What is exactly SiteSecurityServiceState.txt?

[TheVisitor]

I don't use Firefox

This reduces credibility on a...firefox forum? No offense really, but come on.

The entries in SiteSecurityServiceState.txt can be cleared (on restart) if Privacy tab Clear History is checked, and in the Settings dialog Site Preferences is checked. However, this deletes any and all site cookie exception permissions, which is very inconvenient.

Plus, in Fx39 trunk, if browser.preferences.inContent is true, the default, the options to show cookies and exceptions and clear history settings seem to be removed, and the latter two's functionality is not found in about:preferences. If false, the window dialog still has them. It doesn't seem to be a good sign, perhaps this is an in transition thing. The bug to remove hsts from the sqlite permissions db, where it would have been easy to manage, doesn't say in initial comments why this was a good idea.

The direction Firefox dev is going with user control of privacy settings is exactly opposite of what it states elsewhere for marketing purposes, in this case so far.

They are all there, nothing removed. Options->Privacy-> use the drop box to go to 'custom settings'... If you don't change anything when you close out of Options, that box will collapse hiding the settings again.

[malliz]

And its been like that for some considerable time... for many versions

[Virtual_ManPL]

@ Drumbrake - heh, you know... I'm completely calm
what about you? tin foil hat taken down already? (jk)

I'm just saying that if you're seeing some bug or want some enhancement, it's always better to report it,
even if it will be marked as INVALID or WONTFIX, because you will get the reply from the source why it's this way and can't be the other one
or even when you will need to wait ages for fix.
Useless whining like this will just get your irritation about this problem higher, so why "RUSTLE YOUR JIMMIES"?, where's completely no point in doing that.

Don't forget that it's Open Source, so you can also help and write patch by yourself or even fork the whole Firefox.

Going on IRC and speaking to one of the main devs which works on this part, is also a good motivation for them and can speed things up.

Good thing that you finally find the way to remove it.

[alta88]

They are all there, nothing removed. Options->Privacy-> use the drop box to go to 'custom settings'... If you don't change anything when you close out of Options, that box will collapse hiding the settings again.

You're right, the particular test profile window was narrow, and the buttons flex offscreen.. The side tabs collapse nicely for small device mode, but they forgot about those buttons.

[Drumbrake]

@ Drumbrake - heh, you know... I'm completely calm
what about you? tin foil hat taken down already? (jk)

You know, I'm always amused when folks who should know better dismiss privacy and security concerns as "tin foil hat" stuff.
Yes there is a lot of guessing here and some paranoia (due to the very nature of this thing) but data harvesting and user tracking/profiling are real, they are indeed the real business of the big names of the internet.
Mozilla itself (which, incidentally, I still consider one of the best assets of the free software movement) did not shy away entirely from this business with the much hated Directory Tiles, now is having another go at it with a questionable feature like Self Support.

I'm not implying, mind you, that all the storage databases that have been recently added are purposely meant to be exploited by the "usual suspects" -but they are there, storing data in new formats that can't be easily inspected and/or cleared (or even disabled for good) from less than experienced users. Someone will (if they aren't doing this already) have a go at peering in this databases and use them to their advantage, either to collect useful data or install persistent cookies or whatever.
If you look ,for instance, at the amount of trackers, cross-site requests, transparent pixels, ads and scripts on any of the so called "tech sites" , I don't know how can't you dismiss the fact that they are trying to precisely track you in any possible way.

This https://support.cdn.mozilla.net/static/img/blank.png is on Mozilla's Sumo pages, no less. Maybe just for statistics purposes, but still it is there.

I'm just saying that if you're seeing some bug or want some enhancement, it's always better to report it,
even if it will be marked as INVALID or WONTFIX, because you will get the reply from the source why it's this way and can't be the other one
or even when you will need to wait ages for fix.

Going on IRC and speaking to one of the main devs which works on this part, is also a good motivation for them and can speed things up.

Good thing that you finally find the way to remove it.

Well, I do not question that, sure it helps to file bugs, but then: for average users like me, it's not easy to file a valid bug ,and the attitude of the developers can be at times quite irritating ,something along the lines of "it is like that because we want so" or "because no one uses this feature".
Which also why I can't make a patch or participate on mailing lists, I'm not competent enough: I just sometimes spot things that don't seem right or make sense to me and try to report them, or get some explanations.

