Security

Blocking popups in FireFox

One of the most compelling features of Firefox, for many users, is its built-in pop-up blocking. However, the advertising networks and webmasters looking to inflict pop-up ads on users weren't content to allow Firefox users (or anyone else, for that matter) to browse in peace. It's not surprising that, as Firefox gains in popularity, the Mozilla team would be faced with an "arms race" with advertisers determined to spawn pop-ups on all visitors to sponsored sites.

This writer has recently noticed that some sites had begun spawning pop-ups, despite the fact that Firefox's preferences had been configured to block them. After so long without having to cope with pop-ups, it was doubly annoying to see the nuisance starting all over again.

For the most part, before Firefox and other pop-up blockers appeared on the scene, pop-ups and pop-unders were spawned by JavaScript as soon as a site loads. The Firefox pop-up blocking settings were very successful in blocking almost all pop-up ads. The notable exception, at least for this user, was the New York Times website, which was one of the first sites to find a workaround for Firefox's pop-up blocking.

JavaScript, however, is not the only method that can be used to spawn pop-ups. Notably, Flash, Java and other plugins are capable of spawning pop-ups and bypass the restrictions used to stop pop-ups spawned by JavaScript. To start blocking pop-ups on sites that take advantage of features in Flash or Java to spawn pop-ups, users can install the Pop-ups Must Die! extension.

Alternately, users can get the same effect by manually fine-tuning Firefox's settings. The first change, adding "privacy.popups.disable_from_plugins" is described here. The extension also changes the value of "dom.popup_allowed_events" to block all allowed pop-up events. This can be done by entering "about:config" in the Firefox address bar, and finding "dom.popup_allowed_events," and removing all of the options. These are the only two changes made by the extension.

The changes seem to have been very effective -- perhaps a little too effective. Several users have complained that the extension blocks requested pop-ups as well. This is true, but Firefox still allows users to whitelist sites after a pop-up has been blocked by the new settings. This writer considers it a small price to pay to avoid unrequested pop-ups. For those who would rather deal with the occasional unrequested pop-up, one may change "privacy.popups.disable_from_plugins" to "1" to allow pop-ups to be opened when a link is clicked. This will limit the number of windows opened by a link, so nefarious webmasters cannot open an unlimited number of windows.

Determined webmasters, however, can find ways to inflict advertising on users in other ways. Consider this site which was pointed out in the discussion about the "Pop-ups Must Die!" extension. Rather than spawning a pop-up, it creates a frame within the window that blocks the content of the site until the frame "window" is closed. Without disabling frames, which would cause a great deal of problems for sites that use them legitimately, it's difficult to imagine how one could avoid this kind of "pop-up." (Note, disabling frames by changing the value of "browser.frames.enabled" to false appears to break Firefox entirely.)

Ultimately, the best solution may not rest with Firefox. Users who are offended by pop-ups, and other intrusive advertising, have an infallible weapon at their disposal -- stop visiting sites that insist on using pop-ups. While it would require a great number of users to be effective, even the most persistent webmasters and advertisers would have to reconsider their methods if they have no audience for their ads.

Comments (7 posted)

Dnsmasq: poisoning and DoS

Comments (none posted)

gaim: buffer overflow, DoS

Comments (none posted)

kernel: multiple vulnerabilities

Comments (1 posted)

limewire: input validation errors

Comments (none posted)

remstats: tempfile, missing input sanitizing

Comments (none posted)

php4: denial of service vulnerabilities

Comments (none posted)

sharutils: insecure temporary files

Comments (1 posted)

sylpheed: buffer overflow on message

Comments (none posted)

wu-ftpd: missing input sanitizing

Comments (none posted)