Firefox snapshot bug a 'red herring'

By on
Firefox snapshot bug a 'red herring'

Clean your cache.

A bug found within Firefox’s new tab system is a “red herring” and only makes secured browsing data more accessible.

The bug was found in a feature within the latest version of Firefox that captured thumbnail snapshots of websites visited by users. 

A reader of The Register found that the snapshots also trapped secured HTTPS browser data meaning anyone with access to a computer could view potentially sensitive information.

Mozilla was quick to announce plans to fix the bug to prevent tabs slurping HTTPS data.

But the bug was “a bit of a red herring” according to Sophos scribe and Asia Pacific technology head Paul Ducklin, because the information used to build the feature had existed in previous versions of the browser.

Ducklin pointed out that HTTPS data was always available in the browsers’ cache and switching off the new feature – touted as a workaround -- did not resolve the problem.

“In my HTTPS experiments, turning off the thumbnails didn't do anything about Firefox's cache,” Ducklin said.

“Whatever is inside an HTTPS request, and in its corresponding reply, must exist in unencrypted form at each end of the conversation in order to be of any use.

"That means both your browser and the server you're talking to may - indeed, probably will - end up with a permanent record of the transaction's content, even though it was encrypted during transmission.”

However he points out that the snapshot feature provided richer data and made it easier to access the cached information.

Users could avoid potential exposure by erasing stored browser data after each browser session.

“… if this whole issue really is a bug, it may very well be a bug in our willingness to hold on to browser data between sessions," he said.

Copyright © SC Magazine, Australia

Tags:

Most Read Articles

You must be a registered member of iTnews to post a comment.
| Register

Poll

How should the costs of Australia's piracy scheme be split?
Rights holders should foot the whole bill
50/50
ISPs should foot the whole bill
Government should chip in a bit
Other
Flash is heading towards its grave, and that's...
Great! Good riddance
Sad! Flash had some good qualities
Irrelevant. I don't care
What's Flash?
View poll archive

Whitepapers from our sponsors

What will the stadium of the future look like?
What will the stadium of the future look like?
New technology adoption is pushing enterprise networks to breaking point
New technology adoption is pushing enterprise networks to breaking point
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
The next era of business continuity: Are you ready for an always-on world?
The next era of business continuity: Are you ready for an always-on world?

Log In

Username:
Password:
|  Forgot your password?