User Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:42.0) Gecko/20100101 Firefox/42.0 Build ID: 20151029151421 Steps to reproduce: 1. type something into the search bar, eg. "abc" 2. click somewhere else, eg. click on the address bar 3. click on the search bar Actual results: The search provider was contacted for search suggestions and the search suggestion list is displayed. Expected results: The search provider should only be contacted for search suggestions after the textbox has changed, rather than on focus. This is a issue because it allows the search provider to track users. Normally, no cookies are sent when getting suggestions from the search provider. However, the search box's contents are persisted after a search. Because of this bug, whenever a user tries to type a new search query, the previous search term is sent to the search provider. Therefore it's possible to track users' search history by correlating what the previous search term was.
This behavior change was intentional with the new search UI implemented in bug 1088660 for Firefox 34. The privacy issue described here could be avoided by caching the last search suggestions, so that we don't have to hit the network when reopening the panel for previously typed search terms.
looking at this i would put this at a P5 as a low privacy exposure (since information is already going to the search provider - and the option to turn off suggestions exists). am i missing something?
Priority: -- → P5
looking at this i would put this at a P5 as a low privacy exposure (since information is already going to the search provider - and the option to turn off suggestions exists). florian please correct me if i misinterpreted - otherwise just take off your need info
(In reply to :shell escalante from comment #2) P5 seems reasonable to me; I rephrased the summary to describe the part that's actionable here.
Summary: Searchbar suggestions is displayed on input focus rather than input change → Focusing the searchbar shouldn't refetch suggestions
Status: UNCONFIRMED → NEW
Ever confirmed: true
You need to log in before you can comment on or make changes to this bug.