Security Hole with Bookmarks

userChrome.css?
Then you’re hiding the problem, not solving it.

As far as I can tell , Firefox doesn’t even save the information on when you lastly visited a bookmark with the bookmarks themselves (check the moz_bookmarks table in places.sqlite).

If it’s saved anywhere else also in private browsing mode (where?), it’s a disk leak we should solve and send to upstream Firefox.
Keep in mind that disabling private browsing mode isn’t officially supported for Tor Browser, so we won’t fix issues that don’t apply to PBM.

However, for me Firefox shows the recently added bookmarks, not visited.
There are two fields in the moz_bookmarks table: dateAdded and lastModified.
Maybe we could add a pref to hardcode them to some date (e.g., Jan 1st 2020) and then not update anymore.
(Edit: opened tor-browser#43080 for this).

But as already said, userChrome.css isn’t a solution.
The data is stil there.

2 Likes