Firefox logged me in...without entering login information
I have a Firefox account and use it to sync across devices; being able to sync and then completely log out on one device is a primary reason I use Firefox.
I log out of devices that I do not own when I'm exiting Firefox. Today I opened Firefox on a device that I'm 100% certain I logged out of yesterday - and found that my bookmarks, bookmarks bar, and add-ons were already visible and active, and one of my add-ons was already logged in.
I verified that the Firefox Sync / login screen showed that no one was logged into the Firefox account, and then I logged in using my usual credentials. It reflected that I was then logged in, but everything else remained visible.
I followed Firefox instructions for viewing the logs, and strangely, there was no log. I went up a directory, and found that all the logs were in the 'failed' directory. Clicking on each of the failed subfolders shows only: ids []
This is very concerning because it entirely negates the security and privacy aspects of having a login. I was not logged into Firefox - and the Firefox interface confirmed that this morning, in addition to confirming it when I logged out yesterday - yet somehow not only were my personal bookmarks showing, but one of my add-ons was also logged in, providing further access to anyone who might have opened a Firefox window from this device.
All Replies (10)
When you login to a device using Firefox Sync, that data is transferred to that device. It doesn't get removed when you log out of your Firefox Account on that device, it just stops syncing.
If I understand your question correctly, you did log into that device previously but then just logged out. In that case, unless you manually removed all of the Firefox data after logging out of Firefox Sync, it's entirely normal that your data would still be there later.
As for your add-on data syncing, that's intended to happen. The developers that make add-ons can determine what add-on data (if any) gets synced between devices. Obviously the developer of the add-on has included their login credentials in the list of data that needs to be synced.
Thanks for your response, Wesley. I'm sorry I wasn't entirely clear about what was happening. To clarify my initial post:
- I had logged out of all add-ons/plugins and individual tabs/sites.
- I had logged out of Sync by using the "Disconnect" button.
- I had cleared history.
- I had closed the Firefox window.
On all prior occasions, performing those four steps - logging out of individual sites, logging out of plugins, logging out of Sync, and clearing history - had removed all access to my personal data. This has been the case for many months using a Firefox Sync login across multiple devices (three laptops, one desktop, and a mobile device). Today was the first instance in which all of it was accessible without logging in.
While I understand that the intention of Sync is to be able to access this information across devices, the intention of the "Disconnect" function is to stop syncing to the device, and the intention of clearing history and logging out is to...well, clear history and log out. ;) When I open the Firefox browser after performing all of those actions, I do not expect the opposite to be true - i.e. it should not already be logged in.
Perhaps I'm not understanding your question because in your original post you specifically refer to your bookmarks being visible when you accessed Firefox later (unless of course you select the option to remove all synced data as well). However, that should have always been the case, since clearing history doesn't have anything to do with your bookmarks.
Does this still consistently happen or was this a one-off occurrence?
If you aren't logged into Firefox Sync, Firefox won't be able to sync your data. This seems like a case of the data not being removed rather than a case of Firefox syncing data after it's logged out.
It certainly does seem like an impossibility...which is why I came here to ask about and report it. ;) From my perspective, it seems the only likely answer is that it didn't fully disconnect / log out of the last use - but I don't actually know what happened, or how, as I did nothing differently. I just know that I was not yet logged in this morning, and it was displaying information that it hadn't in the past, and which I believe is connected to the login and history, both of which I had manually cleared.
To answer your first question, initially I did think that the bookmarks would stay synced across devices...however across all my uses of Firefox, this is actually the *first* time they have stayed synced after logging out / disconnecting. In the past, disconnecting / logging out of sync has removed the bookmarks toolbar and all add-ons. It may be that every *other* time it was not performing correctly...but the action had previously and consistently removed those things until my next login, which is why I expected it to perform that action again between yesterday and today.
To answer your other question, this is the first time Firefox has behaved in *this* way. As I mentioned above, all other times I've used it (daily for months, across multiple devices), the bookmarks toolbar and add-ons have also logged out. In fact, upon each new login, each of the add-ons had opened new tabs indicating that they had been added and connected, as if for the first time, which I found annoying, but not unusual since it had always done that.
I have also selected the option to remove all data on Disconnect. It's possible that there is a setting I'm missing somewhere, but I did not change settings between yesterday and today until *after* noticing that everything already appeared synced prior to logging in. Then I went into settings and attempted to divine which settings might fix the error. ;)
And again, while I was viewing and accessing all synced data, the Sync / login screen in Firefox was displaying that no one was yet logged in, and prompted me to log in to begin the sync process.
I couldn't say what was happening in the past where you experienced things functioning the way you feel is correct, but once bookmarks and other non-volitile data are synced, they do not get erased by clearing history.
When using Firefox and synchronizing data on devices not your own, you may want to delete cache and data using, e.g., Androids Settings → Apps → Firefox. For general-purpose computers, you can start Firefox and create a new profile, switch to that profile, and then sync. You can switch back to default profile when done and delete your temporary profile.
Of course, you may be overwriting someone's static profile on a device not your own if they do not also sync to the cloud and it is not an empty profile, regardless of deleting or not on logout.
Thanks @crankygoat. It seems that what was previously happening (bookmarks not syncing) was not the standard / intended functionality, and somehow that got corrected and freaked me out. ;)
Extremely coincidentally, after I posted this, I noticed that all the issues miraculously stabilized: bookmarks and add-ons are now consistently available, the previously labeled "sync" / "disconnect" button now says "sign in" / "sign out", and now I get a fancy pop-up that warns me about what "sign out" means.
It's still unsettling that my plugin was already logged in, but I'm chalking it up to an anomaly. That hasn't happened since the original issue.
In the meantime, I have to rethink how I use my profile and sync on third-party machines. In Chrome, I can log out, delete the history and cache, and close the window and it's like I was never there. But I think I have my sync settings setup differently for Chrome than for Firefox. I prefer to use programs that allow me plug-and-play-type access to my personal data - that I can then "turn off" by logging out. For a long time, that's how Firefox was functioning for me, and it's one of the reasons I switched to using it over Chrome. Now that I understand bookmarks and add-ons are not (usually) treated that way in Firefox using sync, I'll have to rethink how I use it.
Thanks for your responses, all.
So, I looked into this some more and it appears that the ability to delete local data when disconnecting from Firefox Sync was removed in Firefox 71 (see bug 1582023). Too many users were misunderstanding the confirmation screen and accidentally deleting all of their data.
@Wesley, interesting! If I understand it correctly, it should still offer the option to delete local data, no? I don't seem to have that option currently, after whatever change / update occurred that changed my configuration.
From the link:
"It will become possible to disconnect from just sync but fxa still being signed in to the browser, or disconnecting from both sync and fxa. It will be possible to disconnect from the FxA toolbar as well as about:preferences#sync."
No, the option to delete the local data was permanently removed. That's why you no longer see that option.