Re: Helping ensure privacy + security

On 11/5/15 9:11 PM, Chris Antaki wrote:
> Disabling plugin enumeration made it more difficult to grab every enabled plugin in one fell loop. In my opinion, it made Firefox more secure, even if it wasn't perfect. It still made mass surveillance more difficult and expensive, which is realistically one of the strongest courses of action we have as privacy activists.
>
> I wish Firefox had kept the setting. It was removed because it caused poorly coded sites to break, and wasn't a perfect feature. I worry that the*exact*  same logic could be used to remove the ability to disable cookies and WebRTC in Firefox.
>
> Chris P's suggestion to disable all plugins works in both Chrome and Firefox though, which is kind of amazing.

I still feel that hiding the plugin names is untenable because you can't 
fix all the websites and the plugin names are still visible to trackers 
that query them using a list of known plugin names. In contrast, 
disabling plugins by default and selectively allow plugins on the 
websites you care about is more private and doesn't break websites.

For example, assume you want to use the Google Earth plugin. If plugin 
enumeration is disabled, then you must whitelist the Google Earth 
plugin, thus exposing the plugin to ALL websites and trackers. If you 
instead selectively plugins only on the websites that need them, then 
you only need to expose Google Earth plugin to google.com.


chris p.