196938 - Inability to clear location bar outside of Mozilla may affect security.

Status: RESOLVED WONTFIX

(SeaMonkey :: General, enhancement)

Description

[Michael K]

User-Agent:       Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.3b) Gecko/20030210
Build Identifier: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.3b) Gecko/20030210

One can delete the Mozilla history.dat file, and clear history, but why is there
no file for the Mozilla Location Bar?

Can't this data be placed in a file that can be accessed outside of Mozilla for
ease of creating a 'wipehistory" script???


IS THERE ANY OTHER WAY TO CLEAR LOCATION BAR besides having to open Mozilla,
select EDIT, PREFERENCES, NAVIGATOR, HISTORY, CLEAR LOCATION BAR, and finally
"OK"  ???


Reproducible: Always

Steps to Reproduce:
see above
Actual Results:  
see above

Expected Results:  
see above

Please address this.

I have selected "CRITICAL" severity because I feel that this is a condition that
may preclude the use of Mozilla in a secure environment.

Comment 1

[Matthias Versen [:Matti]]

>I have selected "CRITICAL" severity because I feel that this is a condition that
>may preclude the use of Mozilla in a secure environment.

A secure environment protects your files on the OS/File System Level (File
encryption, Access rights..). 
Upgrade to a real multi-user OS (all OS that mozilla supports except windows9x/ME)

Never critical -> enhancement

-> wontfix since there is no reason for using a new file.
The current autocomplete-list is stored in the file "localstore.rdf" together
with many other things.

Comment 2

[Michael Lefevre]

verified

Comment 3

[Michael K]

OK - I thought security relasted to operational issues, REGARDLESS of
environment.  Silly me.  I see it's in localstore.rdf, but so are a few other
NON-security related features (screen layout, etc) that by deleting that file
create additional issues...

If you were doing credit card processing, or on line patent searches, and FORGOT
to clear your location bar, and a "corporate spy" opened your Mozilla, and saw
your URL list in the location bar, wouldn't YOU call it a SECURITY ISSUE
???(Ignoring that it is possible to clear it, but with a time consuming pocess).

Putting this data in the history.dat would make a LOT more sense.  Don't you
agree????

May I reopen this just to have a comment from the Gods of Mozilla???

Comment 4

[Andreas Kunz]

Michael: with this bug you want to make it not sensationally possible, but just
*potentially* easier to remove traces of surfing behaviour.
You already can delete the data by doing four mouse clicks, so there is no
privacy issue.
What you want is preventing others from seeing what you did by either navigating
to a directory and removing a file there or by writing a batch file that does it
for you. Both seems more time consuming for me than four mouse clicks.
And if you are into writing time consuming batch files it is surely no problem
for you to read the file localstore.rdf and delete a few lines following
"<RDF:Seq about="nc:urlbar-history">". Or just delete every line that contains
URLS you want to visit without others knowing.
Or just delete the entire file: there are only window positions, sidebar status
etc. saved there and it will be recreated on next launch.

Did you know that the location bar only saves URLs you directly enter there?
So no credit card numbers or Google queries or any link clicks are saved.

And did you know that other programs save traces of your usage in the registry
and more hidden places where you definitely cannot remove them by deleting
single files? Have you sent mail to Microsoft they should store the movies you
watched in a separate file, please?

I guess this can be closed again...

Comment 5

[Michael K]

"I guess this can be closed again..."

OK - no problem.

"And if you are into writing time consuming batch files it is surely no problem
for you to read the file localstore.rdf and delete a few lines following
"<RDF:Seq about="nc:urlbar-history">". Or just delete every line that contains
URLS you want to visit without others knowing. Or just delete the entire file:
there are only window positions, sidebar statusetc. saved there and it will be
recreated on next launch."

OK, will do - the batch file is automatic in my autoexec.bat file.

"And did you know that other programs save traces of your usage in the registry
and more hidden places where you definitely cannot remove them by deleting
single files? "

I think I got them all:  :)

cd\
c:
cd\windows\temp
del *.*
cd\windows\Applic~1\Mozilla\Profiles\XXX\xxxxxxxx.xxx\
copy bookmark.bak bookmark.bk1
copy bookmark.htm bookmark.bak
del history.dat
del cookies.txt
del downloads.rdf
del history.mab
copy persdict.dat persdict.bak
copy cookies.sav cookies.txt
cd\windows\Applic~1\Mozilla\Profiles\XXX\xxxxxxxx.xxx\Mail\xxxxxxxx
copy rules.dat rules.bak
cd\
e:
cd\Progra~1\Mozilla.org\cache
del *.*
cd\
c:
exit

Thanks

Comment 6

[Michael K]

Oh yea, forgot these must be deleted from DOS...
CD\
C:
CD\WINDOWS\COOKIES
DEL INDEX.DAT
CD\WINDOWS\TEMPOR~1
DEL INDEX.DAT
CD\
CLS

Comment 7

[Andreas Kunz]

Re-resolving (see comment #5).

Michael: well, that may work as long as no other applications (or plugins, too?)
are involved.