553124 - After bug 147777 lands, private browsing doesn't need to disable coloring of visited links any more

Status: RESOLVED WONTFIX

(Firefox :: Private Browsing, defect)

Description

[(no longer active)]

With bug 147777, the privacy concerns of enabling visited link coloring in private browsing mode no longer apply, so they should be removed.

Comment 1

[(no longer active)]

Attachment: Patch (v1)

This is basically a backout of these two revisions:

http://hg.mozilla.org/mozilla-central/rev/db0c3219ed3d
http://hg.mozilla.org/mozilla-central/rev/0de77eb4c268

except that it removes the related tests entirely.

Asking for review from bz on the layout parts and from sdwilsh on the places parts.

Comment 2

[Shawn Wilsher :sdwilsh]

Comment on attachment 437070 [details] [diff] [review]
Patch (v1)

WIN!  r=sdwilsh

Comment 3

[(no longer active)]

Attachment: Patch (v2)

The previous patch missed a part which caused it not to compile, but that wasn't in places, so I'm carrying forward Shawn's review here.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Wait.  Can someone remind me again what the idea of private browsing mode is and why we didn't want to color the links before but do now?

Comment 5

[(no longer active)]

(In reply to comment #4)
> Wait.  Can someone remind me again what the idea of private browsing mode is
> and why we didn't want to color the links before but do now?

Private browsing is about not saving local tracks of what user has done on the web.  A side goal is preventing websites from telling whether the user is inside private browsing mode or not.

Without bug 147777, if a website which sets an effectively permanent cookie can use the privacy leak to figure out if you've visited it before.  Now, if you're not sending out cookies, there's a good chance that the website can figure out if you're inside the private browsing mode.

With bug 147777, this is no longer an issue, so we can disable this code now.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Ah, I see.  OK.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 437093 [details] [diff] [review]
Patch (v2)

r=bzbarsky

Comment 8

[(no longer active)]

http://hg.mozilla.org/mozilla-central/rev/9786ae3984b3

This actually removes some automated tests, so marking it in-testsuite-.  ;-)

Comment 9

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

(In reply to comment #0)
> With bug 147777, the privacy concerns of enabling visited link coloring in
> private browsing mode no longer apply, so they should be removed.

So, for the record, I wouldn't quite go that far.  Bug 147777 doesn't attempt to address attacks that involve user interaction.

I'm not saying this change doesn't make sense (or that it does) -- it depends on how conservative you want private browsing mode to be, and I'm not really in a position to judge that.

Comment 10

[(no longer active)]

(In reply to comment #9)
> (In reply to comment #0)
> > With bug 147777, the privacy concerns of enabling visited link coloring in
> > private browsing mode no longer apply, so they should be removed.
> 
> So, for the record, I wouldn't quite go that far.  Bug 147777 doesn't attempt
> to address attacks that involve user interaction.
> 
> I'm not saying this change doesn't make sense (or that it does) -- it depends
> on how conservative you want private browsing mode to be, and I'm not really in
> a position to judge that.

Would we be any safer without this patch?  I mean, are there attacks which can be protected against by the code which this patch removed and cannot be protected against by the code landed as part of bug 147777?

Comment 11

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Yes, there are such attacks.  For example, the site could have a link twice, styled such that in one place it's visible only if visited (and when unvisited, it's the same color as the background), and the reverse for the other place.  Then they can determine whether the user visited the site by seeing which one the user clicks on.

Comment 12

[(no longer active)]

(In reply to comment #11)
> Yes, there are such attacks.  For example, the site could have a link twice,
> styled such that in one place it's visible only if visited (and when unvisited,
> it's the same color as the background), and the reverse for the other place. 
> Then they can determine whether the user visited the site by seeing which one
> the user clicks on.

You're right.  In that case, I tend to lean on the side of preserving the previous behavior, which means backing this patch out and resolving this bug as WONTFIX.

I'll do that tomorrow.

Comment 13

[(no longer active)]

Backed out the patch.

http://hg.mozilla.org/mozilla-central/rev/81086dc562b0