Twitter reveals that Firefox cached private files even after a user has logged out

guest · Apr 3, 2020

Twitter reveals that Firefox cached private files even after a user has logged out
April 3, 2020
https://www.neowin.net/news/twitter...rivate-files-even-after-a-user-has-logged-out

Twitter today revealed a bug in the Firefox browser that accidentally stored non-public files inside its cache, which normally stores information and files temporarily only. Those files stayed in the cache folder for as long as seven days, Twitter found.

This could happen if a user signed in to Twitter using a shared or public computer via Firefox and downloaded Twitter data archive or send a media file via Direct Message.
Twitter says it already fixed the problem by implementing changes to prevent Firefox from storing personal information in its cache folder moving forward.
Click to expand...

Twitter: Twitter Data Cache on Mozilla Firefox

We recently learned that the way Mozilla Firefox stores cached data may have resulted in non-public information being inadvertently stored in the browser's cache.

The Mozilla Firefox browser’s cache retention period is set to 7 days and after that time the information should have automatically been removed from the cache. This issue did not impact people using other browsers like Safari or Chrome.
Click to expand...

summerheat · Apr 3, 2020

No, this is not a Firefox bug. Twitter themselves conceded:

There isn’t a standard for how browsers cache downloaded data. We noticed that the way Firefox stores cached Twitter data is different (but not wrong) than other browsers and could put your non-public info at risk. We made changes to protect your Twitter data if you use Firefox.
Click to expand...

In other words, they didn't sufficiently test their code with Firefox.

mirimir · Apr 3, 2020

Huh. Doesn't everyone who cares configure Firefox to delete all that stuff when it closes?

Accept cookies and site data from websites (recommended)
Keep until ... I close Firefox
Click to expand...

guest · Apr 7, 2020

Twitter warns users – Firefox might retain private messages
April 7, 2020
https://nakedsecurity.sophos.com/20...rs-firefox-might-hold-on-to-private-messages/

What went wrong with Twitter?
Why did Firefox cache data that Twitter surely didn’t want it to, as stated by Twitter in the blog post quoted above?
The answer is a curious one – according to Firefox, Twitter forgot to send the no-store instruction to forbid caching explicitly:

In this case, Twitter did not include a ‘no-store’ directive for direct messages. The content of direct messages is sensitive and so should not have been stored in the browser cache.
Apparently, having set an old-fashioned header to say Pragma: no-cache, which doesn’t quite mean the same thing, Twitter observed that other browsers didn’t save the replies anyway.
From this, Twitter seems to have inferred – understandably if incorrectly – that it had done enough to prevent any web client from holding onto data such as private messages.
Click to expand...

As far as we can tell, the issue has been sorted out amicably, with Twitter now unambiguously telling Firefox to no-store the offending data, and Firefox accordingly not storing it.
Click to expand...

Mozilla: Twitter Direct Message Caching and Firefox

Editor’s Note: April 6, 7:00pm pt – After some more investigation into this problem, it appears that the initial analysis pointing to the Content-Disposition was based on bad information. The reason that some browsers were not caching direct messages was that Twitter includes the non-standard Pragma: no-cache header in responses.

Using Pragma is invalid as it is defined to be equivalent to Cache-Control: no-cache only for requests. Though it is counter-intuitive, ‘no-cache’ does not prevent a cache from storing content; ‘no-cache’ only means that the cache needs to check with the server before reusing that response.
That doesn’t change the conclusion: limited observations of behavior are no substitute for building to standards.
Click to expand...

Log in or Sign up

Twitter reveals that Firefox cached private files even after a user has logged out

guest Guest

summerheat Registered Member

mirimir Registered Member

guest Guest

Log in or Sign up

Twitter reveals that Firefox cached private files even after a user has logged out

guest Guest

summerheat Registered Member

mirimir Registered Member

guest Guest

Useful Searches