[tor-bugs] #8987 [Tor bundles/installation]: OS X Saved Application State files contain traces of the Tor Browser Bundle

[Tor Bug Tracker & Wiki]

#8987: OS X Saved Application State files contain traces of the Tor Browser Bundle
--------------------------------------+-------------------------------------
 Reporter:  runa                      |          Owner:  erinn
     Type:  defect                    |         Status:  new  
 Priority:  normal                    |      Milestone:       
Component:  Tor bundles/installation  |        Version:       
 Keywords:  tbb-disk-leak             |         Parent:       
   Points:                            |   Actualpoints:       
--------------------------------------+-------------------------------------
 A forensic analysis of the Tor Browser Bundle (version 2.3.25-6, 64-bit)
 on OS X 10.8 showed that the Saved Application State files contain traces
 of the Tor Browser Bundle.

 Resume is one of the new features in OS X 10.7 and 10.8. The feature
 allows applications to save their last known state when they are closed,
 and then return to this state when they are later reopened.

 While the Tor Browser does not use this feature, it does leak information
 in the files which are written to the /Users/runa/Library/Saved
 Application State/ directory:

  * /Users/runa/Library/Saved Application
 State/org.mozilla.torbrowser.savedState/data.data
  * /Users/runa/Library/Saved Application
 State/org.mozilla.torbrowser.savedState/window_3.data
  * /Users/runa/Library/Saved Application
 State/org.mozilla.torbrowser.savedState/windows.plist

 The windows.plist file contains the HTML title tag of the last active tab
 in the Tor Browser (or currently active tab, if the browser is still
 open). If the last active tab was torproject.org, then the following
 string will be present in the file:

  * <string>Tor Project: Anonymity Online</string>

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/8987>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online