mullvad / browser-extension Goto Github PK

The external link is used in the carousel and in the recommendations view.

I've tried the Mullvad Privacy Companion and found a bug: The add-on makes Firefox (seemingly needlessly) prompt to unlock the encrypted password store. It's not clear why; as far as I know, no functionality in this add-on requires password access.

STR:

First, install and activate the Mullvad Privacy Companion normally. Make sure the Firefox password store is encrypted with a password.

Either: Disable the Mullvad Privacy Companion add-on. Quit Firefox and relaunch Firefox. No prompt to unlock the password store should appear. Enable the Mullvad Privacy Companion add-on. As you enable the add-on Firefox prompts you to unlock the password store. You can cancel this and continue or supply the unlock password.

Or: Leave the Mullvad Privacy Companion add-on enabled. Quit Firefox and relaunch Firefox. As Firefox comes up it prompts to unlock the password store. You can cancel this and continue or supply the unlock password.

My tests are using Firefox 94.0 (64-bit) on GNU/Linux, the latest Firefox version as I type this.

As a user, I want the title to reflect the view I'm on.

When clicking on the icon in the Privacy Recommendations view, the dropdown appears. However, when clicking again on the icon, the dropdown doesn't close.

Steps to reproduce

• click on the dropdown icon of one of the privacy recommendations
• once the dropdown menu appears, click a second time on the icon

Outcome
The dropdown menu doesn't close.

Expected Outcome
The dropdown menu should close.

Create different profiles with different balance between usability/privacy

When clicking on Learn More in the Home view the user is supposed to be brought to the correct location in the Privacy Recommendation view. However, the introduction of n-scrollbar seems to have broken that logic.

Steps to reproduce:

• Click on Learn More on the uBlock Origin in the Recommendations Carousel

Outcome:
The user is at the top of the Privacy Recommendations view

Expected Outcome:
The Privacy Recommendations view should be scrolled down and show the uBlock Origin card.

Compare for instance commit 41efbf7 where it works as expected

As a user, I want to be able to easily see if there are new articles published in the blog and be kept up to date with what's new with Mullvad.
As a user, I also want to be able to hide news if I'm not interested.

I've been using the Mullvad Privacy Companion Beta for about 3 weeks now,
and I have only one issue.

I have other computers on my network that I need to connect to via my
browser. this is not possible if the proxy is running.

What I've been doing is adding "192.168.1.1/24" to the "no proxy for" entry
in the firefox network settings.
The issue is that this field gets reset whenever the proxy is turned on/off
or when the browser is shut down.

I would suggest keeping the "no proxy for" setting and let it be edited at
will, and/or add an option to "bypass proxy for local connections".

Keep up the good work!

Before we make this repository public, we want to make sure users know how to contribute.

We could display the connection status of either the VPN and/or the proxy, in the URL bar (though there's no guarantee this will be kept in future Firefox versions) or in the extension icon itself.

Create different profiles with different balance between usability/privacy.

HTTPS Everywhere is deprecated and can be replaced by HTTPS-Only mode in Firefox. (See #18 and #19 for HTTPS-Only mode implementation)

As a user, I want to be able to use different socks proxy config per domain.

Containers are well integrated in Firefox and could be useful to improve privacy.

We could look into recommending using them.

See: https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/

Right now, the color of the content and the color of the drawer is too similar, it's hard to quickly know where to start reading.

See: https://bugzilla.mozilla.org/show_bug.cgi?id=1364261

As a user, I want to know which DNS is currently used by the browser.

It would probably make sense to move to Vue 3 now, at the start of the project than at later point.

There's a starter script for Vue3 + Vite which could be interesting, see: https://github.com/antfu/vitesse-webext

• #72

When an extension user is not using Mullvad, we could recommend to them to use DoH and explain how to set it.

It's important to explain, because as of now, simply setting it in the Firefox settings without going to the about:config in Firefox will not force Firefox to use DoH all the time.

Aslo, see #9

All the servers are listed by the server name and not country name. See Switzerland, Germany, UK.

As of now, only the first IP of the list is shown, we should show both IPs if applicable.

