219

The website dropmail.me is able to successfully reidentify me (and offer my last used temp mail addresses via. "Restore access") despite doing the following:

  • Delete all my browsers history which includes cache, cookies, website settings, download history, search history, browser history and active logins. Basically everything that can be deleted through the Firefox menu. I'm using Firefox 52 ESR.
  • Use a VPN (that according to their claims is safe against IPv6 and DNS leaking) that I have not used when I previously visited this website.
  • Using uBlock Origin and uMatrix

Additional information:

  • My "identity" must somehow be bound to my current browser profile. When I use a different browser or a new browser profile, the website doesn't reidentify me as the same person. Actually, it is sufficient to use the Firefox addon Priv8 and create a new sandbox to be identified as a different person. This might indicate that there is some kind of storage for websites that can't be accessed or deleted though Firefox. (It's not Flash cookies, the website doesn't use Flash!)
  • (Update) Other browsers are not affected. Microsoft Edge, after deleting browser history, doesn't allow reidentification. This is a Firefox-only issue!

My questions are:

  • How on earth are they able to reidentify me? Since their only motivation to reidentify me is to offer access to previously used mail addresses, I don't think they use any "dark" techniques like fingerprinting, but of course it can't be ruled out.
  • How can I protect from this kind of "super-tracking" used by this website?
Improve this question
14
  • 6
    Use incognito mode when you visit. Chrome and IE has it, I'm sure Firefox does too.
    – Appleoddity
    Sep 16, 2017 at 15:44
  • 6
    @Appleoddity: Yes, incognito mode helps, but as far as I understand this just prevents websites from storing or reading browser history etc. So when I delete everything this should have the same effect but it doesn't. Maybe a bug in Firefox?
    – manuel
    Sep 16, 2017 at 15:49
  • 23
    I strongly suspect the evil that is evercookie
    – Prime
    Sep 16, 2017 at 20:40
  • 2
    @Prime, in this very case it's not. Manuel is right: "Since their only motivation to reidentify me is to offer access to previously used mail addresses, I don't think they use any "dark" techniques" and peeking in the code you'll see they're simply using standard web technology. Firefox is to blame here, in this specific case.
    – Arjan
    Sep 17, 2017 at 8:15
  • 9
    Even clearing everything still won't protect against fingerprinting
    – o11c
    Sep 19, 2017 at 5:35

3 Answers 3

Reset to default
251

The website is using IndexedDB, for which MDN writes:

IndexedDB is a way for you to persistently store data inside a user's browser. Because it lets you create web applications with rich query abilities regardless of network availability, your applications can work both online and offline.

Not clearing it sounds like a bug in Firefox indeed, but apparently the developers feel otherwise. Like in March 2015, someone wrote:

But even when you delete all your history information the data from IndexedDB persist.

The right way to delete this data is by going to about:permissions address, look for the domain and pressing the Forget About This Site button.

While about:permissions does not work in my Firefox 55, going into Tools, Page Info, Permissions I get the button "Clear Storage":

Page Info dialog

Even worse, neither the greyed-out "Use Default: Always Ask" in the above screen capture, nor enabling "Tell you when a website asks to store data for offline use" in settings, Advanced, Network, have any effect to avoid storage:

Advanced settings

It seems the following from August 2011 may still apply (where "[only]" is added by me):

By default in Firefox 4, a site can use up to 50MB of IndexedDB storage. [Only] If it tries to use more than 50MB, Firefox will ask the user for permission [...]

In Firefox for mobile devices (Google Android and Nokia Maemo), Firefox will [only] ask for permission if a site tries to use more than 5MB [...]

To disable it altogether, go to about:config and disable dom.indexedDB.enabled. However, beware that such might affect plugins/add-ons as well, which seems to be why some want to remove that option, for which someone noted in May 2016:

Until IndexedDB is handled in the same way as cookies with respect to accepting/clearing and third-party behavior, this pref should exist.

(One may find dom.storage.enabled interesting too...)

Improve this answer
16
  • 154
    Indeed. Wow. That's a big deal. I didn't now there is such a loophole in the browser which is "obsessed with protecting your privacy".
    – manuel
    Sep 16, 2017 at 16:32
  • 23
    Disabling it even breaks the website mentioned before, and probably other websites too. Let's hope Mozilla will have a second look at this. One solution might be to delete this storage after I close my browser and only selected site which I trust can have their permanent storage. (this is the way I handle cookies at the moment)
    – manuel
    Sep 16, 2017 at 17:56
  • 28
    See also, bugzilla.mozilla.org/show_bug.cgi?id=1047098
    – Bob
    Sep 16, 2017 at 18:00
  • 10
    The german media mentions this topic: heise.de/-3835084
    – StanE
    Sep 19, 2017 at 12:21
  • 27
    It's always been profoundly stupid that Mozilla treat IndexedDB differently from cookies. It's still blatantly a kind of cookie. The protocol is different, but clearly if I want to block or delete all cookies I don't care about the protocol. Unfortunately, Mozilla's practice is always "add features now, sort out the privacy implications years from now, if ever". @manuel Try wading through about:config some time. There is truly a lot of scary stuff built into Firefox and enabled by default. Mozilla's alleged pro-privacy stance is pure marketing, and nothing more.
    – Boann
    Sep 19, 2017 at 13:40
57

As noted by Arjan it's unfortunately easy to leave site-data installed currently. This is improving somewhat with the preference UX redesign in FF57.

For example, under "Privacy and Security" there is now a "Site Data" section:

Redesigned Privacy & Security menu in Firefox 57

Clicking the site data "settings" will allow you to remove site-data for a specific origin:

Settings - Site Data

This will remove data stored in IDB, Cache API, etc. It will also remove cookies for the origin:

Removing site data for a specific site

(Sorry for not making this a comment under Arjan's answer, but I wanted to include these screenshots.)

Disclaimer: I am a Mozilla employee

Improve this answer
6
  • 4
    Any idea if you're also planning to actually prompt the user for permission to store the data to start with, even if it's just a single bit? (I've read somewhere that for third-party sites the setting for "allow third-party cookies" also applies to IndexedDB, but I've not tested that.) The "Offline Web Content and User Data" setting is quite deceiving, I feel, as it apparently does not apply to IndexedDB.
    – Arjan
    Sep 17, 2017 at 8:23
  • My comment about its "not a nuke everything for this origin" comment was wrong. It does actually delete cookies as well. I'll update the answer to reflect this.
    – Ben Kelly
    Sep 17, 2017 at 13:42
  • 8
    Its a difficult balance between prompting when appropriate and prompting too much. Right now storage is design around the idea sites can use storage without a prompt, but that the browser is free to delete it under pressure. If the site wants persistent storage then they need a prompt. Storage APIs are disabled in 3rd party iframes when 3rd party cookies are disabled. In the future we may move to "double-keying" the origin based on the top-level window origin (like safari has done) which would further isolate storage. In FF this is called "first party isolation" and comes from TOR project.
    – Ben Kelly
    Sep 17, 2017 at 13:50
  • 7
    @Ben Kelly: It still doesn't cover the use case "allow every website to store everything to maintain functionality but automatically delete storage at browser exit" Right? Private browsing is not a nice solution either since it keeps nothing at all (maybe I still want to keep my browser history or storage for sites I really trust. And no, I don't want to switch between normal and private browsing all the time.)
    – manuel
    Sep 17, 2017 at 14:16
  • 19
    You're correct out "delete on exit" cookie setting does not apply to things like IDB. I filed a bug here bugzilla.mozilla.org/show_bug.cgi?id=1400678. I believe our overall permissions UX is being reworked as well, but I'm not sure the kind of storage restrictions being talked about here are included or not. I filed a bug for that as well: bugzilla.mozilla.org/show_bug.cgi?id=1400679. We are working to improve these features, but its an incremental process. Sorry for the issues.
    – Ben Kelly
    Sep 17, 2017 at 15:30
5

Edit: Please read the comment by Ben Kelly before messing with any files in your profile.

Since there is no solution inside Firefox, one can easily implement a temporary fix for this outside of Firefox. IndexedDB files are stored in the directory <profile>/storage/default. By emptying this folder (for example though a scheduled script) you can recover full control over your data and how long it persists. Since each website is stored in a separate folder, you could even implement a whitelist/blacklist or basically every policy you want, given you have some programming experience.

It's not a nice solution and no excuse for Firefox developers to continue to postpone a proper solution for this. (Bugreports exist for years now!)

And be aware that the data format and location might change over time. For example, in a previous version, all IndexedDB data was stored in a single SQL file.

Improve this answer
3
  • 2
    Note that this can corrupt your profile for certain sites. Some state (like service worker registrations) are stored outside this directory. Sites can get confused if the storage is removed, but the service worker registration remains. Our new "Site Data" removal UX is shipping in november and is a better solution. Or, just run in private browsing mode which disables all storage.
    – Ben Kelly
    Sep 17, 2017 at 14:00
  • 1
    @BenKelly "...are stored outside this directory." What does that mean? Stored where? How do we delete that part too?
    – John1024
    Sep 23, 2017 at 6:04
  • 2
    We don't support arbitrary changes to the profile directory. If you start manually deleting stuff then don't be surprised if your profile becomes corrupted and sites don't work correctly. I really don't recommend it. Some of the issues raised by the original question here are being fixed as we speak. Also, private browsing, containers, etc have been mentioned as immediate solutions. Please don't hand modify your profile.
    – Ben Kelly
    Sep 24, 2017 at 0:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .