Nmap Security Scanner
*Intro
*Ref Guide
*Install Guide
*Download
*Changelog
*Book
*Docs
Security Lists
*Nmap Hackers
*Nmap Dev
*Bugtraq
*Full Disclosure
*Pen Test
*Basics
*More
Security Tools
*Pass crackers
*Sniffers
*Vuln Scanners
*Web scanners
*Wireless
*Exploitation
*Packet crafters
*More
Site News
Site Search:
Exploit World
Advertising
About/Contact
Credits
Sponsors:
edgeos



Bugtraq: Re: Firefox 1.5.0.1 Password Manager Arbtirary User Browsing History Disclosure

Re: Firefox 1.5.0.1 Password Manager Arbtirary User Browsing History Disclosure

From: Eliah Kagan <degeneracypressure_at_gmail.com>
Date: Sat, 15 Apr 2006 00:38:23 -0400

> I guess when he uninstalled Firefox
> originally, it wasn't a completely clean uninstall. That's the only
> explanation since we couldn't duplicate my reported bug as easily as
> we thought.

I think that what this comes down to is that when you uninstall
Firefox (or Mozilla), it doesn't prompt you with the option to remove
all user data. That would eliminate the privacy concern, wouldn't it?

To play the devil's advocate, is this a privacy problem at all? Joe
installs software as Mary, creates user data, and uninstalls the
software. Mary then installs compatible software which reads the old
user data. So Mary knows about what was done under her user
account--is that bad? Joe should have no expectation that Mary will
not find out about what he does when logged on as her. Arguably,
Mary's ability to know what her own user account has been used to do
constitutes command of her own information and is a boon to Mary's
privacy.

On the one hand, software should preserve the privacy of all users,
even dumb ones. On the other hand, if you're not going to use multiple
user accounts, you can hardly expect to enjoy the benefits of
privilege separation.

-Eliah
Received on Apr 15 2006

[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
edgeos