ | -------------\r\nStore Passwords  |  Allow/Block\r\nShare Location  | Always ask / Block\r\nUse the Camera  | Always ask\r\nUse the Microphone   |  Block\r\nSet cookies Allow  |  Allow for session / Block\r\nOpen Pop-up Windows  |  Allow/Block\r\nMaintain Offline Storage  | Always ask / Block\r\nFullscreen  |  Always ask / Block\r\nReceive Push Notifications  |  Always ask / Block\r\n\r\n\r\n![permissions - copy](https://cloud.githubusercontent.com/assets/727123/9433711/a510aede-4a36-11e5-966a-edba444dca16.png)\r\n![permmanager](https://cloud.githubusercontent.com/assets/727123/9488097/b0a5ee7e-4bd7-11e5-8875-dbece43ab09a.png)\r\n\r\n\r\n\r\nSo I suggest to set the options to high, means  _Block_. \r\n\r\n\r\n**What's the problem?**\r\n\r\nCurrently we clean page settings after FF is shutting down. This includes also the site specific settings a user made. \r\n\r\nThis will affect the following settings:\r\n\r\nPref. | Value\r\n------------ | -------------\r\npermissions.default.image  |  1 (no GUI for this, for several reasons)\r\npermissions.manager.defaultsUrl  |  (default)\r\nnetwork.cookie.cookieBehavior  |   (we use 1)\r\nprivacy.sanitize.sanitizeOnShutdown  |  true\r\nprivacy.clearOnShutdown.cache |  true\r\nprivacy.clearOnShutdown.cookies |  true\r\nprivacy.clearOnShutdown.downloads |  true\r\nprivacy.clearOnShutdown.formdata |  true\r\nprivacy.clearOnShutdown.history |  true\r\nprivacy.clearOnShutdown.offlineApps |  true\r\nprivacy.clearOnShutdown.passwords |  true\r\nprivacy.clearOnShutdown.sessions |  true\r\nprivacy.clearOnShutdown.siteSettings |  true\r\n\r\nThe <code>privacy.clearOnShutdown.siteSettings</code> needs to changed to <code>false</code> to not break user specific site preferences.\r\n\r\nAnd some options simply don't have an option to control this by an about:config entry (e.g. the push thing), this means we need to mention this into our readme.md. Correct me if I'm wrong but this wouldn't break any security aspect since the local data folder can't be read-out by external apps and I don't know if an attacker really would have an benefit to grab such settings. "},"comment":{"url":"https://api.github.com/repos/pyllyukko/user.js/issues/comments/134887164","html_url":"https://github.com/pyllyukko/user.js/issues/45#issuecomment-134887164","issue_url":"https://api.github.com/repos/pyllyukko/user.js/issues/45","id":134887164,"user":{"login":"CHEF-KOCH","id":727123,"avatar_url":"https://avatars.githubusercontent.com/u/727123?v=3","gravatar_id":"","url":"https://api.github.com/users/CHEF-KOCH","html_url":"https://github.com/CHEF-KOCH","followers_url":"https://api.github.com/users/CHEF-KOCH/followers","following_url":"https://api.github.com/users/CHEF-KOCH/following{/other_user}","gists_url":"https://api.github.com/users/CHEF-KOCH/gists{/gist_id}","starred_url":"https://api.github.com/users/CHEF-KOCH/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/CHEF-KOCH/subscriptions","organizations_url":"https://api.github.com/users/CHEF-KOCH/orgs","repos_url":"https://api.github.com/users/CHEF-KOCH/repos","events_url":"https://api.github.com/users/CHEF-KOCH/events{/privacy}","received_events_url":"https://api.github.com/users/CHEF-KOCH/received_events","type":"User","site_admin":false},"created_at":"2015-08-26T07:52:24Z","updated_at":"2015-08-26T07:52:24Z","body":"Sorry, I'm staying on the cable. You're talking about the about:permission or site specific GUI?"}}