909024 - Stylish config leaks from private browsing

Status: RESOLVED WONTFIX

(Firefox :: Extension Compatibility, defect)

Description

[Andrey K]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0 (Beta/Release)
Build ID: 20130814063812

Steps to reproduce:

1) install "Stylish" addon from private browsing mode, restart browser;
2) see "Stylish" among addons, it is already privacy leak;
3) enter private mode again and go some site;
4) make user style for this site with Stylish, exit private mode;
5) see: there is recently made user style is kept by this addon;


Actual results:

User style goes from private browsing to public browsing.
Widely, addon config info leaks from private browsing mode.

Also tested in Nightly 26.0a1 (2013-08-24)


Expected results:

Any addon must loose its config on private browsing exit.
Widely, Firefox should loose addons, installed in private browsing on exit.

Comment 1

[Josh Matthews [:jdm]]

Addon installs are a permanent, intended action, and we have no intention to change that behaviour. Stylish will need to be updated to respect a window's privacy status, if the addon author believes it is desirable; there is nothing we can do within Firefox, unfortunately.

Comment 2

[Jorge Villalobos [:jorgev] (he/him)]

The developer has been notified about this bug and asked to address it on a future update.

Comment 3

[Jason Barnabe (np)]

User styles are addons as well, and I see no reason why they would act any differently than an extension. They do not gather information on what a user does in private browsing mode, other than the "permanent, intended action" of installing it.

Comment 4

[Josh Matthews [:jdm]]

I agree, if these are styles that are explicitly installed, I don't see any need to treat ones installed from private windows any differently.

Comment 5

[Andrey K]

It is easy to say "it is a problem of addon developer".

Browser is like company boss. Addons like staff.
If politic of a company "we don't know that do our employees", it (company) will get insiders and different data leaks. It will harm for company reputation.
If politic is "employee want to steal, but can't (by design)" all will be good.

Comment 6

[Andrey K]

In other words, it is browser problem too, because it holds addons.