[tor-bugs] #19995 [Applications/Tor Browser]: New Identity does not clear HSTS state anymore

[Tor Bug Tracker & Wiki]

#19995: New Identity does not clear HSTS state anymore
-+-
 Reporter:  gk   |  Owner:  tbb-team
 Type:  defect   | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor |Version:
  Browser|   Keywords:  tbb-newnym, tbb-
 Severity:  Normal   |  torbutton
Actual Points:   |  Parent ID:
   Points:   |   Reviewer:
  Sponsor:   |
-+-
 A while back Mozilla changed the way site security preferences are
 handled. The permission manager is not responsible for them anymore. This
 affects clearing HSTS (and possibly other state) on New Identity: it does
 not get deleted anymore.
 This is a spin-off of #18589

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #19995 [Applications/Tor Browser]: New Identity does not clear HSTS state anymore

[Tor Bug Tracker & Wiki]

#19995: New Identity does not clear HSTS state anymore
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_review
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-newnym, tbb-torbutton,   |  Actual Points:
  GeorgKoppen201608, TorBrowserTeam201608R   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * status:  new => needs_review
 * cc: arthuredelsteint (removed)
 * cc: arthuredelstein (added)
 * keywords:  tbb-newnym, tbb-torbutton => tbb-newnym, tbb-torbutton,
 GeorgKoppen201608, TorBrowserTeam201608R


Comment:

 While working on the design document I stumbled over #18589 again and
 after looking at it a bit at least the `NEWNYM` issue seemed trivially to
 fix. A patch is in my bug_19995_v2
 (https://gitweb.torproject.org/user/gk/torbutton.git/commit/?h=bug_19995_v2).

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #19995 [Applications/Tor Browser]: New Identity does not clear HSTS state anymore

[Tor Bug Tracker & Wiki]

#19995: New Identity does not clear HSTS state anymore
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_review
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-newnym, tbb-torbutton,   |  Actual Points:
  GeorgKoppen201608, TorBrowserTeam201608R   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by bugzilla):

 > on New Identity: it does not get deleted anymore.
 Can you confirm that? Because it does clear SiteSecurityServiceState.txt
 (by invoking Clear All History / Site Preferences somehow). And Firefox
 should do that then, otherwise there is something for uplifting.
 > NEWNYM issue seemed trivially to fix.
 Retained state after exiting can be treated as newnym violation, so could
 you also provide a patch for clearing/deleting
 SiteSecurityServiceState.txt (as a workaround)?

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #19995 [Applications/Tor Browser]: New Identity does not clear HSTS state anymore

[Tor Bug Tracker & Wiki]

#19995: New Identity does not clear HSTS state anymore
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_review
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-newnym, tbb-torbutton,   |  Actual Points:
  GeorgKoppen201608, TorBrowserTeam201608R   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by mcs):

 Replying to [comment:1 gk]:
 > While working on the design document I stumbled over #18589 again and
 after looking at it a bit at least the `NEWNYM` issue seemed trivially to
 fix. A patch is in my bug_19995_v2
 (https://gitweb.torproject.org/user/gk/torbutton.git/commit/?h=bug_19995_v2).

 This patch looks good to me.
 I don't know the answers to the questions raised on comment:2, but it does
 seem like no data should be written to SiteSecurityServiceState.txt when
 in PBM or, as suggested by bugzilla, Mozilla should treat a browser exit
 as an exit from PBM.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #19995 [Applications/Tor Browser]: New Identity does not clear HSTS state anymore

[Tor Bug Tracker & Wiki]

#19995: New Identity does not clear HSTS state anymore
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:  closed
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:  fixed
 Keywords:  tbb-newnym, tbb-torbutton,   |  Actual Points:
  GeorgKoppen201608, TorBrowserTeam201608R   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * status:  needs_review => closed
 * resolution:   => fixed


Comment:

 Replying to [comment:3 mcs]:
 > Replying to [comment:1 gk]:
 > > While working on the design document I stumbled over #18589 again and
 after looking at it a bit at least the `NEWNYM` issue seemed trivially to
 fix. A patch is in my bug_19995_v2
 (https://gitweb.torproject.org/user/gk/torbutton.git/commit/?h=bug_19995_v2).
 >
 > This patch looks good to me.
 > I don't know the answers to the questions raised on comment:2, but it
 does seem like no data should be written to SiteSecurityServiceState.txt
 when in PBM or, as suggested by bugzilla, Mozilla should treat a browser
 exit as an exit from PBM.

 We have #18589 for fixing the underlying problem and that should be
 something for uplifting then, yes. Fixed on maser (commit
 6dc853740b0e2be39f17b1a1857f2610de42548c) and maint-1.9.5 (commit
 3c04ec4654270f2896db0efffc4bc72edc2e3018).

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs