321720 - A password should be required to clear data from history: Tools - Options

Status: RESOLVED WONTFIX

(Firefox :: Private Browsing, enhancement)

Description

[Alan Mills]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7

My daughter, in order to hide her activities from us, went to tools, then options, then Privacy, and, I believe, hit "clear all."  All bookmarks, passwords, and everything were wiped out, even though there was a "Master Password."  It seems that there should be a "Master Password" for and tool activity.

Thank Heavens there is a "Restore" option in system tools.

Reproducible: Always

Steps to Reproduce:
1.  Go to "tools"
2.  Go to "privacy"
3.  Click "Clear all"

Actual Results:  
Everything is wiped out.

Expected Results:  
Firefox should request the "Master Password" to perform this action.

I am sure that I am not the only person who has experienced this.  In fact, I did it myself, by accident once, and immediately went to "System restore."  This should be a useful feature, if instituted, for all system administrators, to check histories of employees, family members, or guests using their computer(s).

Comment 1

[Josh Birnbaum]

Firefox 1.5 no longer has a "Clear All" button.

If someone has physical access to a computer, there will always be a way for them to remove traces of their actions.  It's just a question about how much you want to pretend that they can't, and how noticeable the deletion will be after the fact.

See bug 266945 for a Password Manager specific discussion.

Comment 2

[Alan Mills]

I do not feel that the "tools - Options" section should be available to everyone who uses a computer, just those who know the master password.

Comment 3

[John Vivirito]

This happen is Linux as well, here is the Ubuntu bug related to this.

https://bugs.launchpad.net/firefox/+bug/382107

Comment 5

[Nochum Sossonko [:Natch]]

Confirming, for investigation. This might be a privacy boost of sorts, but consider the fact that history can still be deleted (as well as cookies and passwords) through other mechanisms, making this kind of futile.

Comment 6

[Johnathan Nightingale [:johnath]]

I think this is WONTFIX, but not because I'm not sympathetic, just because I think a) we've mitigated the problem somewhat, and b) doing more than that wouldn't really help things.

As to the mitigation - the new Clear Recent History dialog in Firefox 3.5 makes it harder for this kind of impulsive clearing to have the really exciting consequences Alan describes in comment 0.  We don't offer to clear bookmarks or saved passwords at all any more, so the real loss here would be awesomebar contents, cookies, and form autocomplete.  But the fact that we provide a time span feature (with a 1-hour default) also makes it much less likely that the daughter in question here would wipe out everything. So I assert that the bug, as reported, would not have occurred with our new dialog the way it did with the old one.

Further, making CRH ask for a master password would ignore the multitude of other ways that exist within the browser and without to damage or delete profile and history data. The Master Password is a combination lock to protect saved passwords from prying eyes, but it is not a "login to the browser" feature in the general sense and even if it were, it would still only prevent stealing of private information, not deletion. A local user logged into your machine can delete things at any point - and a sufficiently motivated or mortified teenager might be among the most adept at doing so.

Because I think things are substantially better now (she likely would have just used Private Browsing mode, if she was poking around in the tools menu) and because the perceived incremental win here isn't really a win, and does not justify the code cost, I'm marking this WONTFIX.  Thanks for pinging it, Natch.