Cannot enable addon in private browsing

[mobd]

I'm unable to use the addon in private browsing. If I try to enable it, it turns off by itself again: I'm not sure if this is a firefox bug or a bug with the addon, but this is the only addon that seems to have this problem. As far as I know, it used to work fine in the past

[M-Reimer]

This is by intention. Websites can detect my Add-on which renders private browsing useless.

[M-Reimer]

I was on my phone when I wrote the above comment, so now, as I'm on my PC, I can add a little bit more background.

The problem with any kind of PDF viewer for Firefox on Android, at least if it is meant to be somewhat convenient to use, is that the only way to implement it with the current API is to hook into the actual page load to replace the real PDF file with the viewer.

This results in the "real" URL to still be displayed in the URL bar, which keeps the possibility to easily copy the URL or to use the Firefox "share" features from the menu to easily share the PDF URL.

But doing it this way comes with an disadvantage. The PDF viewer now is in the context of the original website which gives the original website access to it. Meaning: The original website can pretty easily find out that you are using my Add-on. At least in theory this can be used for fingerprinting.

I decided that I can live with that in "regular browsing" mode. There is a warning about this on my AMO page! But for private browsing I hard disabled my Add-on as there it is pretty important to not have additional characteristics that could be abused for fingerprinting.

[M-Reimer]

Actually I think we can keep this one open. If people don't see my note on the AMO website, maybe they run over this.

This Issue is blocked by either of these: https://bugzilla.mozilla.org/show_bug.cgi?id=1718268 https://bugzilla.mozilla.org/show_bug.cgi?id=1457500

As mentioned above I prevent my Add-on from running in "private mode" by intention as, without any of the above bugs fixed (either one could help with better implementing my Add-on) my Add-on adds a factor which can be used for fingerprinting and I don't want users to enable it in private browsing mode for this reason.

[hackel]

@M-Reimer Would it be possible to add an option that disables the private browsing restriction (with an appropriate warning), or does it have to be hard-coded?

While fingerprinting certainly isn't desirable, it seems pretty unlikely anyone would write a fingerprinter specifically to detect this extension. And 99% of the time I'm copying the URL and pasting it in a non-private tab anyway, so they're getting my data either way.

[ahusain]

@M-Reimer I wanted to make a fork of this add-on so that it is enabled for private browsing (just for my own, insecure use). I assumed this is just a matter of setting "incognito": "spanning" in the manifest.json file, but that does not seem to work - it just hangs in private browsing without loading the pdf. Any advice?

[M-Reimer]

@ahusain I wonder why people want to use private browsing every time. Probably you have a issue here which should be solved differently. I, for example, really hate that Firefox has no Cookie Manager at all on Android and plan to create a simple to use touch friendly Add-on for this which will also have a way to create an (optional) whitelist of allowed domains so all other cookies can be purged every time Firefox is closed to get a fresh cookie profile regularly.

But back to topic. I currently work on a concept which will allow PDF direct viewing in private browsing with minor limitations.

It will not be possible to have the URL of the PDF in the address bar as this requires modification of content which is in the origin of the original page (and so easily detectable). I will also disable "embedded PDF support" for private browsing (even easier to detect). Then I will add the old "resource://...." PDF.js instance back in and do a redirect if you are in private browsing mode. Websites can not detect this but it will not be possible to share the PDF easily this way (as you now are redirected to a "resource://" URL which is only valid for your Firefox installation). With this change it at least is possible to view PDFs without saving them in private browsing mode.

But I still have to find the time to test this and do the needed modifications. Shouldn't be too difficult though as web request handlers can be flagged for "private browsing only" and "non private browsing only" so both should fit nicely into one Add-on.