359060 - Firefox leaks privacy information when handling feeds

Status: VERIFIED DUPLICATE of bug 358878

(Firefox Graveyard :: RSS Discovery and Preview, defect)

Description

[Johannes Walther]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20060811 Minefield/3.0a1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20060811 Minefield/3.0a1

Jared Breland reports in http://www.legroom.net/modules.php?op=modload&name=News&file=article&sid=215 that Firefox transmits private informations to Google when to decide how to handle Web feeds. Information on what feed you're watching is transmitted to Google in the Referer when retrieving the icon for the Web Service Icon.
At this point also Google can also set a cookie (depending on the browsers cookie preferences) to associate this information with further ones (maybe a login to one of their services).

heise news reports on that in http://www.heise-security.co.uk/news/80310 and adds, that this behaviour is also valid for Yahoo!

This is a privacy leak that should be closed. One can argue about the need to retrieve Google's icon every time, but it's absolutely not necessary to send the referer.

Reproducible: Always

Comment 1

[:Gavin Sharp [email: [e-mail]]]

*** This bug has been marked as a duplicate of 358878 ***

Comment 2

[Tanner M. Young [:tmyoung]]

Verified Duplicate.