Firefox: are websites/web bugs able to access the PLACES.SQLITE file?

apparently this is the file that stores both your site history and bookmarks in FF. Seems suspicious to me that FF would store your bookmarks with other data and i thought i read previously that some sites were able to read your history of sites visited. I get the feeling that firefox is deliberately making it difficult to avoid tracking and privacy leaks.

 

Hi, i'm not sure if www's can do that with WebBugs ?

I do know for a FACT that BleachBit is the Only cleaner i've used that both identifies & cleans ALL SQLITE files, amongst All the other things

 

I too would be happier if bookmarks were separate from history. I like to completely delete places.sqlite once in a while as opposed to vacuuming it. Because bookmarks are part of places.sqlite, I first have to save them separately.
[special mode on]BTW, if you don't trust Mozilla, just use some other browser that is better suited to your privacy requirements. I would suggest IE9. There's no point in expecting Mozilla to change their spying ways for which they are so well known.[/special mode off]

 

Personally I am unaware of any exploit that is able to read the PLACES.SQLITE. The only things I am aware of that can view your web history in Firefox is a CSS exploit (Which has been since fixed). The other is a java script exploit that reads your cache for that particular session. If you have Firefox set to clear your cache after each session your are reasonably safe. See here for details: https://www.wilderssecurity.com/showthread.php?t=313498 I guess there could be an exploit that reads PLACES.SQLITE but I am personally unaware of it in the wild.

 

Examples of this?

 

Note the tags, "special mode"

 

thanks, i've been using BleachBit in ubuntu and the GUI is kind of bland compared to CC but it cleans a bunch of files. i searched around and i guess what i was worried about was called "history sniffing" and supposedly FF has solved the problem but still seems odd that bookmarks are added to history in one file...

agree with first part....as to "special mode", i guess that's supposed to be sarcasm or something...point is while FF is better about privacy than chrome(idk about IE, haven't used for 5 years or so + havent bothered to follow news on it), FF/Mozilla gets ~85% of its income from Google by making Google its default search engine/home page etc....that's est $85 million last year so i'm sure they're in on making this tracking+profiling business possible as much as all the rest of the browser co's and only do just enough to make the base happy... just like on the Flash cookies they finally got around to having an built-in option to delete them about 3 years after the fact and i'm sure we'll find out 2-3 years down the road that the tracking co's have found other means and FF will again be very slow to react - ITS A PROBLEM THEY'RE NOT INTERESTED IN SOLVING.

EDIT: here are some more accurate numbers apparently on Mozilla's $$$ from search providers:

In the 2010 report, Mozilla did not disclose the amounts it received from individual search partners, but said that payments from search services accounted for 98% of the year's revenues, or $121.1 million out of a total of $123.2 million.

from: http://www.computerworld.com/s/arti...lines_to_say_if_it_s_renewed_100M_Google_deal

note that they did reup with google per this link:

http://idealab.talkingpointsmemo.com/2011/12/google-confirms-mozilla-deal-despite-chromes-ascent.php

 

I'll take your word for it.

 

Hi Vasa,

How do you to separate history from bookmarks with the places.sqlite ?

 

I guess he exports the bookmarks and then re-imports them, lol.

 

Pretty clear to me.

 

I don't really understand when it said "I first have to save them separately."

 

The bookmarks. Save (export) the bookmarks first, delete places.sqlite, import the bookmarks back. At least that's that way I read it.

Seems like a like of effort for nothing, since you can have Firefox clear history on exit.

 

This is done automatically daily by FF in the bookmarkbackups subfolder in your profile folder anyhow.

 

Very true though I don't know whether .json is more tractable than .html.

And as far as my previous post, yes, I meant exporting the bookmarks as .html before deleting places.sqlite.

 

I only wanted to point out that manually exporting your bookmarks is usually not necessary as this is done by FF anyhow. It's sufficient to import your newest .json file to add your bookmarks to the (newly created) places.sqlite file.

 

Okay, that's good to know

 

As already mentioned by marktor, the problem that websites were able to read your browsing history is fixed. Neither http://www.whattheinternetknowsaboutyou.com/ nor http://lcamtuf.coredump.cx/cachetime/firefox.html were able to read mine. I guess that applies to the info stored in places.sqlite in general.

 

Yes, that was fixed a while ago and, as usual, people were all hysterical over the restrictions placed on styling visited links.