Bug in Safari’s Private Browsing feature reveals browsing history

[Petrovic]

Content source

http://www.myce.com/news/bug-in-safaris-private-browsing-feature-reveals-browsing-history-75419/

A bug in the Private Browsing feature of Apple’s browser Safari allows others to see which URLs have been visited. The Private Browsing feature of Safari should make sure that users can visit websites while no information about those visits is stored by the browser.

However, due to a bug Safari leaves traces that make it possible to see which URLs have been visited. When browsing in Private Browsing mode, Safari saves the favicon and the address of the visited website in a favicon database.

Favicons are normally loaded from the webserver of the visited website but Safari saves the images in a database to use them for other purposes like e.g. favorites and browsing history. Unfortunately Safari also saves the information when browsing in Private Browsing mode. Someone with physical access to the computer can see which websites have been visited in Private Browsing mode, Mac Issues reports.

Full Article

 

[Ink]

MacIssues: http://www.macissues.com/2015/03/17/safari-bug-saves-web-page-urls-in-private-mode/

While this is normal behaviour and is not at all a security risk, it may be considered a privacy issue as pages you might not want a trace of on your system will be logged to this database, which is a simply SQLite database commonly used in OS X, and which can be opened with a number of SQLite readers (including the built-in “sqlite3″ Terminal utility). Since the database is not encrypted, if your Mac is not using FileVault, then someone can technically access the file and even open it in a text editor to see the visited URLs.

Safari’s Webpageicon.db file can be opened in any SQLite database reader, where a list of all visited sites can be seen.

If you're concerned, there are 3 options:

1. Use another browser (Chrome, Firefox etc.)
2. Use a private and encrypted system
3. Manually delete the icon database

Details: http://www.macissues.com/2015/03/17/safari-bug-saves-web-page-urls-in-private-mode/

 

[cruelsister]

The stock broker that I use about 2 months ago posted a warning that clients accessing their site should NEVER (their caps, not mine) use Safari.