The Brown PLT Blog
A Privacy-Affecting Change in Firefox 20
Posted on 10 April 2013.Attention, privacy-conscious Firefox users! Firefox has supported private browsing mode (PBM) for a long time, and Mozilla's guidelines for manipulating privacy sensitive data have not changed...but the implementation of PBM has, with potentially surprising consequences. Previously innocent extensions may now be leaking private browsing information. Read on for details.
Global Private-Browsing Mode: Easy!
In earlier versions of Firefox, PBM was an all-or-nothing affair: either all currently open windows were in private mode, or none of them were. This made handling sensitive data easy; the essential logic for privacy-aware extensions is simply:
if (inPBM)
...must store data only in memory...
else
...allowed to save data to disk...(For the technically curious reader, there were some additional steps to take if extension code used shared modules: they additionally had to listen to events signalling exit from PBM, to flush any sensitive data from memory. This was not terribly hard; trying to "do the right thing" would generally work.)
Per-window Private Browsing: Trickier!
However, in Firefox 20, PBM is now a per-window setting. This means that both public and private windows can be open simultaneously. Now, the precautions above are not sufficient. Consider a session-management extension, that periodically saves all open windows and tabs:
window.setInterval(3000, function() {
if (inPBM) return;
var allWindowsAndTabs = enumerateAllWindowsAndTabs();
save(allWindowsAndTabs);
});
Most likely, this code internally uses Firefox's
nsIWindowMediator API to produce the enumeration. The
trouble is, that API does exactly what it claims: it enumerates
all windows—public and private—regardless of the
privacy status of the calling window. In particular, suppose that
both public and private windows were open simultaneously, and the
callback above ran in one of the public windows. Then
inPBM would be false, and so the rest of the
function would continue, enumerate all windows, and save them: a clear
violation of private browsing, even though no code was running in the
private browsing windows!
This code was perfectly safe in earlier versions of Firefox, because the possibility of having private and public windows open simultaneously just could not occur. This example demonstrates the need to carefully audit interactions between seemingly unrelated APIs, features, and modes—ideally, mechanically.
Takeaway Lessons
Private browsing “mode” is no longer as modal as it used to be. Privacy-conscious users need to take a careful look at the extensions they use—especially ones that observe browser-wide changes, like the session-manager example above—and double-check that they appear to behave properly with the new private-browsing changes, or (better yet) have been updated to support PBM explicitly.
Privacy-conscious developers need to take a careful look at their code and ensure that it's robust enough to handle these changed semantics for PBM, particularly in all code paths that occur after a check for PBM has returned false.