"Forget About This Site" also removes saved password? Topic is solved

[back2themoon]

Just confirmed this on both my main profile and clean Pale Moon portable.

Log in to the Pale Forum, saving the password
Press Ctrl-H, and right-click on the most recent forum.palemoon.org entry
Select "Forget About This Site"
The saved password is gone

Is this intended? Seems new behaviour to me. Wasn't this option about cache, cookies etc. alone? Wiping the password looks like an issue. Or am I missing something?

33.9.0.1 (sse2), no master password (didn't test with one).

[Moonchild]

Did you want to actually forget about the site or not? If the answer is "yes, but..." then this function isn't what you want. It will make it so the state is as if you've never visited before. It will remove everything related to that site. This behaviour hasn't changed recently.

From Mozilla's support documentation about the analogue function in Firefox (so I don't have to type it myself):

Using "Forget About This Site" will remove all data stored in Firefox from that domain like bookmarks, cookies, passwords, cache, history, and exceptions, so be cautious and if you have a password or other data from that domain that you do not want to lose then make sure to backup this data or make a note.

You can't recover from this 'forget' unless you have a backup of the involved files.

It doesn't have any lasting effect, so if you revisit such a 'forgotten' website then data from that website will be saved once again.

[back2themoon]

It's not a problem for me personally, but I always thought that function was the equivalent of Clear Recent History/Everything/All for single websites. The Ctrl-Shift-Del prompt cannot delete passwords, right? I tried it, and it doesn't delete passwords.

About Firefox, I haven't actually tested it but those docs are contradictory (even for v.143), because:

If you pick "Forget About This Site..." on Firefox, you will get a warning prompt first: (this is a newer addition - the confirmation prompt I mean)

Clear data (Firefox warning).png

To be honest, it seems correct not to touch passwords. They are not really part of the traditional "browser history" - same with Bookmarks.

[Moonchild]

It's not "clear browsing history" it's "forget about the site". If you want to clear browsing history then yes, you'd use that function. I really don't want to change that and conflate the two things. "Forget about this site", as said, makes it so the browser forgets everything about it. That's unambiguous and doesn't require further explanation.

Firefox obviously changed what it does more recently, muddying the waters (and requiring that dialog to explain that it's "forget, except..."). I guess I should have typed the explanation myself anyway to not confuse you.

[back2themoon]

I just tried PM 32.5.2 and indeed, it still deletes the password. So, I was wrong about this being a recent change.

...Forget about this site", as said, makes it so the browser forgets everything about it. That's unambiguous and doesn't require further explanation.

This "hammer-logic" should include Bookmarks too then! Also: the Forget About This Site function is only available within the History sections, so they are clearly related.

In any case, I won't insist. Just had to post because it seemed important and I thought it was a recent bug.

[Moonchild]

This "hammer-logic" should include Bookmarks too then!

IMHO not the case, because bookmarks are separate records (notes) of sites. You don't even have to have visited a site to have a bookmark for it (e.g. create a bookmark from a link on a different site).
But I guess then you'll argue that you could write down a password for a site manually too... The thing is, in normal operation a "saved password" is stored after interaction with the site, i.e. after you have visited and put in the credentials into the site. Same goes for history, cache, dom storage, cookies, etc. but a bookmark is independent of whether you visited.

I can make it optional to clear passwords if enough people would want that feature, of course. I can see a use case for it. But it really does depart from "forgetting about a site entirely" which is the common meaning of that function.

[back2themoon]

If anything, it is about extra flexibility. "Forget About This Site" I think is an important troubleshooting tool for specific website issues. If you are going to wipe passwords too, you are taking it to another level.

I cannot speak on behalf of them, but I'd assume users heavily relying on the internal Password Manager would not want another browser function (seemingly unrelated to the Password Manager) messing with their passwords. They'd only deal with them using the Password Manager. At least I would, anyway. So yes, thanks for at least considering it.

[jobbautista9]

I think at the very least there should be a confirmation dialog before forgetting a whole website. Also, when I inputted credentials in this forum, made the browser remember it, then used the "forget about this site" feature, it did erase the saved password, but the form history or autofill for the username still remained. I think that might be a bug.

[Michaell]

I support leaving it as is.

[Moonchild]

I think at the very least there should be a confirmation dialog before forgetting a whole website. Also, when I inputted credentials in this forum, made the browser remember it, then used the "forget about this site" feature, it did erase the saved password, but the form history or autofill for the username still remained. I think that might be a bug.

