New issue
Advanced search Search tips

Issue 880357 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Closed: Sep 5
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug
M71



Sign in to add a comment

Clear omnibox suggestion image cache when the user clears browsing data

Project Member Reported by jdonnelly@chromium.org, Sep 4

Issue description

Though the cache is small an in-memory, it's still important that "Clear browsing data" completely remove all personal information, including the answer and entity images in the cache (https://cs.chromium.org/chromium/src/chrome/browser/bitmap_fetcher/bitmap_fetcher_service.cc).

See crbug/854773 for additional context.
 
Cc: dullweber@chromium.org jdonnelly@chromium.org
Is there any existing code that clears an in-memory cache?  If so, pointing me to it will expedite implementation.  If not, then I think it's a mistake to introduce Chrome's codebase to the notion that clearing inaccessible memory caches is necessary to good privacy.  It may set a precedent that leads to lots of useless code and wasted user time.

To see what I mean, let's think about what actually has to happen here.  We have a few images cached in RAM that's linked into program logic by pointers in a collection.  The way to get at these images is to request them by the URL used to fetch them in the first place; otherwise they are essentially locked in a black box without a key.  If someone can access the raw program memory to get at these images, then the user's got much bigger problems to worry about.  Would it be sufficient to unlink the image memory by clearing the collection?  An adversary with RAM access could still find the images!  We should obliterate them with kittens and chaos first, then unlink the pointers.  And if we're that paranoid, then there are surely many other areas of memory that should get wiped clean as well.

The only argument I can find in favor of clearing this cache is that you can check whether a *known* image URL is cached by measuring latency or network traffic when requesting it.  Knowing what to request and tricking Chrome into doing so is a pretty tall order, though.  Still, it's better for privacy to err on the side of paranoia - so if this is the concern, let me know and I will simply clear the collection and leave the images intact but unlinked.  If this is not the concern, then what is?
Status: WontFix (was: Assigned)
You're right that if it is currently only possible to observe the content in the cache by looking at network connections, the privacy impact of this cache it not very big. I also agree that full deletion of data from RAM or sectors on the disk is not really possible.
It looks like we only remove in-memory caches that affect the behavior of websites or personalization so it's fine with me if we just keep the cache.
Yeah, even with network access you'd have to know which URLs to request, and the odds of getting a 'hit' (observing that cache is used to serve image instead of going to network for download) are about 12/infinity ~= 0.  And any missed guess reduces the numerator by 1, so we should be pretty safe!

Sign in to add a comment