tor-webwml.git

1) - Investigation of Privacy Mode:
2)   - Good:
3)     - Cookies Cleared+memory only
4)     - Cache cleared and memory-only
5)     - History not available via javascript or CSS
6)     - Safe because currently unsupported:
7)       - Geolocation not supported in browser
8)       - DOM Storage not supported
9)       - HTML5 Storage not supported
10)     - Http auth is cleared
11)     - Do they have a session store?
12)       - Yes. It is disabled.
13)     - Form history disabled
14)       - But non-private entries still available
15)     - Malware and phishing protection
16)       - Per-url check?
17)         - Doesn't seem like it..
18)   - Bad:
19)     - RLZ Identifier sent with all queries even in Incognito mode
20)       - http://www.google.com/support/chrome/bin/answer.py?hl=en&answer=107684
21)     - Flash cookies not cleared
22)     - Google gears are still available
23)       - Do they have their own storage?
24)         - Yes. Completely ignores private mode.
25)     - Safebrowsing API key not cleared?
26)       - but updates may not happen "under" the incognito window
27)     - Desktop resolution available
28)     - Browser resolution is available
29)     - SSL session keys
30)       - Not cleared!
31)       - They clear trusted certs tho
32)     - Timezone not spoofed
33) 
34) - Misc Features we definitely need:
35)   - Incognito-specific proxy settings
36)     - Browser proxy settings currently do not apply immediately
37)   - Plugin enable/disable controls
38)   - Spoof user agent
39)   - Referer alteration API
40)   - Autolaunching of remote apps needs to be disabled
41)   - API to opt-out of all the opt-in tracking for incognito mode
42)   - Cookie API would be nice
43)   - Need network.security.ports.banned
44)     - http://www.remote.org/jochen/sec/hfpa/hfpa.pdf
45)   - Resize windows (content-window side possibly ok)
46) 
47) - Future investigation
48)   - Non-private form history still available
49)     - Forms seem to not be auto-filled, but this may be different
50)       for some fields?
51)   - How evil is google update? will it happen over incognito?
52)     - http://en.wikipedia.org/wiki/Google_Updater#Google_Updater
53)     - http://en.wikipedia.org/wiki/SRWare_Iron#Differences_from_Chrome
54)     - http://foliovision.com/2008/12/09/adwords-ppc-organic-rlz/
55)   - Test in more detail with sysinternals for disk writes
56)   - What about safebrowsing requests? Can they bypass proxy?
57)   - Video tag supports H264 and ogg via ffmpeg
58)     - Hrmm.. proxy bypass ability?
59) 
60) - Test results. Used Incognito Mode with the test suites from:

61)   https://www.torproject.org/torbutton/design/index.html.en#SingleStateTesting