[Privacy bug] The creating a bookmark in a private tab with VPN causes connection non through VPN
-
A Former User last edited by A Former User
The related topics:
[1]
Bookmarking a new site (which you din’t visit in non-incognito mode before), bookmarks will not have a favorite icon.[2]
The creepy bookmark warning when you create a bookmarks and have at least one incognito tab.
Better change the text what creating a bookmark in incognito mode will cause the privacy leak. -
A Former User last edited by A Former User
It can be easy detected by DNS leaking. (You need only DNSQuerySniffer)
....The additional:
The private tab is with enabled "VPN".
The non-private tab (window) is without enabled "VPN".So, the problem is obvious – сreating of a bookmark happens in common window even you add it in an incognito tab.
-
brz7fvuw3o last edited by brz7fvuw3o
You know that search engines circumvent the VPN by default in Opera?
Ridiculous default of course, that goes for much more in Opera.
[The most serious thing is that Opera starts by default as a scheduled task to check for updates.
In practice, this means that every time Windows Opera starts up, it always checks automatically for updates.
How you dare to call yourself a privacy browser remains a mystery to me.
By the way, Brave and I think Chrome (you can find it anywhere in Windows where you don't want it anyway) as well.
Actually it's a pity Opera doesn't have these things in order, in itself it's a pretty nice browser.] -
A Former User last edited by A Former User
You know that search engines circumvent the VPN by default in Opera?
I don't think that is a problem.
- It can be easily found in the options (It's not a hidden option).
- It can be disabled (It's the important part).
- It has benefits - you get a relevant search result (for based on your IP location) and no captcha.
The most serious thing is that Opera starts by default as a scheduled task to check for updates
I also want an option to easily disable auto-updates, for example, future Manifest V3 can break a lot of extensions that get you better privacy (not only ads blockers).
-
A Former User last edited by A Former User
Bump.
Or Opera team think that it is an appropriate behavior?
-
burnout426 Volunteer last edited by
Can you double-check that this is still the case now since the bookmarks manager now loads in the private window again when you open it from the private window?
-
A Former User last edited by A Former User
I opened a private tab, enable "VPN", opened a site. Connection is through "VPN". There is no log in DNSQuerySniffer about the connection to the site.
Bookmark the site:
The image for the bookmark are loaded non through "VPN".
As a result the part of the connection – DNS resolve – is showed in DNSQuerySniffer log. -
burnout426 Volunteer last edited by burnout426
Okay. Thanks for the update. I'll test and test in Opera Developer too. Don't know if it's expected behavior or not yet though.
In Opera Developer, I'll see if
opera://flags/#opera-dohmakes a difference. Since the query goes over HTTPS, maybe it'll go through the VPN then. Maybe it won't though still if it's an issue with private window/normal window context where the VPN isn't on in the normal window.I assume everything works fine if VPN is on by default and then you open a private window?
-
A Former User last edited by A Former User
@burnout426
This happens then "VPN" enabled only in a private tab. Obviously, because the process of creating of a bookmark is going in common window that is wrong.DNS over HTTPS is not a decision. Absolutely.
DNS resolve is just a part of connection to the site, the next step is HTTP/HTTPS connection that also in this case does not go through "VPN". In this case IP of the site and a content (in case HTTP) are visible for ISP.
-
A Former User last edited by A Former User
DNS over HTTPS is not a decision. Absolutely.
Here is it.
HTTP (TCP) connection is visible too. It is unacceptable for any good VPN.(I have used Wireshark.)
-
A Former User last edited by
A bit more presentable screenshot (domain of images for the previews is the same as domain of the site):
This site is on HTTP so I (and ISP) can see the all content, not only IPs. -
burnout426 Volunteer last edited by burnout426
Thanks for all the details. Opera has confirmed your findings and they are investigating. I'll post if there are any updates.
-
burnout426 Volunteer last edited by
Partial fix in https://blogs.opera.com/desktop/changelog-for-65/#b3459.0, but there's a little more to do, so sit tight.
-
-
-
burnout426 Volunteer last edited by
Can you test in https://blogs.opera.com/desktop/2020/03/opera-69-0-3638-0-developer-update/? There's "DNA-81409 Switch to Chromium’s favicon fetcher" in the changelog, which might help with this issue.
-
A Former User last edited by A Former User
I don't think what it will fix this bug. The problem is not with favicons, but with images (that are used as a bookmark preview) that are loaded through a non incognito window.
It probably may fix this bug with favicons, but I have no desire to test it.
-
A Former User last edited by A Former User
Yes, I was right, that fixed the bug with favicons (that were created in the incognito mode). But.
The bug is this topic about is still not fixed.
-
burnout426 Volunteer last edited by
@anonan said in [Privacy bug] The creating a bookmark in a private tab with VPN causes connection non through VPN:
The bug is this topic about is still not fixed.
In the latest Opera Developer you still see favicon fetches bypassing the VPN?
-
A Former User last edited by A Former User
Sorry, my previous message is about the latest release version (68), not develop (69).
you still see favicon fetches bypassing the VPN?
I have never said that. I talked only about previews (It are images for the bookmark, Opera parses the HTML for image URLs (not only
imgtags) and downloads them), but I have rechecked it, and the favicon is downloanig non through the incognito window too.Opera 68:
I have created the bookmark in the incognito window with enabled "VPN", but Opera downloaded both the favicon and images for the preview through the default window, that has no enabled "VPN", so I can see HTTP connections to the site in Wireshark:
I did not test it in the Developer version.
