819575 - Clear DNS cache of entries for private connections when leaving private browsing mode

Status: NEW

(Core :: Networking: DNS, defect, P3)

Description

[Josh Matthews [:jdm]]

We should probably do this cleanup. Given that we currently don't, I'm not inclined to block releasing per-window private browsing until this is fixed. Steve mentioned that we may need to clear the OS' cache as well.

Comment 1

[Steve Workman [:sworkman] (INACTIVE)]

To clarify on my comment, Necko stores DNS entries in a cache in nsHostResolver.cpp, but those entries are resolved using the underlying OS's hostname resolution API (getaddrinfo). Some/Most/(all?) OSes have their own DNS cache, separate from Necko's. So, that might also need to be cleared - whether that can/should be done on an entry by entry case needs to be determined. If we clear the whole cache, then we incur the extra RTT for resolving non-private browsing (PB) entries, subsequent to the PB session ending. There is probably a good case for saying that keeping the entries private would overrule this very small performance loss.

Note as well, that according to nsHostResolver.cpp, we only evict DNS entries when the cache is full. The entries are invalid after 3 mins, but they are not evicted until a DNS lookup completes and the cache is full, or until the browser shutsdown. So, entries, although probably stale, will be hanging around in memory.

Comment 2

[(no longer active)]

This cache is not persisted to disk, so I don't understand why we should clear it.

Comment 3

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

(In reply to Ehsan Akhgari [:ehsan] from comment #2)
> This cache is not persisted to disk, so I don't understand why we should
> clear it.

A contrived example:
Let's say that we use private browsing mode to browse to example.org at home. Then we exit private browsing mode and go to work with the laptop. At work, my boss asks me if I've ever been to example.org or a site that links to example.org and I lie and say "no". Boss then opens up a private browsing window on my laptop and observes that browsing to example.org doesn't cause a DNS request for example.org, exposing my lie.

In general, I think it is difficult for us to classify certain leaks as "not bad enough" because it is difficult to identify all side channels where the leakage could be determined. It is better, whenever possible, to avoid *all* leaks between private browsing sessions by default.

Comment 4

[(no longer active)]

(In reply to comment #3)
> (In reply to Ehsan Akhgari [:ehsan] from comment #2)
> > This cache is not persisted to disk, so I don't understand why we should
> > clear it.
> 
> A contrived example:
> Let's say that we use private browsing mode to browse to example.org at home.
> Then we exit private browsing mode and go to work with the laptop. At work, my
> boss asks me if I've ever been to example.org or a site that links to
> example.org and I lie and say "no". Boss then opens up a private browsing
> window on my laptop and observes that browsing to example.org doesn't cause a
> DNS request for example.org, exposing my lie.

Well, sure, but how would they check to see if you do a DNS request?  If they can install wireshark or something similar on your machine, you're already screwed (cause they can install a keylogger, etc.)

> In general, I think it is difficult for us to classify certain leaks as "not
> bad enough" because it is difficult to identify all side channels where the
> leakage could be determined. It is better, whenever possible, to avoid *all*
> leaks between private browsing sessions by default.

Yeah, sometimes it's hard to know where to draw the line.  For this particular case, I would definitely take a patch which clears the DNS cache when the last private window has been closed, but I don't think this is a very important leak to worry about.

Comment 5

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

(In reply to Ehsan Akhgari [:ehsan] from comment #4)
> Well, sure, but how would they check to see if you do a DNS request?  If
> they can install wireshark or something similar on your machine, you're
> already screwed (cause they can install a keylogger, etc.)

They can observe it on the network, because they own the network.

Comment 6

[(no longer active)]

(In reply to comment #5)
> (In reply to Ehsan Akhgari [:ehsan] from comment #4)
> > Well, sure, but how would they check to see if you do a DNS request?  If
> > they can install wireshark or something similar on your machine, you're
> > already screwed (cause they can install a keylogger, etc.)
> 
> They can observe it on the network, because they own the network.

Yes, and in that case your privacy will not be protected from them.  We say this in about:privatebrowsing.  :-)

Comment 7

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258

Comment 8

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258