3

Title says it all. I have crash reports specifically disabled and yet the browser submitted one anyway. What's the risk of login information (in particular: saved login info, open sessions in online services) being compromised? Is there any way of getting Mozilla to delete a crash dump?

Some advice for everyone else running Firefox: delete crashreporter.exe from the Firefox directory, that thing is dangerous. There is no legitimate reason to send any such information when the end-user has taken every step to say "No". I was never prompted to send any crash report, the browser just sent it automatically despite having opted to disable them in the Settings.

  • Something else that I would like to know. Can the crash dump contain any text-data from tabs that weren't involved in the crash? – user1258361 Sep 30 '16 at 5:19
  • 2
    If it sent a report even though you opted out, I would encourge you to file a bug report with Mozilla so they can fix it. – Anders Sep 30 '16 at 7:18
3

It is very unlikely that you gave away compromising information. Your active logins, cookies, search history and the content of your visited websites are safe. Presumably, the most relevant sensitive information in your case is the last visited URL (which you had to explicitly agree to submit).

Also note that Firefox doesn't submit crash reports without your consent. In the Mozilla docs you can find details on how the Mozilla Crash Reporter works and how you can understand crash reports.

What does a crash report contain?

A Firefox crash report contains information relevant for debugging such as:

  • Browser version
  • Installed extensions
  • Operating system version and configuration
  • Stack trace of the crash (involved modules, functions, etc.)

You can optionally include the URL of where the crash has occurred and a contact email address.

Where can I view my previous crash reports?

You can view your crashes from inside Firefox at about:crashes or locally at ~/.mozilla/firefox/Crash Reports/. All submitted Firefox crash reports are published on crash-stats.

Who else can view a crash report?

Everyone is able to view a basic version of your report but only few users can see sensitive details.

Some fields, such as "URL" and "Email Address", are privacy-sensitive and are only visible to users with minidump access.

(Source)

So even if you submitted the URL - it's not public, developers will probably never read it given the total amount of crash reports, and nobody will know it was you.

  • 1
    You're saying that there's no way Firefox could submit a crash report without permission just because that's what the docs say? – Craig Sep 30 '16 at 7:24
  • 1
    @Craig I did not audit the source code if that is your point. The docs describe how the software works. In this case they say that crash reports are prompted. This is in accordance with my personal experience. – Arminius Sep 30 '16 at 7:37
  • If anyone wants to replicate this (Firefox 39.0.3, no idea if a newer version patched it): 1) Disable crash reporting in settings -> advanced -> data choices. 2) Get Firefox to crash. The crash reporter should run even with this disabled. 3) Go to about:crashes and click on the crash dump. 4) The browser will submit the crash dump even with the crash reporting "disabled". This kind of application behavior is downright dangerous and borders on spyware. What button do I have to click to tell the browser "No means no?" – user1258361 Sep 30 '16 at 14:17
  • I'm just saying the docs describe how they intended, or at least how the person writing that part of the documentation intended, for the software to function at the time that part of the documentation was written. There could be a lot of reasons why the actual system behaves differently from the documentation. – Craig Sep 30 '16 at 14:21
  • Doesn't matter what the documentation intended, sending data like this when the end-user has specifically opted out could be considered a privacy violation or even data theft. The about:crashes UI failed to warn that clicking on any of the dumps would send a crash report no matter what the settings were. – user1258361 Sep 30 '16 at 14:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.