On 08/24/2016 12:29 AM, Alexander Bokovoy wrote:
> On Tue, 23 Aug 2016, Dusty Mabe wrote:
>>
>> I can't seem to get firefox-48.0-5.fc24.x86_64 to work with kerberos
>> single sign on in a private window. It works fine when using a
>> non-private window.
>>
>> Any ideas on why this would have broken? Anyone else seeing this?
> We fixed an information leak that was happening in private browsing.
> However, the same (almost the same) mode switch was used in Firefox to
> implement 'Never Remember History' mode which is almost private in the
> sense that browsing history is not remembered.
>
> With the fix for
https://bugzilla.mozilla.org/show_bug.cgi?id=1291700,
> 'Never Remember History' mode is now allowing GSSAPI to work.
> Private browse mode will not allow GSSAPI credentials to work, though,
> as this is an information leak.
>
I wonder if the default setting for
network.negotiate-auth.trusted-uris=https:// is or isn't a leak.
By the way, this is a Fedora default customization, Upstream binaries
don't do that