claustromaniac / httpz

Fat-free hardenable opportunistic encryption for Firefox
https://addons.mozilla.org/firefox/addon/httpz/
GNU General Public License v3.0
61 stars 5 forks source link

Show list of exceptions added to whitelist #5

Closed Maryse47 closed 5 years ago

Maryse47 commented 5 years ago

Unless I'm mistaken, currently user's exceptions aren't listed anywhere in addon options so it's hard track them. I think it would be nice to have list of them with the ability to delete specific sites.

ghost commented 5 years ago

Indeed, user's exceptions aren't listed anywhere in addon options nevertheless if the idea is only to spot them it's always possible to check

[USER_PROFILE]/browser-extension-data\httpz@cm.org\storage.js

It can even be manually edited (once Firefox closed) but that's a bit of a prehistorical way of doing things, I guess!

in4u commented 5 years ago

Please don't implement this feature without providing support for incognito mode. There should be an option to exclude sites in incognito mode from being added to the exceptions list.

Maryse47 commented 5 years ago

@in4u I don't see your comment being related to this issue. As you see in the above, exceptions are saved right now in [USER_PROFILE]/browser-extension-data\httpz@cm.org\storage.js.

in4u commented 5 years ago

Yes, I am aware that the exceptions are stored there. In fact, in the absence of incognito mode, better there instead of main interface!

As for the comment relation issue, the only reason I posted here instead of opening a separate feature request for incognito mode is that I don't feel any strong need for it unless your proposed enhancement is implemented.

Gitoffthelawn commented 5 years ago

Now that FF stores data in sqlite files (and not simple storage.js files), this functionality is probably even more important.

claustromaniac commented 5 years ago

Please try 0.7.0b.

Note that hostnames added to the whitelist from an incognito window are only invisible if added via the icon's popup. I'm not sure I'm going to leave it that way.

in4u commented 5 years ago

@claustromaniac Seems OK to me.

I suggest highlighting info regarding incognito whitelisting behaviour (probably in the toolbar icon description itself) so that people are aware of it and don't raise issues about sites missing from the whitelisted hostnames list.

Another thing I noticed is that the icon for a site sometimes remains disabled and comes back on randomly (either after few tabs are opened/closed, or browser is restarted, or site is reloaded in new window/tab, or cache is refreshed, etc. I can't pinpoint the actual trigger). But this is a pre-existing problem which has nothing to do with your latest update. I don't use the icon so it has never bothered me.

claustromaniac commented 5 years ago

Thanks for testing, and for the suggestions.

Another thing I noticed is that the icon for a site sometimes remains disabled and comes back on randomly ...

What you describe might not be a problem at all. The extension is only meant to kick in when the browser tries to navigate to an http site, and only show the icon then (or when you navigate to a whitelisted site). When you navigate to a site over https (like by clicking a link or using a bookmark or so) HTTPZ is not meant to show the icon there.

If you want to see the extension in action, edit the URL in this tab and change the scheme to http (as in http://github.com/claustromaniac/httpz/issues/5).

in4u commented 5 years ago

What you describe might not be a problem at all. The extension is only meant to kick in when the browser tries to navigate to an http site, and only show the icon then (or when you navigate to a whitelisted site).

The specific problem which I encountered while testing was that occasionally an http link whitelisted in incognito mode had the icon disabled leaving no way to remove that site from whitelist until one of the random tricks I mentioned in my previous comment re-activated the icon.

Anyway, I have two more suggestions:

  1. Provide a button in the settings to clear or empty the whitelist (it should remove all the incognito entries too).

  2. Provide export/backup and import/restore option for settings (all HTTPZ settings, not just the whitelisted hostnames). Take feedback from others on whether a section containing whitelisted incognito entries should be included in the settings file for manual viewing/editing or whether it should be encrypted or else not included at all. I have no special preference and am okay with the settings being exported as plain text, json, xml, etc.

Gitoffthelawn commented 5 years ago
  1. Provide a button in the settings to clear or empty the whitelist (it should remove all the incognito entries too).

Good idea.

  1. Provide export/backup and import/restore option for settings (all HTTPZ settings, not just the whitelisted hostnames)

Great idea.

Take feedback from others on whether a section containing whitelisted incognito entries should be included in the settings file for manual viewing/editing or whether it should be encrypted or else not included at all. I have no special preference...

I'm fine with them being included for manual viewing/editing.

...and am okay with the settings being exported as plain text, json, xml, etc.

Me as well.

claustromaniac commented 5 years ago

The specific problem which I encountered while testing was that occasionally an http link whitelisted in incognito mode had the icon disabled leaving no way to remove that site from whitelist until one of the random tricks I mentioned in my previous comment re-activated the icon.

Should be fixed in 0.7.0b2. It was due to an oversight, thanks for reporting.

As for your other suggestions, I tried to add those too to the 0.7.0b2 release, as best as I could.

in4u commented 5 years ago

Surprisingly, in this version, whitelisting feature is not working for me at all. Choosing to whitelist from the icon has absolutely no effect regardless of being in normal or incognito mode. It doesn't even show up in the options page or exported file. On manually entering the hostname, it shows up in the exported file and is visible in the options page too but the feature does not work as intended and the site is treated as non-whitelisted.

claustromaniac commented 5 years ago

Can you give me an example of a site you can't whitelist? I couldn't reproduce that issue on my end. If you don't mind, open a new issue for that (or for further suggestions), to avoid going off-topic and keep some order.

in4u commented 5 years ago

Any site, e.g. example.com. My settings are:

{
    "ignorePeriod": 0,
    "ignored": {},
    "incognitoWhitelist": {},
    "knownSecure": {},
    "rememberSecureSites": false,
    "whitelist": {}
}

I think it's better if you create a new issue requesting feedback for the beta version so that others may also test and pitch in. Otherwise I'll open my issue in a day or two after playing around a bit more.