1884725 - In Windows, passkeys authentication under Firefox in anonymous/private mode is logged as it was non-private to Windows Log Event

Status: RESOLVED FIXED

(Core :: DOM: Web Authentication, enhancement)

Description

[patricio.domingues]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0

Steps to reproduce:

• Opened Firefox in private mode in Windows 11
• Log in to a site (e.g., github.com) with passkeys using an Android phone as roaming authenticator

Actual results:

Login is OK.
The situation is that Firefox logs the same messages in Windows Event Log's "Microsoft-Windows-WebAuthN%4Operational.evtx" as it does for non-private mode. Besides the date/time, some of the logged messages contain the remote domain name to which the user seeks authentication and the Windows account SID. This departs from the behavior that one expects from private mode.

Expected results:

When set in "private mode", Firefox should be more reserved in the amount of messages and data that it logs to "Microsoft-Windows-WebAuthN%4Operational.evtx" log.
Other browsers drastically reduce the number of logged messages when an authentication operation is performed in "private mode".

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::DOM: Web Authentication' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[John Schanck [:jschanck]]

Attachment: Bug 1884725 - set private browsing flag in calls to Windows WebAuthn API. r=keeler

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/22e5fd52d74c
set private browsing flag in calls to Windows WebAuthn API. r=keeler

Comment 4

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/22e5fd52d74c