In this particular case, having to clear site-specific preferences (including zoom levels) to eventually get rid of HSTS supercookies doens't make sense to me, furthermore that kind of information is nowhere to be found on usual support pages.

[patrickjdempsey]

But if you are already concerned about privacy and tracking, you are probably already deleting cookies on exit, which should cause the file to not even be used... or have any of you "privacy conscious" folks even bothered to test that?

[Sabardeyn]

That isn't necessarily true Patrick.

I'm concerned about security and privacy and I've taken steps to limit cookie usage by preventing cookies being accepted and/or setting them to session only. But I do not delete all of them on exit because I do want some websites, that I feel are less likely to abuse my trust, to retain enough info about me to make usage of the site easier.

But not letting a known cookie onto my computer, is very different from having an unknown cookie placed on my computer without my knowledge, an easy means of oversight, or retention/deletion. Particularly when there are no cross-site limitations on this unknown cookie's usage. As Drumbake stated, sooner or later someone is going to take advantage of these cookies. Why should users wait until after abuse has occurred to start yelling about potential security holes?

How long before this new supercookie is used by Chase, Home Depot, Target or any one of the other "security conscious" companies to store trivial data like my name, address, social security number, bank accounts, credit card numbers, etc? And how long, after that, does someone else come along and start making nefarious use of it?

[patrickjdempsey]

That isn't necessarily true Patrick.

So I'll take that as a no, you haven't bothered to try it then. Next?

[JayhawksRock]

But if you are already concerned about privacy and tracking, you are probably already deleting cookies on exit, which should cause the file to not even be used... or have any of you "privacy conscious" folks even bothered to test that?

And probably never used or tested your 'read only' suggestion. That file remains empty for me.

[Sabardeyn]

So, you posted that the function is conditional on cookies being deleted, and I clearly stated that I don't automatically delete cookies on exit and thus not meet the condition, Firefox will still magically perform the necessary clean up?

[patrickjdempsey]

As with LSO's and several other "alternative" "tracking" cookies, if you want to manage them separately you probably need an extension. But you can't complain that Firefox doesn't offer a way to block/delete these when it clearly does, you just choose to not do it. Mozilla doesn't support every possible imaginable configuration, they will flat out tell you that is what extensions are for.

[Drumbrake]

But if you are already concerned about privacy and tracking, you are probably already deleting cookies on exit, which should cause the file to not even be used... or have any of you "privacy conscious" folks even bothered to test that?

In reply to this comment, of course I do set Firefox to clear cookies on exit and I've also been disallowing third-party cookies long before this became the default setting.

Still, I'll have to disagree with your point of view expressed above: the way I see it, if Firefox has storage methods for LSOs, DOM storage, indexedDB, HSTS supercookies and so on, it should also have a native, built-in way to clear this stuff.
And it should also be clearly exposed in the GUI and documented in SUMO pages as well.

Back when LSOs began being threated as "cookies" in general (even if they aren't) someone whose name I can't remember now wrote on bugzilla "for our users cookies are cookies, they expect them to be cleared if they wish so" or something along those lines.

The workaround to clear DOM storage is just that, a workaround that no normal user is aware of, it is documented on a Mozilla developer's page and nowhere else (that I'm aware of ), whilst the trick to set SiteSecurityServiceState.txt to a read-only file (or blank it with some command line such as echo ' ' > SiteSecurityServiceState.txt) is even more out of reach of average users.
Yes, I could add "site preferences" to the workaround for clearing DOM storage, but then again why should I lose per-site zoom preferences to clear HSTS cookies?

[EdwardDHorvath]

I think this is a problem that can be solved to everyone's satisfaction with relative ease by simply splitting "Site Preferences" in the clear history dialogs into "User-Set Site Preferences" and "Server-Set Site Preferences"

I have filed a bug requesting this change:
https://bugzilla.mozilla.org/show_bug.cgi?id=1147882

Please vote or comment in support of this bug

[Drumbrake]

Thank you very much.

[EdwardDHorvath]

The version of FF released today adds another item to the list ... "Opportunistic Encryption"

It's a good feature, but again it allows servers to store data in the user's profile that presumably also can't be cleared unless also clearing user-specified site preferences.

"This [(server-set)] mapping is saved and used in the future." "You [(the server administrator)] can control some details about how long the Alt-Svc mappings last and some other details."
- http://bitsup.blogspot.com/2015/03/oppo ... refox.html