July 28, 2008
Firefox 3: Go Away, Location Bar

I've recently upgraded to Firefox 3 only to notice an ugly new security feature: in order to protect us all from nasty phishers the fine mozilla developers decided that it is for our all best if the location bar cannot be hidden anymore when a website opens up a new window via Javascript's window.open() method. Well, thank you very much guys for so much care - only, I don't like that. Actually I find it totally annoying and patronizing.

So what can be done about it? Fortunately as a self-responsible grown-up you can override the default behaviour in the Firefox presets. These presets are opened by entering "about:config" in the location field. If you do this the first time you will see a warning page in which you confirm that any change will be your own fault, just like in real life.

After confirming this you will see a long list of potentially dangerous settings. Don't touch any except for the one called dom.disable_window_open_feature.location (this list is sorted alphabetically). The default value is "true", but we want to change it to "false" which is accomplished by simply double clicking the row. The line will turn bold in order to show you that this is not the safe default value anymore.

That's all. But don't come back crying to me if some nasty phisher cleared your bank account afterwards.

Posted at July 28, 2008 07:00 PM | Further reading

why don't you like this feature? seems it's only an issue if you are popping fullscreen browser windows which is like so 2002.

(btw your comment form blocks my email address + url)

Posted by: felix on July 28, 2008 07:46 PM

I'm writing creative design tools for a.viary.com where every piece of screen real estate is valuable and - yes we are totally oldschool in opening fullscreen browser windows for our applications.

Posted by: Mario Klingemann on July 28, 2008 07:55 PM

I think it just gives more freedom to the user although more constraints to the developer. As a user I'm happy to be able to see the location, copy it and put it in a tab (even for a.viary). I don't see where it's patronizing since we have more options not like forcing a user to view a site in fullscreen mode.

Posted by: asinomasimple on July 29, 2008 11:36 AM

It's not fullscreen mode I'm talking about - it is opening any new browser window from a script. What I don't like about in particular that it breaks exisiting sites or applications. As an alternative they could have used the same yellow bar technique that is used to show messages like "site xy tried to open a popup window" together with an option "always trust site xy"

Posted by: Mario Klingemann on July 29, 2008 11:49 AM

Enter or type "config" with out quotes in the location bar. It can list out all the entries available in it. You just get through the given information regards your inconvinence..

Posted by: Arul on July 29, 2008 12:35 PM

In saying fullscreen mode I meant the window taking up my whole screen, I guess I'm oldschool that way too ;-)

Posted by: asinomasimple on July 30, 2008 09:33 AM

Can't believe you're so short-sighted about this. Firefox has gained huge traction with "normal" (not overly technical) users who _do_ need protected wherever possible.

There's no way an edge case such as an application from a.viary requiring true full-screen should take precedence over anti-phishing changes.

Posted by: Cameron on July 30, 2008 06:46 PM

As I have said in the comment above - I wouldn't mind if they had done it the same way as it is currently handled with popup blockers or plugin warnings - yellow bar on top with a "settings" button that allows me to adjust this feature individually per-site. This would also make it much clearer that this is all about security.

I just find the way it is solved now visually very ugly and the fact that it is an all-or-nothing choice pretty lame.

Posted by: Mario Klingemann on July 30, 2008 06:56 PM

I'm with you Mario. Having an URL address in an online application widow is totally useless. It's not only taking allot of real estate but also block the possibility to have a custom menu bar just under the title bar. I guess these kind of annoyances will help Adobe Air gain popularity for RIA.

By the way, I'm not the other Felix complaining about his email address

Posted by: felix_m on July 31, 2008 05:21 PM

Are you saying you're a self-responsible grown-up? Sure don't sound like it the way you talk. Mozilla developers didn't develop this just for you, get used to it.

Posted by: Ah Ha on August 1, 2008 10:32 PM

Is it so obstructing? Nevertheless, the tip of modifying FF presets you shared is nice.

Posted by: Dave on August 8, 2008 12:11 PM
Post a comment

Email Address:



Remember info?

Thank you!

Most Visited Entries
Sketches, Works & Source Code
In Love with
Powered by
Movable Type 2.661

© Copyright Mario Klingemann

Syndicate this site:
RSS 1.0 - RSS 2.0

Quasimondo @ flickr
Quasimondo @ LinkedIn
Quasimondo @ Twitter
Quasimondo @ Facebook
Quasimondo @ MySpace
Quasimondo is a Bright
Citizen of the TRansnational Republic
My other blog in german

My family name is written Klingemann,
not Klingelmann, Klingeman, Klingaman, Kingemann,
Kindermann, Killingaman, Klingman, Klingmann, Klingonman
Klingemman, Cleangerman, Klingerman or Kleangerman

profile for Quasimondo at Stack Overflow, Q&A for professional and enthusiast programmers