[Privacy bug] The creating a bookmark in a private tab with VPN causes connection non through VPN
-
brz7fvuw3o last edited by brz7fvuw3o
You know that search engines circumvent the VPN by default in Opera?
Ridiculous default of course, that goes for much more in Opera.
[The most serious thing is that Opera starts by default as a scheduled task to check for updates.
In practice, this means that every time Windows Opera starts up, it always checks automatically for updates.
How you dare to call yourself a privacy browser remains a mystery to me.
By the way, Brave and I think Chrome (you can find it anywhere in Windows where you don't want it anyway) as well.
Actually it's a pity Opera doesn't have these things in order, in itself it's a pretty nice browser.] -
anonan last edited by anonan
You know that search engines circumvent the VPN by default in Opera?
I don't think that is a problem.
- It can be easily found in the options (It's not a hidden option).
- It can be disabled (It's the important part).
- It has benefits - you get a relevant search result (for based on your IP location) and no captcha.
The most serious thing is that Opera starts by default as a scheduled task to check for updates
I also want an option to easily disable auto-updates, for example, future Manifest V3 can break a lot of extensions that get you better privacy (not only ads blockers).
-
burnout426 Volunteer last edited by
Can you double-check that this is still the case now since the bookmarks manager now loads in the private window again when you open it from the private window?
-
anonan last edited by anonan
I opened a private tab, enable "VPN", opened a site. Connection is through "VPN". There is no log in DNSQuerySniffer about the connection to the site.
Bookmark the site:
The image for the bookmark are loaded non through "VPN".
As a result the part of the connection – DNS resolve – is showed in DNSQuerySniffer log. -
burnout426 Volunteer last edited by burnout426
Okay. Thanks for the update. I'll test and test in Opera Developer too. Don't know if it's expected behavior or not yet though.
In Opera Developer, I'll see if
opera://flags/#opera-doh
makes a difference. Since the query goes over HTTPS, maybe it'll go through the VPN then. Maybe it won't though still if it's an issue with private window/normal window context where the VPN isn't on in the normal window.I assume everything works fine if VPN is on by default and then you open a private window?
-
anonan last edited by anonan
@burnout426
This happens then "VPN" enabled only in a private tab. Obviously, because the process of creating of a bookmark is going in common window that is wrong.DNS over HTTPS is not a decision. Absolutely.
DNS resolve is just a part of connection to the site, the next step is HTTP/HTTPS connection that also in this case does not go through "VPN". In this case IP of the site and a content (in case HTTP) are visible for ISP.
-
anonan last edited by anonan
DNS over HTTPS is not a decision. Absolutely.
Here is it.
HTTP (TCP) connection is visible too. It is unacceptable for any good VPN.(I have used Wireshark.)
-
anonan last edited by
A bit more presentable screenshot (domain of images for the previews is the same as domain of the site):
This site is on HTTP so I (and ISP) can see the all content, not only IPs. -
burnout426 Volunteer last edited by burnout426
Thanks for all the details. Opera has confirmed your findings and they are investigating. I'll post if there are any updates.
-
burnout426 Volunteer last edited by
Partial fix in https://blogs.opera.com/desktop/changelog-for-65/#b3459.0, but there's a little more to do, so sit tight.
-
burnout426 Volunteer last edited by
Can you test in https://blogs.opera.com/desktop/2020/03/opera-69-0-3638-0-developer-update/? There's "DNA-81409 Switch to Chromium’s favicon fetcher" in the changelog, which might help with this issue.
-
anonan last edited by anonan
I don't think what it will fix this bug. The problem is not with favicons, but with images (that are used as a bookmark preview) that are loaded through a non incognito window.
It probably may fix this bug with favicons, but I have no desire to test it.
-
anonan last edited by anonan
Yes, I was right, that fixed the bug with favicons (that were created in the incognito mode). But.
The bug is this topic about is still not fixed.
-
burnout426 Volunteer last edited by
@anonan said in [Privacy bug] The creating a bookmark in a private tab with VPN causes connection non through VPN:
The bug is this topic about is still not fixed.
In the latest Opera Developer you still see favicon fetches bypassing the VPN?
-
anonan last edited by anonan
Sorry, my previous message is about the latest release version (68), not develop (69).
you still see favicon fetches bypassing the VPN?
I have never said that. I talked only about previews (It are images for the bookmark, Opera parses the HTML for image URLs (not only
img
tags) and downloads them), but I have rechecked it, and the favicon is downloanig non through the incognito window too.Opera 68:
I have created the bookmark in the incognito window with enabled "VPN", but Opera downloaded both the favicon and images for the preview through the default window, that has no enabled "VPN", so I can see HTTP connections to the site in Wireshark:
I did not test it in the Developer version.
-
burnout426 Volunteer last edited by
@anonan said in [Privacy bug] The creating a bookmark in a private tab with VPN causes connection non through VPN:
I did not test it in the Developer version.
It's supposed to have everything fixed in this area and Opera doesn't know of any other cases where things leak. But, if you can still find a situation where Opera leaks, then Opera would like to know. Otherwise, it's considered fixed and you'll see it fixed in Opera Stable once stable reaches 69.
-
burnout426 Volunteer last edited by
In testing I think I'm able to reproduce in both Opera stable and Opera Developer.