Firefox will block notification pop-up prompts from next year

With the release of Mozilla Firefox 72 in January 2020, users will stop seeing the “allow to show notifications” requests by default

Push notification feature, which served as a great annoyance to many users for the past several years, will be disabled on the Firefox browser from January 2020 by default. According to ZDNet,^[1] the developers of the browser ran an experiment for a month in April to see how visitors interacted with the feature – as it turned out, almost 97% of users disabled or blocked the notifications immediately.^[2]

The feature was first introduced by Google Chrome back in September 2012 and was also adopted by Mozilla Firefox in June next year. Sure enough, the API can be extremely useful, as it allows users to view information from websites they frequent at. However, a few years ago, malicious actors and spammers started to abuse the feature in order to turn a quick profit from endless adverts that are spammed directly into users’ desktop, even when the browser is off.

Due to this reason, as well as the successful experiment back in April, Firefox decided to disable the feature altogether by default. Since January 2020 (the release of Firefox 72), users will no longer see pop-ups on sites that ask to allow notifications to be shown but instead will be provided with a tiny icon in the address bar. Once clicked, users will still be able to enable notifications to be shown if they choose to do so. Firefox hopes that this will help to fight spam and increase the overall experience of users while browsing the web.

Threat actors use social engineering techniques to make users agree to notifications

2-spyware is focused on providing detailed information about various cyberthreats, and, since a few years ago, we noticed an increased amount of websites that are crafted with one intention only: to make users click on the “Allow” button so that notifications for a site to be enabled. For that, malicious actors often use social engineering techniques,^[3] such as:

• Users are promised a video or other underlying content after they click “Allow”
• Crooks use “Click allow to prove you are not a robot” prompts
• Visitors are deceived by misleading claims that 18+ content will be disclosed after allowing notifications.

Additionally, there are countless other tricks used by fraudsters – all to make users believe that they will get something in return as soon as they allow notifications to be shown. Such tricks were used by numerous websites, including System-sms.com,^[4] Facebook-info.com, Pingclock.net, and many others – note how domain names are often associated with legitimate names.

A legitimate API used for malicious purposes

The push notification feature was introduced by major browsers with good intentions – users can receive information that they care about directly from sites they trust. For example, if they enabled notifications from BBC.com, they will be notified when a new article is published. Therefore, the feature definitely has its uses. However, it was taken over by criminals that want to make a quick buck.

The reason for increased numbers of such sites is also because most modern browsers block pop-unders or pop-ups from being shown in the first place,^[5] so the push notification feature has been extremely favorited by malicious actors. Once users subscribe, they start receiving pop-ups regularly at any time when the machine is operational.

This method is also hugely successful because users are unaware of the API feature. Since they start receiving notifications, they are confused about why and how these pesky pop-ups are showing on their screens consistently. Finally, some might also be tricked into clicking on advertisements and end up being redirected to potentially malicious websites. Luckily, the feature can be disabled relatively easily.

Therefore, we highly discourage you from allowing notifications from such scam sites. Fortunately, since Firefox is disabling the feature by default (or rather, making it far less visible), much fewer users will be tricked into subscribing to malicious ads that can compromise their online security and computer safety. Let’s just hope that Chrome and other most used browsers will follow this pattern to make the internet a safer place for everybody.