User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:16.0) Gecko/20100101 Firefox/16.0 Build ID: 20121010144125 Steps to reproduce: 1) Disable tab preview on empty tab page. 2) Disable writing of cookies, cache to disk. 3) Expect privacy. 4) Waste a day creating a ramdisk at boot and symlinking Library/Caches/Firefox there. Actual results: 1) Discovered Library/Caches/Firefox/Profiles/*/thumbnails directory while Firefox is running. 2) Learned every page I've visited recently apparently has a mid-resolution cleartext copy stored on disk. 3) Tried shutting down browser, discover thumbnails continue to persist despite 'clear private data' feature being configured to destroy everything but whitelisted cookies. Expected results: Timestamped JPGs of my browsing activity should not appear on disk

"2) Disable writing of cookies, cache to disk." should read "2) Disable disk cache"

Bug could also be entitled "PERF: tab preview feature is needlessly generating thumbnails", if Mozilla don't consider this a security concern.

(In reply to David M. Wilson from comment #0) > 2) Disable writing of cookies, cache to disk. > 3) Expect privacy. Thumbnails are neither cookies nor cache. Thumbnails will respect this setting, I think: Preferences -> Privacy -> History -> Firefox will: [ Never remember history ] (In reply to David M. Wilson from comment #2) > Bug could also be entitled "PERF: tab preview feature is needlessly > generating thumbnails", The thumbnail service isn't exclusively used by the new tab page.

(In reply to Dão Gottwald [:dao] from comment #3) Can't we create a new setting in Privacy tab in Options that will be linked to "browser.pagethumbnails.capturing_disabled" known from issue with thumbnails memory leak? It will be good for performance and for people which have disabled "New Tab Page".

(In reply to Virtual_ManPL [:Virtual] from comment #4) > (In reply to Dão Gottwald [:dao] from comment #3) > Can't we create a new setting in Privacy tab in Options that will be linked > to "browser.pagethumbnails.capturing_disabled" known from issue with > thumbnails memory leak? What memory leak? > It will be good for performance and What performance problem are you referring to? > for people which have disabled "New Tab Page". As I said in comment 3, the new tab page isn't the only consumer of the thumbnail service.

(In reply to Dão Gottwald [:dao] from comment #5) > What memory leak? I mean this leak and bug 754671 in which size of used space by thumbnails keeps growing infinitely. (In reply to Dão Gottwald [:dao] from comment #5) > What performance problem are you referring to? I remember that thumbnails are taken on every site which we visited (except now probably encrypted sites by security reasons). So when you don't use "New Tab Page", this feature simply wasting your CPU, memory and space, if I understand this correctly of course. (In reply to Dão Gottwald [:dao] from comment #5) > As I said in comment 3, the new tab page isn't the only consumer of the > thumbnail service. What's more that is using the thumbnails? I have "browser.pagethumbnails.capturing_disabled" set to "true" in about:config and I didn't see thumbnails in "New Tab Page". But I still see 'thumbnails' when I drag tabs and windows or I still see Panorama (SHIFT+CTRL+E) thumbnails.

(In reply to Virtual_ManPL [:Virtual] from comment #6) > (In reply to Dão Gottwald [:dao] from comment #5) > > What memory leak? > I mean this leak and bug 754671 in which size of used space by thumbnails > keeps growing infinitely. That bug is fixed. > > What performance problem are you referring to? > I remember that thumbnails are taken on every site which we visited (except > now probably encrypted sites by security reasons). So when you don't use > "New Tab Page", this feature simply wasting your CPU, memory and space, if I > understand this correctly of course. Without some evidence that there's significant CPU, memory and space overhead, this seems purely hypothetical. > > As I said in comment 3, the new tab page isn't the only consumer of the > > thumbnail service. > What's more that is using the thumbnails? Panorama uses it for tabs that aren't restored yet, for instance. Generally the service isn't tied to any specific feature. Future Firefox features can utilize it and add-ons can too.

This is to confirm that with "Remember my browsing and download history" unchecked, Firefox 16.0.1/OS X continues to write thumbnails of my browsing and download history to a permanent store (even if it later decides to remove pointers to their location, they still persist on disk). The difference between writing thumbnails to disk, and temporarily writing URL history to disk, is that private information is very easily discernible from the stored data (e.g. banking apps). Suggest thumbnail service respects "browser.cache.disk.capacity" and/or "browser.cache.disk.enable", since a thumbnail is effectively a cached copy of a rendered page.

The thumbnail service doesn't store thumbnails for pages that aren't cached, like those served by banking sites. See bug 754608.

At the very least, this is a confusing UI - it's reasonable to expect that unchecking a box labeled "Remember my browsing and download history" would prevent us from saving thumbnails for visited pages. That checkbox controls places.history.enabled, which controls places history. Maybe we should make that checkbox also set browser.pagethumbnails.capturing_disabled.