Schneier on Security

Roger • March 27, 2006 6:12 PM

The key point here is that there appears to have been a mechanism, albeit complicated, by which profile information could leak between Mozilla accounts not protected by an encryption password. However, if you read carefully how it occurred, that is NOT what actually happened; there was no leakage between accounts or profiles.

What happened is this: two users (let’s call them Alice and Bob) SHARED the same Windows account. Bob installed Firefox in this account, and saved some profile information, relying on “security by obscurity” because Alice was unaware of Firefox. Later Alice became aware of Firefox, and Bob uninstalled it. Bob went on to carry out various other activities (creating a new Windows XP account and creating a new Firefox profile) which activities are in fact irrelevant because at this point the damage has already been done. Later (actually, much later, but that doesn’t matter) Alice reinstalled Firefox in her original account, and saw the old profile entries.

At no point has there been leakage of information across profiles or accounts; the information that Alice saw was shown to her because so far as both Windows and Firefox were concerned, it was HER profile in HER account!! Bob screwed up in three ways:
1. He relied on “security through obscurity” by saving his sensitive information in a (not very obscure) part of Alice’s account, ignoring the optional additional encryption, and just hoping she wouldn’t ever find it. Well, eventually, years later, she did.
2. He (presumably) thought that “Never save passwords for this site” meant something like “Record absolutely nothing about this site”, which is nearly the opposite of what it meant.
3. He apparently thought that uninstalling Firefox would erase his profile as well.

Error 1, which is the biggy, and is the only thing which somehow “subverted” (actually, appeared to subvert) account permissions, was basically his own stupid fault. Arguably Firefox could do more to protect people from themselves by popping up a stronger warning about the necessity of a profile password before saving the first password list entry. Even more useful would be more recognition from security professionals that account != user because people do things like sharing accounts and then later splitting them. Perhaps we need mechanisms that recognise that if a home user version of Windows XP was set up with one account, and much later another is created, then a shared account is being split up and some cleaning up needs to be done. But there’s only so much you can do. When two people effectively pretend to the computer that they are the same person, they can’t later complain that it can’t tell the difference!

Error 2 can be partly blamed on Firefox, although it’s not so much a bug as unclear expression. The expressions used to label those buttons is not entirely clear. I’m pretty computer savvy, and I recall that the first time I saw that dialog, I had to think about the implications for a couple of seconds. I can easily see even fairly sophisticated users being confused by it. Maybe the buttons should be called “Save password for this site”, “Forget this site this time” and “Put this site on a list of sites I shouldn’t bug you about”, or something like that.

Error 3 is not a bug, it’s a feature, which Firefox shares with many (probably most) other applications. Most of the time if you uninstall and reinstall an application, you would be more than slightly peeved if all the user-created stuff associated with it had vanished. However one can also see that sometimes this isn’t what the user wants. I think most uninstallers should probably give the user a clearly labelled option to clean out all profile entries (or saved games, saved documents, whatever) as well. In fact should I choose to uninstall a security related application, I would like the uninstaller to trawl through the file system and Windows registry and expunge every trace of the application, its associated file types, and any registry entries linked to those three letter extensions. But TTBMK the total list of applications which currently do this, is nil. This is one reason why some folk advocate occasionally wiping and completely reinstalling a non-server Windows installation, because installs and uninstalls occur all the time and many uninstalls don’t completely clean up.