Keyoxide: aspe:keyoxide.org:KI5WYVI3WGWSIGMOKOOOGF4JAE (think PGP key but modern and easier to use)

  • 0 Posts
  • 24 Comments
Joined 2 years ago
cake
Cake day: June 18th, 2023

help-circle


  • As best I can tell, Mull is us.spotco.fennec_dos, so on that list.
    Mulch is likely us.spotco.mulch based on mulch webview being us.spotco.mulch_wv, neither are on the list.

    My interpretation here is that Mulch uses some other system, perhaps that mentioned api or something else entirely. Therefore it needs no explicit mention and just works. It might be that it previously did not support that system, or bitwarden didn’t, but somehow now it does.
    On the other hand, Mull still requires the manual compat lsit for whatever reason, therefore now in ironfox you run into that issue. In Mull it was likely solved before you ever used it.



  • Maybe bitwarden has a hardcoded list of browsers and defaults to the app id otherwise? There could also be an override, but if not you’d have to open an issue with bitwarden and wait for them to update their list.

    Edit:
    Looking into the code there is indeed a hardcoded list.
    This file contains the code

    // Docs state that password fields cannot be reliably saved in Compat mode since they will show as
    // masked values.
    bool? compatRequest = null;
    if (Build.VERSION.SdkInt >= BuildVersionCodes.Q && fillRequest != null)
    {
        // Attempt to automatically establish compat request mode on Android 10+
        compatRequest = (fillRequest.Flags | FillRequest.FlagCompatibilityModeRequest) == fillRequest.Flags;
    }
    var compatBrowser = compatRequest ?? CompatBrowsers.Contains(parser.PackageName);
    

    I read this as:
    There are browsers that do “native” autofill and ones that do “compat”. Mull and ironfox do compat.
    This compat support is communicated on Android 10+, but either on older android or maybe if the app is built for older android (?) it won’t be communicated, thus the hard coded list.

    Doesn’t look like there is a way for users to add to this list.





  • Yeah that seems about right.

    I don’t know how the versioning works for the Android versions here…

    Android has the same versions as desktop here, which is why there is no differentiation. The main chunk of firefox is platform independent (and even used in thunderbird too).

    So any firefox android app and fork thereof needs that version 131.0.3+ too (unless it is esr which is 128 currently).











  • Careful, Google is currently forcing apps to migrate from SafetyNet to PlayProtect!
    SafetyNet is used by tons of security theater apps like banking 2FA. It is an API of play services.
    PlayProtect is basically the same but you have to talk to it though google play. This is a blatant move by google to make exactly what OP is suggesting impossible, and means that if you do this, you may soon see many apps break that you are forced to use.


  • Yes, those could be detected.
    Ill see how large that portion is on my system in a bit, but I would expect it to come out as the minority.

    Non-detectible ones I can think of rn:

    • Tab muting manager
    • VPN manager
    • link redirect skippers
    • stats printers, like a tab counter
    • dynamic shortcuts, like opening the archived version of the current page on archive.org
    • old reddit redirect
    • cookie managers

    Many more of the ones you listed won’t be detectable on most websites.

    userscript managers (grease/tamper/violentmonkey etc.)

    A userscript manager is by definition detectible only on pages you define or install a userscript for. Even then, modern userscript managers like tampermonkey are running scripts in a separate scope that is completely sandboxed from the actual websites js context, you can’t even pass an object or function to the website and access it there, it will fail.
    Youtube has actively fought some userscripts and failed, which they probably wouldn’t have if those userscripts were detectible.

    User theme managers should be similar, but I can’t comment on them as I don’t use any.

    page translators

    Translators are only detectible when enabled.

    addons serving in-browser ads

    Why would you have an addon that serves ads?

    site-specific UI improvements (RES, SponsorBlock, youtube/SNS tweaks)

    Are site-specific, i.e. not detectible anywhere else

    privacy blockers (CanvasBlocker/JShelter/etc.)

    Please don’t use those anymore, use only uBo. Same for uMatrix.
    uBo is pretty good about not being detected, for obvious reasons.