762438 - blank private tab is showing history of browsed websites

Status: RESOLVED INVALID

(Firefox :: Tabbed Browser, defect)

Description

[Daniel]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:13.0) Gecko/20100101 Firefox/13.0
Build ID: 20120601175215

Steps to reproduce:

ctrl+shift+p


Actual results:

blank tab opened showing boxes of visited websites including gmail etc. - potential breach of privacy


Expected results:

blank tab without any boxes in private mode !

Comment 1

[Bob Clary [:bc] (inactive)]

not security sensitive.  You can disable the new tab behavior if you don't like it.

Comment 2

[Daniel]

still a privacy breach. what if you are using someone's else computer and you can see their favourite history in the boxes. there should be no data sharing between normal and private mode.

your comment on "changing the preferences" is strange, as the default should be not showing any boxes.

Comment 4

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

This is not a dup of bug 755996, because bug 755996 became to be just about Cache-Control: no-store. This is about private browsing mode.

Daniel, I think it is OK for private browsing mode to show your non-private-browsing-mode history in the new tab page, but it is NOT OK to show your private-browsing-mode history in the new tab page. If you are seeing information from your private browsing mode sessions in the non-private-browsing-mode new tab pages, then please let us know.

It is OK to show non-private-browsing information in the new tab page for private browsing because that information isn't "private" in the way that private browsing means. Even before the new-tab page, people using your computer could see the same (or, similar, at least) information by looking at your history (CTRL+SHIFT+H) and/or by browsing the files in Firefox's cache--whether you are in private browsing mode or not.

Comment 5

[Daniel]

ok, close it then. I just find that strange, if the private mode shares some data with the normal mode. Of course, other way round it would have been even worse.

Comment 6

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Daniel, a good way of thinking about it is that Private Browsing only protects things that happen in private browsing mode. It's like the saying "What happens in Vegas, stays in Vegas."

I am going to leave the bug open because I'm not a peer on this module, but I think it will get closed as "invalid." However, that is just an unfortunate choice of words. Thanks for your bug report and if you are in doubt about whether something is a bug or not, please report it--especially if you are worried that it is a security or private problem.

Comment 7

[(no longer active)]

Please note that you can already use the non-private history, bookmarks, etc. from the location bar, the History and Bookmarks menus, their corresponding sidebars, the Library window, the Bookmarks Toolbar, and probably a bunch of other UI elements that I'm forgetting about.  Showing them on the new tab window is just presenting the information which you can already access in an easier to use way.

Comment 8

[Dão Gottwald [:dao]]

(In reply to Brian Smith (:bsmith) from comment #6)
> Daniel, a good way of thinking about it is that Private Browsing only
> protects things that happen in private browsing mode. It's like the saying
> "What happens in Vegas, stays in Vegas."

(In reply to Ehsan Akhgari [:ehsan] from comment #7)
> Please note that you can already use the non-private history, bookmarks,
> etc. from the location bar, the History and Bookmarks menus, their
> corresponding sidebars, the Library window, the Bookmarks Toolbar, and
> probably a bunch of other UI elements that I'm forgetting about.  Showing
> them on the new tab window is just presenting the information which you can
> already access in an easier to use way.

Yep.