Firefox To Require Permission For Plug-Ins

Mozilla engineers are in the process of improving the security and speed of Firefox by implementing a permission switch for browser plug-ins.

In a blog post on Wednesday, Mozilla software engineer Jared Wein said that browser plug-ins are often the cause of security problems and system slowdowns and that "click-to-play" code has been added to Firefox nightly developer builds to control the activation of plug-ins.

"When plugins.click_to_play is enabled, plug-ins will require an extra click to activate and start 'playing' content," Wein explains. "This is an incremental step towards securing our users, reducing memory usage, and opening up the Web."

[ Read about Amazon's cloud-based search service. See Amazon Returns To Search Business With CloudSearch. ]

It may also further erode the usage of plug-in technologies such as Adobe Flash on desktop computers. In a Twitter post, privacy researcher Christopher Soghoian notes that the move "essentially kills Flash ads and Flash cookie tracking."

The impact of this new Firefox feature will depend on how it is expressed in default settings and on the various use cases that Firefox engineers end up supporting. For example, the click-to-play feature may include options to allow users to avoid having to reauthorize plug-ins on popular sites like YouTube. Mozilla does not want to make Firefox so secure it's a hassle to use. However, such conveniences could undermine potential security and privacy benefits of requiring users to approve plug-in operation.

Google Chrome has for a while now included a similar permission mechanism for plug-ins, accessed via Settings/Under the Hood/Privacy-Content Settings/Plug-ins. But Chrome's engineers evidently believe that users will have a better experience without having to approve plug-ins: "Run automatically" is singled out as the "recommended" option.

Mozilla is also considering whether to let previously granted plug-in approval expire if the plug-in has not been used in the past 30 days.

Apple recently adopted this expiration date approach to deal with the Flashback trojan that has affected over 600,000 Macs. In its security update released on Thursday, Apple said, "As a security hardening measure, the Java browser plug-in and Java Web Start are deactivated if they are unused for 35 days."

"Click-to-play" for plug-ins is scheduled to arrive in Firefox 14.

When picking endpoint protection software, step one is to ask users what they think. Also in the new, all-digital Security Software: Listen Up! issue of InformationWeek: CIO Chad Fulgham gives us an exclusive look at the agency's new case management system, Sentinel; and a look at how LTE changes mobility. (Free registration required.)