Summary: RFE to add a "Prompt to send e-mail address as anonymous FTP password" preference for use by those who sometimes, rather than always or never, wish to have that done. Background for this request is in Bug 16964. The reporter of that bug report wants the Mozilla product to help prevent e-mail address harvesting by bait-and-switch honourless "businessmen" - he uses Messenger as his primary e-mail package, so setting a null or invalid e-mail address won't work for him. One way that e-mail addresses could be harvested is by sending some of the switched-in page content from an anonymous web server. If the "Send my e-mail address as anonymous FTP password" preference is in its default on state, a simple <IMG SRC="ftp://... URL would do the trick. To deal with that, one could turn off that preference, but then there is always the problem of, after switching the preference off, needing to turn it on to do a download, and then forgetting to turn it off again. Fewer sites seem to require the e-mail address nowadays, but that only makes it worse: it's harder to remember to turn off the pref again if the last time was months ago. This could be dealt with by adding a new preference: "Prompt to send e-mail address as anonymous FTP password" inset from the existing pref much like "Enable javascript for Mail and News" is inset from "Enable Javascript." The point of this would be to enable a popup dialog box asking for confirmation before sending the e-mail address as part of the FTP exchange. Those that want to always or never send their e-mail address would continue to be well served by the existing preference, and those who want to occasionally send it would be served by the new preference. For logic's sake, this new option could be greyed out when the "Send my e-mail address as anonymous FTP password" preference is on, or instead, it could always be available, but enabling it would grey out the existing preference.

Moving to MailNews Product

Not sure if this is really a Navigator issue or an FTP issue. It's definitely not a mail/news issue. Reassigning to don, cc valeski.

Clearing my name from QA contact then.

Over to valeski.

Bulk move of all Networking-Core (to be deleted component) bugs to new Networking component.

spam: in my testing realm, so reassigning qa contact to me, en masse.

*** Bug 35317 has been marked as a duplicate of this bug. ***

robert-- welcome to necko!

6.0 is past the stage for new features

see also bug 27973, giving e-mail address to ftp servers shouldn't be on by default.

Adding "privacy" keyword. This is a privacy but not a security issue; if the "Send my e-mail address as anonymous FTP password" pref is turned off, Mozilla protects the user's e-mail identity, but under real-world usage, that pref may be left on longer than the user originally intended.

Hi dougt, welcome to necko :)

is this a dupe of http://bugzilla.mozilla.org/show_bug.cgi?id=57763 ?

No, this bug and bug 57763, ""send e-mail address as anonymous ftp passwd" doesn't work" are orthogonal. This bug is advocating an effective third state for the advanced.mailFTP pref: add "ask" to the existing "yes" and "no", like so: +---- FTP Password -----------------------------------------+ | ( ) Send email address as FTP password | | (*) Do not send email address as FTP password | | ( ) Ask before sending email address as FTP password | +-----------------------------------------------------------+ ... and then following through on the backend by asking each time before sending the email address to an FTP server if "ask" is selected. (Note that before the fix for bug 57763, anyone using MailNews as a primary mail user agent would not have had the option of using a null or bogus email address to avoid leaking their real address to FTP sites -- if advanced.mailFTP="yes" had been working, that is!) Bug 57763 is asking for the real email address to be sent when the user wants it to be, i.e., when advanced.mailFTP is set to "yes" (instead of the fake "mozilla@" address). If I'm reading the patch (attach_id=26677) correctly, it appears that the user will have the option of specifying the email address to be sent to FTP servers independently of any "real" address used by MailNews. From a privacy standpoint, that makes this RFE less important, because the cautious user will be able to use a bogus email address for FTP, leave advanced.mailFTP set to yes, and not worry about turning it on and off. For those who would prefer to use their real email address (perhaps bogus addresses in intranet server logfiles are frowned upon by an employer?), though, the "ask" option this RFE is asking for would continue to be useful. At the same time, now that the there are two FTP prefs on the Advanced pane, moving them into their their own section like so: +---- FTP Password -----------------------------------------+ | ( ) Send email address as FTP password | | (*) Do not send email address as FTP password | | ( ) Ask before sending email address as FTP password | | Use this email address: ________________________ | | <small>Most FTP servers will allow you to download | | content even if you do not send a password, but some | | may not. You can specify the e-mail address to send. | | </small> | +-----------------------------------------------------------+ would clean up the UI somewhat and make these prefs more visible. Implementation note: adding the front end for this RFE would touch most of the same files as the patch for bug 57763 would; the backend code that actually sends the email address would need new logic to throw up an alert iff the pref is set to "ask", and then send either the network.ftp.anonymous_password email addredd or the fake "mozilla@" address depending on the user's choice. Second implementation note: if it would break things to change advanced.mailFTP from a bool, a new boolean pref, say, "advanced.mailFTP.ask" could be added; the backend code would check it first: iff "yes", ask the user each time; if "no", use advanced.mailFTP to decide what to send for an anon FTP password. The UI could still be radio buttons; otherwise, the UI would need to grey out the advanced.mailFTP checkbox if the advanced.mailFTP.ask checkbox was checked.

Ack. Sorry for the extra spam. Fixing Summary from: "RFE: pref for "Prompt to send e-mail address as FTP password"" to "RFE: pref for "Ask before sending email address as FTP password"" to disambiguate it from the summary for bug 57763.

if someone does the frontend work, I will do the backend work. assigning to ben.

mass move, v2. qa to me.

qa to tever -> ftp NOTE: There should be some consideration for supporting selection of any email address that is configured in mailnews.

Hmm, there should also be some design concerns about ftp | mail modularity this feature would depend on mailnews being installed...

I think we should WONTFIX this bug. These days, nobody sensible user types their real email address because of spam. No sensible email admin depends on email validation as a form of tracking usage.

So should we remove the "Send this e-mail address as anonymous FTP password" pref from advanced prefs?

This feature was never integrated into any mailnews config or migration. (bug 55030 #9) So, this is a privacy RFE over a feature that was never implemented. I think we should WONTFIX this bug. MailNews doesn't even seem to have an RFE to populate this field, absent a feature that does that, this is purely something a user would have to activate by both: checking the box, and entering an alternative anonymous ftp password (bug 57763 #28) I think leaving the pref where you can change the default anonymous password to your own choice is still useful. I've filed bug 202370, which suggests we change the prefs text to not say "email". This would largely put all these FTP steals email address concerns to rest.

Mass reassign of my non-Firefox bugs to ben_seamonkey@hotmail.com