Tridactyl: preference reverted in user.js

(Beta users: sorry if you're seeing this a second time. Mozilla asked us to change how we reverted the setting, so we have had to do it a second time for you.)

You're seeing this page because Tridactyl thinks you ran the fixamo command at some point. This command changed two preferences in your user.js file: extensions.webextensions.restrictedDomains and privacy.resistFingerprinting.block_mozAddonManager. Mozilla reviewers think the restrictedDomains setting is very dangerous and should never be changed by end users and also want us to reset the block_mozAddonManager setting so that "the standard security level set by Firefox is met". They gave Tridactyl maintainers an ultimatum: either remove the command and the changes it made to user's files before October 2019 or be blocked.

Tridactyl maintainers reluctantly complied and Tridactyl has restored the preferences to their original values by removing them from your user.js. It also added a new preference named tridactyl.unfixedamo2 to prevent this reversion script from altering this preference again. Firefox will adopt these changes on next startup. You may want to restart now.

We are not aware of any exploitation of the vulnerability opened by changing these preferences, but, to the best of our knowledge, you were potentially vulnerable if you have or had a sufficiently malicious addon installed with permission to run on the restricted domains and you have firefox credentials to steal.

In this case, the malicious addon could steal your credentials, your Firefox sync data, and impersonate you on almost any Mozilla site. If that sounds worrying, you should be aware that it is part of the WebExtension security model that any malicious addon can monitor your activity, steal credentials, and impersonate you to any site you visit that the addon has permission to run on.

If you believe you have been compromised you may want to uninstall whatever malicious addon you have and any other addons that you don't remember installing; then change all your Mozilla-related passwords then your passwords for any service that you have ever accessed while that malicious addon was installed and any passwords in your Firefox passwords database. If your other sync data (history, bookmarks, etc) are sensitive then you may want to take other actions. Finally, please also notify us (contact details on GitHub project page) and tell Mozilla security about the malicious addon.

If Tridactyl ever provides another feature that allows users to trade security for usability, we will: seek pre-approval from Mozilla; more prominently feature security information; and require users to indicate their informed consent before activation.

You can find more information here.

All the best,
The Tridactyl Maintainers