The add-on management page in the Tor Browser loads discovery.addons.mozilla.org, which includes a Google Analytics script that can, at the moment, not be disabled.
Steps to reproduce:
Open Menu. Select Addons. Select "Get Addons", unless this is already selected.
Expected behaviour:
Does not load any tracking.
Actual behaviour:
Load a tracking script from Google Analytics.
Trac: Username: justJanne
Designs
Child items
...
Show closed items
Linked items
0
Link issues together to show that they're related.
Learn more.
Google Analytics is used by Mozilla under a specific contract that restricts how the data can be used at Google. Mozilla is comfortable that it's not used for tracking purposes.
However, Tor could disable the Discovery Pane altogether by setting the extensions.webservice.discoverURL setting to another website. This would only disable add-on discovery. It would not disable the ability to manage add-ons for the Tor browser.
Relevant upstream bug: [https://github.com/mozilla/addons-frontend/issues/2785 ]
The proposed fix wont work, they're saying that if DNT is enabled then the analytics.js wont load. But DNT is set to false in the Tor Browser (and rightly so). Better fix is to have an option for disabling it. Another alternative fix is to have the Tor Browser block www.google-analytics.com entirely.
Another solution which I think gk will like: always block scripts on about:addons, its functionality will still be there despite JS being disabled (with the exception of a video not rendering out :).
A bit disappointing to see Mozilla do stuff like this without possibility to opt-out. :(
The correct general fix is to make it explicitly opt in, via something like a HTTP header.
Eg: Serve pages that load the analytics js if the HTTP request has X-Mozilla-Tracking-Opt-In set (and only set the header when making requests from the about context, if the user has opted in). However that requires trusting Mozilla to implement and honor the header, so alternatives that do not require such things should be explored.
"Get Addons" is the only tab on about:addons that loads the discovery.addons.mozilla.org page.
Setting the hidden boolean preference extensions.getAddons.showPane to false removes this tab.
"Get Addons" is the only tab on about:addons that loads the discovery.addons.mozilla.org page.
Setting the hidden boolean preference extensions.getAddons.showPane to false removes this tab.
Yep, which we wanted to do anyway for unrelated reasons. Closing this as a duplicate of legacy/trac#22073 (moved).
Trac: Resolution: N/Ato duplicate Status: new to closed