683462 - First-time Private Browsing warning/info messagebox is a security vulnerability

Status: RESOLVED INVALID

(Firefox :: Private Browsing, enhancement)

Description

[NB]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100101 Firefox/6.0
Build ID: 20110811165603

Steps to reproduce:

When you first install Firefox and use the private browsing feature, it shows a messagebox with a warning and a checkbox to never show that message again. If a user ticks that box to never be notified again, then it can be determined by an attacker that private browsing has been used on this computer because it will never show that dialog again. 


Actual results:

see above


Expected results:

Expected behavior: Eliminate the 1st-time messagebox so that an attacker cannot determine if private browsing has been used on the currently installed firefox instance. The knowledge that a user has previously used the private browsing feature allows an attacker to gain the knowledge that a user is perhaps an advanced user and has made use of private browsing in the past.

Comment 1

[NB]

Perhaps display the warning/message on the chrome of the window instead of in a message box so that the user can still be informed about that important message without compromising his security by using your security feature.

Comment 2

[(mostly gone) XtC4UaLL [:xtc4uall]]

Maybe converting the Prompt to a Doorhanger Notification is possible.

FWIW, activating the Checkbox actually sets browser.privatebrowsing.dont_prompt_on_enter;true. But I fail to see/understand the Attack Vector: the Attacker has to have local Access to the User's Box to e.g. read that Pref's Status, right? If that State is given the User will have other Worries.

Comment 3

[NB]

The attack could be as simple as your boss or a parent with local access checking to see if that feature has ever been used, whose intent is to glean a piece of information and not complete takeover of the network.

Comment 4

[(no longer active)]

I'm not sure if there is a good way to address this except by moving to the new per-window private browsing model...

Comment 5

[NB]

> "activating the Checkbox actually sets browser.privatebrowsing.dont_prompt_on_enter;true"

imho, the fix is simply 1) don't set that variable 2) don't rely on that variable 3) inform the user in some other manner the important information you wanted to convey in that message box. 

if a user has their preferences set to ALWAYS use the private browsing model on firefox's start up, then this attack vector is probably not a huge concern to them. it is for the person who only occasionally uses the feature that it becomes an (albeit minor) concern. 

its just no good that by using a security feature you end up being less secure.

Comment 6

[Alex Faaborg [:faaborg] (Firefox UX)]

The current dialog box is basically a hack since losing your entire session can be rather annoying.  The best solution is to move to a per-window approach.  In the meantime, this information leakage isn't great but it is better than not promoting the user (since they could experience form field data loss), or not giving users a way to remove the warning (since it is annoying).

Comment 7

[Thorin [:thorin]]

Cleaning up open/old privacy tagged bugs ... this is no longer valid. Tested in FF68+ and the only doorhanger (no dialogs) I got in a new profile was about extension permissions in PB mode. Not worth tracking down the bugzilla where it was removed, but I think we can close this as INVALID

pinging someone ... Johann it is (as triage owner) .. apologies if these are getting annoying

Comment 8

[Johann Hofmann [:johannh]]

No worries, thanks for cleaning this up, I agree this is INVALID.