[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #8534 [EFF-HTTPS Everywhere]: [CHROME] Cookies can bleed to/from incognito mode

#8534: [CHROME] Cookies can bleed to/from incognito mode
----------------------------------+-----------------------------------------
 Reporter:  pde                   |          Owner:  pde
     Type:  defect                |         Status:  new
 Priority:  normal                |      Milestone:     
Component:  EFF-HTTPS Everywhere  |        Version:     
 Keywords:                        |         Parent:     
   Points:                        |   Actualpoints:     
----------------------------------+-----------------------------------------

Comment(by mikeperry):

 Turns out this appears to be an Chrome API bug. We're getting the
 onCookieChanged event, and the cookie we get in that event has a storeId
 of 0 regardless of where it comes from (Incognito or not). We then turn
 right around and set the secure flag on the cookie and issue a
 cookies.set(cookie). Since the storeId is still the default store, the
 cookie leaks to normal mode.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/8534#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs