this post was submitted on 30 Nov 2025
52 points (87.1% liked)

Firefox

23014 readers
404 users here now

/c/firefox

A place to discuss the news and latest developments on the open-source browser Firefox.


Rules

1. Adhere to the instance rules

2. Be kind to one another

3. Communicate in a civil manner


Reporting

If you would like to bring an issue to the moderators attention, please use the "Create Report" feature on the offending comment or post and it will be reviewed as time allows.


founded 6 years ago
MODERATORS
 

Is this behavior expected? I would imagine it would be a privacy violation in a multi-user system. I thought they had some sort of encryption for hiding the sites that I visit.

BTW, FF does not do this on private mode. But still it is concerning, that any program can know about the sites I visit just by looking at ~/.mozilla/profile/storage/default.

you are viewing a single comment's thread
view the rest of the comments
[–] terribletortoise@lemmy.world 46 points 9 months ago* (last edited 9 months ago) (4 children)

The tilde (~) means that path is located in the per-user home directory. The default behaviour is for user home directories to be only accessible by that specific user.

The encryption you're referring to is likely specific to Firefox Sync (i.e. syncing your FF settings, history, etc. across devices). Sync is end-to-end encrypted. But I'm not surprised that it's unencrypted on disk.

[–] brokenwing@discuss.tchncs.de 3 points 9 months ago (3 children)

But wouldn't it be better if they chose to obfuscate it. Are there any inherent disadvantage in doing so?

[–] dormedas@lemmy.dormedas.com 27 points 9 months ago (1 children)

Generally, no. If a person has access to your home folder, it doesn’t matter if site-data is site-data or some UUID, the person can still look around and find that data. How to do so would be on the internet, in the source code for Firefox.

Firefox simplifies its engineering efforts and makes site-data clearly visible to the proper user by relying on the system’s security measures instead of inventing its own bespoke ones.

[–] naeap@sopuli.xyz 3 points 9 months ago

You could hash the duckduckgo URL for example

But yeah, the data would be there, not sure how much that would help

load more comments (1 replies)
load more comments (1 replies)