Let's say I look up cat images, right?
With a normal image search, eventually my browser may end up loading an image directly from whatever random website is hosting it:
Me → random website → picture
Waterfox Private Search has an image proxy, so instead it can do:
Me → Waterfox → random website → picture
That's neat because the random website doesn't get my IP just because I'm loading its image.
BUT I noticed something that seems a little concerning.
When my browser asks Waterfox's image proxy for that cat picture, my current logged-in Waterfox Search session cookie is sent along with the request.
So instead of the image proxy simply receiving something like:
"Some random person wants cat.jpg"
it's receiving something more like:
"This authenticated Waterfox Search session wants cat.jpg."
That session is capable of being associated with my Waterfox Search account, which is also the account I use for my paid subscription.
To be clear, I'm NOT saying Waterfox saves this information or keeps a history of the images I request. Waterfox says they don't keep search logs/history, and I haven't found evidence otherwise.
What I don't understand is why my authenticated session needs to be sent to the image proxy at all.
If the proxy doesn't need to know who I am, why not give it some random temporary identifier like:
TempID: 809SDF8923i58
Then it just knows "TempID 809SDF8923i58 wants cat.jpg", sends the image back, and that temporary ID doesn't need to mean anything outside that interaction.
That seems like a better privacy design than sending my authenticated session and relying on a promise that the relationship isn't stored.
Also found what seems to be a separate image-proxy bug:
Me → original image website = works
Me → Waterfox proxy → same original image = sometimes HTTP 502
So for some valid original images, Waterfox's proxy returns a 502 instead of the image. I can't tell from my side whether that's the original host rejecting the proxy, a timeout, or something else going wrong in Waterfox's proxy/backend, but the original image itself works when accessed directly.