Can websites see my Firefox Addons?

Question

I know when you visit a website, they can actually see a lot of your personal information, like browser type, but can they also see which addons I've installed?

What about something like Mozilla Plugin Check? How does it know what plugins I have?

I've installed Adblock Plus, but one webpage I visited redirected me because of it. How can it see I've installed ABP, and is there a way to hide this information?

Answer 1

In general, a web site cannot tell what addons you have.

There are two ways that a web site can tell things about a web browser.

1. HTTP headers, such as User-Agent and Cookie, that the browser sends with the request.
2. Javascript code that the browser runs.

The HTTP headers do not include information about your addons. Click the link to view your own headers. Typically Firefox will include its version number, and information about your operating system, in the User-Agent header.

Javascript code that runs in your browser may detect the presence of some add-ons, if the Javascript specifically checks for something that indicates the presence of a particular add-on. Some sites specifically try to check for Adblock. The Adblock programmers try to prevent this but it is an arms-race between the sites and the Adblock programmers. You can block Javascript on a per-site basis with NoScript.

Answer 2

Yes... and no. There's no simple way to do it for the most part, at least not inherently. Read, for example:

http://en.wikipedia.org/wiki/Adblock#Detection

Detection

Some webmasters have used JavaScript to detect the effects of the popular Adblock filters.[17] This has been done by generating a honeypot-like URL and verifying its delivery and also by more advanced verification of the DOM after the web page is rendered in the web browser to ensure the expected advertising elements are present.

These methods do not detect the presence of the Adblock extension directly, only the effects of the filters, and are vulnerable to continued updates to the filters, and by whitelist-filtering web scripts with an extension such as NoScript.

An attempt was made to detect the plug-in itself but that detection method was rendered unusable by the 0.7.5.2 update of Adblock Plus.[18]

So it's more trickery and picking up that the extension is present by finding the side effects and making an educated guess - but they can do it for some things.

As for hiding this information from a server, I don't know - it is probably possible but I know of no method.

Answer 3

I'm positive that I saw a site that would list all of your enabled plugins (other than about:plugins which doesn't count for obvious reasons). However, I can't seem to find it anymore...

Answer 4

Most likely they detected that you didn't load the advertisement, not that you have specifically ABP installed. This is done through javascript, mainly. There are various websites out there that detail how to do it, just visit this Google search and peruse the results.

Answer 5

It could be that rather than Adblock Plus itself the web-page javascript functions detected that some functions in a script provided by their advertiser were missing and redirected you because of that.. sort of an indirect method of detecting Adblock, detecting by it's effects rather than actively finding it.

More than this I don't know, I'm not a Mozilla developer, but I'm certainly curious if plugins are a detectable thing in Firefox. I can see times when it could be both good and bad to have that functionality.