News for hackers. Stuff that matters.

A comment on iCloud was storing cleared browsing histories.

Re:iCloud was storing cleared browsing histories by furyg3 on Friday February 10, 2017 @03:50AM (#13614118)
After a crash Safari is nice enough to restore your open windows and tabs... I've noticed several times that it's also nice enough to re-open your private browsing windows, too. That throws up some red flags for me.
[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by abalone on Friday February 10, 2017 @05:37AM (#13614481)
That's a MacOS thing, not just a Safari thing. Windows stay open until you close them, even across restarts. MacOS, like iOS, has mostly retired the concept of "quitting an app kills state".

(You can go back to the old behavior via a system setting: "Close windows when quitting an app")

[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by saurik on Friday February 10, 2017 @08:22AM (#13615163)
This feature isn't some kind of evil magic... it isn't like it is serializing the virtual memory state of the entire process to disk in the style of unexec(): programs have to manually decide what they think matters for their suspension state; correspondingly, if this happens, Safari would have to be incorrectly saving information that the user clearly doesn't expect or want.
[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by abalone on Friday February 10, 2017 @02:33PM (#13618159)
> Safari would have to be incorrectly saving information that the user clearly doesn't expect or want.

This is vestigial thinking from the MacOS perspective. The concept of "saving" is gone. The concept of "memory state" versus "disk" is gone, from the user perspective. Those are all implementation details now. For the user it's simply, your windows stay open until you close them. Quitting does not close windows, so it's not unusual to see them when you return to an app.

By the way, Safari in iOS does exactly the same thing. And given that iOS kills apps on its own, there would be no question that randomly killing private sessions would be a bug.

I mean maybe you could distinguish between a force quit and an OS quit, but why? Just close the windows if you want to clear them. The private window guarantee is there will be no trace after you close the window. It's just vestigial thinking that quitting apps also closes windows.

[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by Nullabillity on Friday February 10, 2017 @06:40AM (#13614698)
Storing stuff on disk that should be kept purely in-memory is a Mac thing?
[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by kalleboo on Friday February 10, 2017 @07:59AM (#13615051)
Being able to pull the plug/battery on a computer and then having the restored state be exactly the same is a Mac thing, yeah.
[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by yoz-y on Friday February 10, 2017 @08:07AM (#13615094)
In this particular case though it should not do so. Users do expect the private tabs to disappear after the window closes, no matter how it is closed.
[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by Someone on Friday February 10, 2017 @08:41AM (#13615254)
I am not sure reopening private windows is a good idea, either, but Mac OS removed the rule "quitting an application closes its windows".

Given that, it is logical that it reopens private windows, just as, for example, TextEdit or Numbers reopen windows with content you never explicitly saved (even across reboots)

[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by dTal on Friday February 10, 2017 @10:06AM (#13615836)
>Being able to pull the ... battery on a computer... is a Mac thing

Nope!

[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by dTal on Friday February 10, 2017 @10:11AM (#13615864)
What is "quitting" then? How much state is stored? Between "no state" (window is a dead bitmap) and "all the state" (program is simply paused) is a lot of wiggle room.
[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by j_s on Friday February 10, 2017 @09:26AM (#13615526)
As long as this functionality is documented on the incognito start page, similar to "doesn't make you anonymous" warnings, it seems fine (by design) to me.

If anyone has any pointers to documentation on the forensics aspects of this I'd appreciate a link.

It doesn't look like there's that much open source available for the new-ish Windows 8+ hibernation file: https://github.com/volatilityfoundation/volatility/issues/25

[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by throwaway2048 on Friday February 10, 2017 @10:17AM (#13615926)
Why would anyone find this behaviour desirable? We should ask that before going to the "If its documented its the user's fault" truncheon.
[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by j_s on Friday February 10, 2017 @11:52AM (#13616794)
before going to the "If its documented its the user's fault" truncheon

To be clear to anyone else reading this, that's not what I said nor close to what I meant. I think I understand where you're coming from though.

[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by throwaway2048 on Friday February 10, 2017 @01:59PM (#13617907)
sorry for the quotes didn't intend to make it look like you said that.
[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by M4v3R on Friday February 10, 2017 @04:33AM (#13614273)
Well to be honest they don't say that the browser doesn't store your browsing data temporarily. As a matter of fact it has to do that in order to provide you with caching, cookies and local storage for your private browsing session. Normally this data gets wiped out when you close the window, but when the browser crashes it doesn't have chance to do so, so they restore the windows for you so you can make the decision whether to close them or not.
[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by devwastaken on Friday February 10, 2017 @04:54AM (#13614353)
> As a matter of fact it has to do that in order to provide you with caching, cookies and local storage for your private browsing session.

This is solved by knowing what is stored is private browsing data, which should be marked anyways. Safari just isn't that well thought out of a browser.

[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by madeofpalk on Friday February 10, 2017 @06:01AM (#13614548)
> Safari just isn't that well thought out of a browser

Safari is just a browser that has made a different set of tradeoffs.

[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by devwastaken on Friday February 10, 2017 @06:13AM (#13614584)
What tradeoff? Both chrome and Firefox treat private browsing data differently, and if they crash, will not be able to just restore it. Even if they did, its still bad design. The point of private browsing is to make it so when that window exits, that data doesn't exist anymore. You can still pull it up in new tabs in Firefox, but not if the window itself closes.
[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by kalleboo on Friday February 10, 2017 @07:51AM (#13615020)
I'm just speculating here, but since macOS/iOS have native APIs that automatically enable state restoration, Safari might be using those instead of reinventing the wheel for cross-platform compatibility like Chrome and Firefox need to.

Leveraging native APIs means less code (fewer bugs), less disk usage, less RAM usage, etc.

[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by k-mcgrady on Friday February 10, 2017 @08:02AM (#13615066)
>> Both chrome and Firefox treat private browsing data differently

>> The point of private browsing is to make it so when that window exits, that data doesn't exist anymore.

When defining what private browsing is supposed to do we should keep in mind Safari was the first major browser to introduce the feature.

[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by daxelrod on Friday February 10, 2017 @10:05AM (#13615824)
Sure, but it also didn't save/restore any window or tab state at that time. All those features came later, so this represents a change in how things act between Safari versions.
[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by blowski on Friday February 10, 2017 @07:36AM (#13614934)
> The point of private browsing is to make it so when that window exits, that data doesn't exist anymore

Who defined it that way? And how do you define 'exit', 'data' and 'exist'?

[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by devwastaken on Friday February 10, 2017 @09:24AM (#13615508)
What is reality anyway?
[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by aljones on Friday February 10, 2017 @10:16AM (#13615909)
Typically in macos, closing windows doesn't quit applications and quitting applications doesn't close windows.
[ Parent | on HN ]