1320465 - Favicon is added to bookmark in Private Browsing mode

Status: VERIFIED WONTFIX

(Firefox :: Private Browsing, defect)

Description

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

STR:
1. On new profile without any history and bookmarks added, create the new bookmark by editing some existing bookmark (like for example: "https://www.mozilla.org/en-US/" ).
2. Start Private Mode
3. Open newly created bookmark and see that favicon is added and is staying even after browser restart in "places.sqlite" file in normal mode.

This shouldn't happen, because it's violating privacy per leaking history data.
Either don't save favicon or remember favicon only for Private Browsing session.

This is also visible after importing bookmarks and browsing them in Private Mode.

Comment 1

[Marco Bonardo [:mak]]

this is not a bug, we do that on purpose, bookmark favicons are allowed to bypass PB, since bookmarks persist to PB (you can also create bookmarks while in PB).
We don't consider that a privacy violation cause if you have a bookmark to a page, it's very likely you visited or will visit it.

Comment 2

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

Fair enough answer, thank you very much.

Comment 3

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

Basing on this:
https://github.com/jonasstrehle/supercookie
https://supercookie.me/workwise
reopening and requesting reevaluation of measurements.

I suspect TOR will also love this.

Comment 4

[Marco Bonardo [:mak]]

Storing favicons in the Places cache has nothing to do with Supercookies, because that cache is not accessible from content, nor used to make decisions about whether to load the icon from the network. Provided someone can reproduce the supercookie bug in Firefox, that bug would be only related to network cache isolation.