[WebExtensions] Anti-phishing for add-on pages

[desktopd (Desktopd Mozilla Product Lead)]

Continuing the discussion from [WebExtensions] Future of innovative add-ons:

// moz-extension URIs have the form moz-extension://uuid/path. Each
// extension has its own UUID, unique to the machine it’s installed
// on. This is easier and more secure than using the extension ID,
// since it makes it slightly harder to fingerprint for extensions if
// each user uses different URIs for the extension.

Good.

How to make clear that a certain page belongs to a locally-installed add-on the user trusts? This should be implemented because add-ons often handle security-sensitive things and phishing is terrible. Previously we could tell the users the right URIs of the add-on UIs since they are static resource: or chrome: addresses. But with WebExtensions all the addresses are randomized, so this is not good for user experience. (Recognizing moz-extension: part is not enough: you cannot tell the add-on’s name from it)

Resources in WebExtensions should indicate their identities.
Mockup:

This of course should be distinguishable from HTTPS pages or Firefox pages.

[noitidart]

You got some awesome thoughts. But it looks like you’re discussing with you and yourself. haha. Not a bad thing, its a fun read!

[jorgev]

Please file a bug here. That sounds like a good suggestion.

[desktopd (Desktopd Mozilla Product Lead)]

Thank you.
https://bugzilla.mozilla.org/show_bug.cgi?id=1266012