commit 5c2e8dbbc1593dbc5682f035812cf51862daefcf
parent a3ed2d55e95a2f80b0aca9c1e6df1ec23341a9fc
Author: Benjamin VanderSloot <bvandersloot@mozilla.com>
Date: Mon, 29 Dec 2025 13:28:35 +0000
Bug 1988814 - Finalize the issue card items for security and privacy - r=fluent-reviewers,mkennedy,bolsson
Differential Revision: https://phabricator.services.mozilla.com/D275505
Diffstat:
2 files changed, 23 insertions(+), 30 deletions(-)
diff --git a/browser/components/preferences/privacy.js b/browser/components/preferences/privacy.js
@@ -459,10 +459,6 @@ if (SECURITY_PRIVACY_STATUS_CARD_ENABLED) {
type: "bool",
},
{
- id: "security.disallow_privilegedabout_remote_script_loads",
- type: "bool",
- },
- {
id: "dom.security.skip_html_fragment_assertion",
type: "bool",
},
@@ -1165,7 +1161,6 @@ if (SECURITY_PRIVACY_STATUS_CARD_ENABLED) {
new WarningSettingConfig(
"warningPrivilegedConstraint",
{
- rsl: "security.disallow_privilegedabout_remote_script_loads",
shfa: "dom.security.skip_html_fragment_assertion",
xhtmlcsp: "security.browser_xhtml_csp.enabled",
allowUDPEE: "security.allow_unsafe_dangerous_privileged_evil_eval",
@@ -1178,7 +1173,6 @@ if (SECURITY_PRIVACY_STATUS_CARD_ENABLED) {
"dom.security.skip_remote_script_assertion_in_system_priv_context",
},
({
- rsl,
shfa,
xhtmlcsp,
allowUDPEE,
@@ -1188,7 +1182,6 @@ if (SECURITY_PRIVACY_STATUS_CARD_ENABLED) {
allowParentUnrestrictedJSLoads,
skipRemoteScriptAssertionInSystem,
}) =>
- (!rsl.value && !rsl.locked) ||
(!xhtmlcsp.value && !xhtmlcsp.locked) ||
(shfa.value && !shfa.locked) ||
(allowUDPEE.value && !allowUDPEE.locked) ||
diff --git a/browser/locales-preview/privacyPreferences.ftl b/browser/locales-preview/privacyPreferences.ftl
@@ -51,47 +51,47 @@ security-privacy-issue-warning-test =
security-privacy-issue-warning-fingerprinters =
.label = Known fingerprinters are not blocked
- .description = Allowing fingerprinters may allow you to be tracked without cookies
+ .description = Fingerprinters can track you across websites without using cookies
security-privacy-issue-warning-third-party-cookies =
.label = Third-party cookies are enabled
- .description = Third-party cookies are often used to track users across sites
+ .description = Third-party cookies are often used to track you across sites
security-privacy-issue-warning-password-manager =
.label = Password manager is disabled
- .description = Password managers help you use strong passwords for all of your online accounts
+ .description = Strong, unique passwords for all of your online accounts are harder to maintain
security-privacy-issue-warning-popup-blocker =
.label = Popup blocker is disabled
- .description = Popups are annoying and can be deceptive
+ .description = Annoying and deceptive windows can appear unexpectedly
security-privacy-issue-warning-extension-install =
.label = Websites can install extensions
- .description = Extensions are a powerful feature, and not just every website should install them without asking
+ .description = Extensions are powerful and should not be installed by most websites without your permission
security-privacy-issue-warning-safe-browsing =
.label = Dangerous and deceptive content is not blocked
- .description = Some websites are known to serve malware or phishing pages, and we can block them for you
+ .description = Some websites are known to serve malware or phishing pages, and we are not blocking them for you
security-privacy-issue-warning-doh =
.label = DNS over HTTPS is disabled
- .description = DNS over HTTPS helps hide what websites you visit from your network provider
+ .description = Your network provider can see what websites you visit
security-privacy-issue-warning-ech =
.label = Encrypted Client Hello is disabled
- .description = Encrypted Client Hello helps hide what websites you visit from your network provider
+ .description = Your network provider can see what websites you visit
security-privacy-issue-warning-ct =
.label = Certificate Transparency is disabled
- .description = Rogue certificates allows attackers to intercept traffic, and certificate transparency helps stop them
+ .description = Rogue certificates that may make your connection insecure are harder to detect
security-privacy-issue-warning-crlite =
.label = Certificate revocation is disabled
- .description = Some certificates can become insecure, so websites need to make their certificates no longer valid
+ .description = Certificates that a website no longer trusts can not be disabled
security-privacy-issue-warning-certificate-pinning =
.label = Certificate pinning is disabled
- .description = Rogue certificates allow attackers to intercept traffic, and certificate pinning helps stop them
+ .description = Rogue certificates that may make your connection insecure are harder to detect
security-privacy-issue-warning-tlsmin =
.label = Unsafe TLS versions are enabled
@@ -99,43 +99,43 @@ security-privacy-issue-warning-tlsmin =
security-privacy-issue-warning-tlsmax =
.label = The latest TLS version is disabled
- .description = TLS is how we encrypt your network traffic, and the latest version is the best security we have to offer
+ .description = TLS is how we protect your network traffic, and the latest version is the best security we have to offer
security-privacy-issue-warning-proxy-autodetection =
.label = Proxy auto-configuration is enabled
- .description = Proxy auto-configuration could allow untrusted networks to monitor your web activity
+ .description = Untrusted networks could monitor your web activity
-security-privacy-issue-warning-priveleged-constraint =
- .label = Priveleged context hardening is disabled
- .description = We disable some web features inside of { -brand-short-name } to protect against attacks against your browser
+security-privacy-issue-warning-privileged-constraint =
+ .label = Privileged context hardening is disabled
+ .description = Certain internal browser pages have some web features that could be disabled to improve security
security-privacy-issue-warning-process-sandbox =
.label = Process sandbox features are disabled
- .description = We disable featues for different parts of { -brand-short-name } that don`t need them
+ .description = Some browser components have features enabled that could be disabled to improve security
security-privacy-issue-warning-content-resource-uri =
.label = Resource URI protection is disabled
- .description = Some { -brand-short-name } internal resources should not be available to every website you visit
+ .description = Websites can access { -brand-short-name } internal resources
security-privacy-issue-warning-worker-mime =
.label = Worker MIME type restriction is disabled
- .description = Workers should only be allowed to run content intended to be run as Javascript
+ .description = Content not hosted as Javascript may be run in a worker
security-privacy-issue-warning-top-level-data-uri =
.label = Data URI navigations are not blocked
- .description = Phishing websites sometimes navigate to data: URIs to trick you into entering your information
+ .description = Phishing sites may use this technique to trick you into entering your information
security-privacy-issue-warning-active-mixed-content =
.label = Active mixed content is not blocked
- .description = Websites that load scripts over HTTP are vulnerable to network attackers injecting Javascript to pages you visit
+ .description = Network attackers can inject malicious scripts into some pages you visit
security-privacy-issue-warning-inner-html-ltgt =
.label = HTML attribute sanitization is disabled
- .description = Attackers may try to inject Javascript into a page through the HTML tag attributes
+ .description = Attackers can inject Javascript through HTML tag attributes
security-privacy-issue-warning-file-uri-origin =
.label = File URI strict origin policy is disabled
- .description = Files loaded in { -brand-short-name } should be cross-origin from files in the same folder
+ .description = Local files in the same folder can share information with each other
## DNS-Over-HTTPS
