search

andy-portmen / country-flags

adds a toolbar button to browser address-bar displaying current physical location of visited website
https://webextension.org/listing/country-flags.html
Mozilla Public License 2.0
133 stars 35 forks source link

Private Windows mode #79

Closed aimi617 closed 1 year ago

aimi617 commented 1 year ago

The latest version 0.5.5 writes the site cookies in Private Windows mode which is compromising a user privacy. It's not recommended to use this add-on in Private mode. Tested on FF Developer Edition 103.0b9 (64-bit).

andy-portmen commented 1 year ago

What do you mean by "writes the site cookies"?

aimi617 commented 1 year ago

After visiting the site with enabled add-on in private mode we noticed a plenty of saved 3-rd party cookies, somehow the add-on creates a breach in private mode and sites can save the cookies. With disabled add-on the privacy was restored. As a test we switched to private mode, cleared all cookies, enabled add-on, and browsed a set of heavily loaded sites by different trackers, the result is tons of recorded cookies in FF -> Settings -> Privacy & Security -> Manage Data...

andy-portmen commented 1 year ago

browsed a set of heavily loaded sites by different trackers

Can you provide an example website?

andy-portmen commented 1 year ago

somehow the add-on creates a breach in private mode and sites can save the cookies

I just tested the extension on a clean Firefox profile and I am not able to reproduce this. Please provide steps.

aimi617 commented 1 year ago

The issue still there, please see those 2 sites in a screenshot, sites were browsed in Private mode with enabled add-on, FF Dev Edition 103.0b9 (64-bit).

image

andy-portmen commented 1 year ago

I tried these two websites, and although they created cookies in the private mode, there is no entry on "Manage Data..." for me.

Either another extension is responsible, or you have a corrupted profile. Try on a clean profile with only this extension installed, and let me know if you can still reproduce this. Based on the extension permissions, it is very unlikely it could manipulate cookies.

aimi617 commented 1 year ago

We also suspect, either a conflict with other extension or corrupted profile. It will take a time to test it, we keep you posted about results.

aimi617 commented 1 year ago

It's an add-on issue, same cookies appear with all other disabled add-ons, or brand new clear profile, and the same happens in another regular FF 102.0.1 (64-bit). To test it, launch FF, run a private mode, in private FF window go to mk.ru, forward to kp.ru, then back to mk.ru. Keep all browser windows opened, go to Settings, Privacy & Security, open Manage Data, you will see those cookies.

andy-portmen commented 1 year ago

Thanks for the report. The extension was using a local fetch to emulate navigation for existing tabs to get the IP address. It turned out that this function was responsible for the cookie creations. It is now fixed on the 0.5.6 release. Please confirm.

aimi617 commented 1 year ago

No cookies in private mode, thanks for fixing. Is it possible to move Service URLs Up-Down? For example, "Copy IP" is frequently used service and would be nice to move it Up on first position.

andy-portmen commented 1 year ago

Is it possible to move Service URLs Up-Down?

As of the next release, you can sort services from the options page.