This sounds so bizarre. And be careful, the site in question could be a phishing site to siphon google e-mail account information from the browser via hitherto unknown bug. But I doubt it. Still it is very uncomfortable that my e-mail addresses and A TELEPHONE number is shown even for a second or so. (I am afraid that it can be shown much longer under program control. Shoulder surfing will be easy in a cafe or other public places.) Here is a fact that prompted my post here. I visited a site found in Facebook post using Firefox under windows 10. I post the site URL at the end. CAUTION: Don't click on the site until you read the gory details. When I visited it (the page is very darkish), I thought I saw a strange white rectangular box floating on the screen before the screen is filled with the images from the web site. I thought something was strange and I re-visited the site. A real surprise! I noticed that the white rectangle inside the FF window shown in the dark background contained my e-mailes address AND my smartphone TELEPHONE NUMBER. Whoa? I had to check further. On my Linux PC, where I use FF occasionally (but I don't think I have stored my google e-mail accounts, etc. there), I notice that the visit to the website results in a suggestion box that is shown on the screen that says (in Japanese. I am using Japanese locale) that you can log into the site using google account. (It says, you don't have to remember the password.) I am attaching the screen on Linux version to this post. So I thought maybe the Windows version somehow fails to show this suggestion to let me login to use the google e-mail addresses into the site. And usually, such a prompt shows the list of available google e-mail addresses. (Why the telephone number was there is beyond me. Have I used the telephone number to be the account name in Google service? I don't think so. But who knows. Well, at least when I search for my telephone number in the remembered login account/password from the tools menu of FF, I could not find it. So if the number is fetched from somewhere, it must be from some remembered cookie or local storage of JavaScript. I am going to show the screen of Windows 10 which was captured by screen capture program in the next attachment. (with properly hidden addresses and a telephone number) Strange thing is that while the white rectangle is shown on the screen, the image of the site, except for the menu bar near the top is gone, it's black. So the white rectangle was quite visible for a second. What is causing this display? As I mention above, FF may be trying to list the google e-mail addresses, but - a suggestion to login using google account is not shown under Windows 10 although it was shown on linux PC, and - I wonder why a telephone number is in the list in the white rectangle that disappear after a second or so. My telephone number is NOT a google e-mail address name (or is it?) It seems very fishy. I wonder if someone can explain this as a programming mistake that occurs under Windows 10 only. But at the same time, I do get suspicious that someone is trying to obtain information from cookies (but the-same-origin principle should preclude the access to google cookies?) and/or java storage very earnestly for private information gathering. I am reporting this as security issue. And I think we better keep it that way until someone figures out why such a display of google e-mail addresses and a telephone number occurred. The site in question was: https://www.artstation.com/artwork/J9RzVa I tried to record it using webarchive, but failed. Maybe there is a robots.txt or something that made webarchive not to try to crawl the URL. So the next time you visit the website, you may not see it... At least, it has been reproducible for the last few hours.
Bug 1867335 Comment 0 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
This sounds so bizarre. And be careful, the site in question could be a phishing site to siphon e-mail account information and phone nubmers from the browser via hitherto unknown bug. But I doubt it. Still it is very uncomfortable that my e-mail addresses and A TELEPHONE number is shown even for a second or so. (I am afraid that it can be shown much longer under program control. Shoulder surfing will be easy in a cafe or other public places.) Here is a fact that prompted my post here. I visited a site found in Facebook post using Firefox under windows 10. I post the site URL at the end. CAUTION: Don't click on the site until you read the gory details. When I visited it (the page is very darkish), I thought I saw a strange white rectangular box floating on the screen before the screen is filled with the images from the web site. I thought something was strange and I re-visited the site. A real surprise! I noticed that the white rectangle inside the FF window shown in the dark background contained my e-mailes address AND my smartphone TELEPHONE NUMBER. Whoa? I had to check further. On my Linux PC, where I use FF occasionally (but I don't think I have stored my google e-mail accounts, etc. there), I notice that the visit to the website results in a suggestion box that is shown on the screen that says (in Japanese. I am using Japanese locale) that you can log into the site using google account. (It says, you don't have to remember the password.) I am attaching the screen on Linux version to this post. So I thought maybe the Windows version somehow fails to show this suggestion to let me login to use the google e-mail addresses into the site. And usually, such a prompt shows the list of available google e-mail addresses. (Why the telephone number was there is beyond me. Have I used the telephone number to be the account name in Google service? I don't think so. But who knows. Well, at least when I search for my telephone number in the remembered login account/password from the tools menu of FF, I could not find it. So if the number is fetched from somewhere, it must be from some remembered cookie or local storage of JavaScript. I am going to show the screen of Windows 10 which was captured by screen capture program in the next attachment. (with properly hidden addresses and a telephone number) Strange thing is that while the white rectangle is shown on the screen, the image of the site, except for the menu bar near the top is gone, it's black. So the white rectangle was quite visible for a second. What is causing this display? As I mention above, FF may be trying to list the google e-mail addresses, but - a suggestion to login using google account is not shown under Windows 10 although it was shown on linux PC, and - I wonder why a telephone number is in the list in the white rectangle that disappear after a second or so. My telephone number is NOT a google e-mail address name (or is it?) It seems very fishy. I wonder if someone can explain this as a programming mistake that occurs under Windows 10 only. But at the same time, I do get suspicious that someone is trying to obtain information from cookies (but the-same-origin principle should preclude the access to google cookies?) and/or java storage very earnestly for private information gathering. I am reporting this as security issue. And I think we better keep it that way until someone figures out why such a display of google e-mail addresses and a telephone number occurred. The site in question was: https://www.artstation.com/artwork/J9RzVa I tried to record it using webarchive, but failed. Maybe there is a robots.txt or something that made webarchive not to try to crawl the URL. So the next time you visit the website, you may not see it... At least, it has been reproducible for the last few hours. EDIT: Fixed a few typos and the initial misconception that the e-mail addresses shown were all googles. There is one non-google e-mail address, so my initial theory that FF is tricked into divulging google e-mail address was wrong, I think.