To improve privacy, we would like to be able to enable network partitioning from the extension.
See: https://developer.mozilla.org/en-US/docs/Web/Privacy/State_Partitioning#network_partitioning

As a user I want to be recommended to set HTTPS-Only mode.

On MacOS, sometimes the extension ends up in a No connection detected state, when actually a connection is available.

See the video linked for STR:
https://user-images.githubusercontent.com/13787166/157676090-68c72d2c-1600-44cd-80ce-bc6a090740ea.mp4

As a user, I want to report when a website is blocked.

There's no privacy benefits to use DoH when using Mullvad.
If a user has DoH set, we should recommend them to disable it.

Also, see #11

It would be helpful for users to have a changelog between versions.

See: https://github.com/mullvad/coding-guidelines#changelogs

Before we make this repository public, we want to make sure users know how to contribute.

is it possible, to in the extension, select CONTRY insted of individual server? Servers are changed frequently and it will end in users not haveing access to internet since a server was removed or replaced

It's arguably better to use DuckDuckGo, even if it doesn't provide better privacy in the browser by itself.

Maybe we could recommend using another search engine if users are using Google/Bing, etc.

Should be doable with: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/chrome_settings_overrides

As of now, we can only display HTPPS-Only mode status in our extension. We would like to be able to set it from the extension directly.

This is currently not possible, but it is being worked on, see: https://bugzilla.mozilla.org/show_bug.cgi?id=1740744

As you can see, below, the scroll bar is not at the bottom when I was at USA and it refused to scroll any further.

Before we make this repository public, we want to make sure users know how to communicate.

Users are unaware WebRTC disabled is disabled by default which makes some users confused, for example when trying to use Jitsi.

Some ideas to address the issue:

• create a list of websites relying on WebRTC and warn users visiting those websites
• Detect if a website is using WebRTC (Is it possible?)
• Add disabling WebRTC as a recommendation on install and keep it activated by default

Add tests to:

• Carousel empty/not empty
• Location loading/error/loaded
• recommendations card ignored/enabled

Privacy Companion is a great tool but it would be nice it one were able to set separate proxies for different container environments within Firefox. So far I've used an addon called "Container Proxy" for this.

Mozilla has integrated that to their Firefox VPN implementation.

Also see #23

we have seen malicious actors disabling telemetry as a common part of their attempt to lock us out and/or making us unaware of how many user profiles are affected by a malicious addon (usually through "creative" solutions) and so an API would likely be picked up as another way to achieve that.

Having said that, making it an API could as well allow us to control it, and so I'm open to reconsider if the API comes with a solution to prevent it from being abused.

Right now, all permissions are requested on install.
There is a possibility to only request a permission when it is needed.

This would be much better, because we don't want to ask for permission that a user won't need.

See: https://extensionworkshop.com/documentation/develop/request-the-right-permissions/#request-permissions-at-runtime

To do once the extension is ready.

No external API call by default

As a user, I want to have more information about the Privacy Companion when I install and/or update it.

As a user, I also don't want any of it to be annoying.

See: https://extensionworkshop.com/documentation/develop/onboard-upboard-offboard-users/

As a support, I would like the user to be able to be able to easily find the version.

Some users have asked about having a chromium version of the extension.

This should be possible, even though functionality will be even more limited, as the Chromium doesn't expose some of the privacy features.

As a user, I want to set a custom DoH directly through the extension.

This is currently not possible to implement because the Firefox webextension API is not exposing this.

See:

• https://bugzilla.mozilla.org/show_bug.cgi?id=1455425#c21
• https://bugzilla.mozilla.org/show_bug.cgi?id=1595859
• https://bugzilla.mozilla.org/show_bug.cgi?id=1455425
• https://bugzilla.mozilla.org/show_bug.cgi?id=1593788

When user is not using Mullvad, the proxy feature shouldn't be presented to the user, unless a proxy configuration is already set (we need to be able to disconnect).

Mullvad Privacy companion is open source (GPL v3+), and we should aim to open the repository as soon as we feel comfortable doing so.

Before going public we should probably resolve:

• #37
• #72
• #44
• #65
• #46
• #88