No that isn't a bug, because form history by design is not bound to websites. The whole point of form history is so that you enter specific data once and can then use it across multiple sites.

[tellu-white]

To be honest, it seems correct not to touch passwords. They are not really part of the traditional "browser history" - same with Bookmarks.

I've made an add-on that works just like the "Forget About This Site" button on the "about:permissions" page, but without deleting the passwords saved in Pale Moon. In this add-on, I've added the file "ForgetAboutSite.jsm":

Pale Moon\Source Code\uxp\toolkit\forgetaboutsite\ForgetAboutSite.jsm

with the modified name: "forget_about_site.js"

In this file, I commented out the block of code that deleted the passwords saved by Pale Moon.

Through testing, I noticed that the "Forget About This Site" button on the "about:permissions" page does not delete the bookmarks associated with the selected domain, so I did not have to change anything (in the code) related to bookmarks.

***

Help:

Clicking on the add-on button opens the "about:permissions" page in a new tab, if it is not already open. If it is already open, it becomes the active page.

At this point, no entry from the list of URLs is selected.

To perform "Forget About Selected Site - Except Password," first select the desired site (from the list) and then click the add-on button again. In the screenshots below, you can see that after clicking the add-on button, there are no more Cookies for the selected site.

I haven't tested the rest of the removed elements (Cache, Image Cache, Plugin data, Downloads, etc. - see the "forget_about_site.js" file), but it's likely that all of these elements have been removed, as well as Cookies, which are in the same function as them (in the "forget_about_site.js" file):

Code: Select all

removeDataFromDomain: Task.async(function* (aDomain){ ... })

Screenshots:

01.png

02.png

03.png

04.png

05.png

06.png

07.png

08.png

09.png

***

If you are interested in this approach, you can download the add-on Forget About Selected Site - Except Password 1.0 here:

https://www.mediafire.com/file/4iuy2qtjrrci43y/forget_about_selected_site_except_password_1_0.zip/file

[back2themoon]

I've made an add-on that works just like the "Forget About This Site" button on the "about:permissions" page, but without deleting the passwords saved in Pale Moon.

Many thanks again, tellu-white. Your extension does the job. I've installed it and I'm keeping it. Allow me two suggestions:

1. The second confirmation prompt ("Domain x is Forgotten.") is a bit overkill, since several clicks are required already. I'd remove it altogether. The action's effect is directly visible in the Permissions Manager anyway.

2. If you ask me, I'd also remove the first prompt ("Are you sure you want...?"). Your method does not remove passwords anyway, the user who will use your extension for this should know what they are doing, and even in case of accidental press (unlikely) there's no real harm done. It'd be great if you could make this prompt optional, especially if none of this makes it into Pale Moon.

I still hope this makes it into Pale Moon. I said I won't insist (and I am not) but few final thoughts:

It's a bit contradictory that Clear All History/Everything does not touch passwords, while Forget About This (One) Site does. While I love semantics, it doesn't sound like "Forget" is any "stronger" than Clear. Yes, it's "Clear All History" but:

a) "Forget About This Site" does seem like a subset of History, not some red-button, separate, kill-all feature - at least it is positioned that way, as mentioned earlier.
b) It does pretty much exactly what Clear All History/Everything does (unless I'm missing something) + wipe passwords on top. In true Men In Black Neuralyzer style.

[Moonchild]

While I love semantics, it doesn't sound like "Forget" is any "stronger" than Clear.

It absolutely is, though. "Clearing history" just does that: it clears normal traces of browsing activity. "Forgetting about a site" means (or should mean) that you are wiping everything related to the site from memory (= everything stored, in computer terms). Think of it as removing notes from a notebook about a subject compared to forgetting you took a subject class entirely.

I still hope this makes it into Pale Moon.

Like I said if enough people are interested in this distinction to keep passwords, then I could make it an option, but my PoV remains that if someone wants that the browser completely forgets about (any and all actions performed on) a site then every trace should be removed, including credentials that were stored after interaction with site content. I'm approaching this from a privacy standpoint, primarily. Stored credentials means you have been on and interacted with the site (as stated before, a bookmark would not). This means there won't be a clean slate for that site and anyone can easily see you've been there before (and therefore it was not "forgotten"). Even the website itself could determine this if you choose to autofill.

[back2themoon]

I'm approaching this from a privacy standpoint, primarily.

It is an interesting standpoint, even if I remain sceptical. The Master Password does protect from password deletion via FATS, which is very positive. I'm guessing though the MP wasn't really meant for this i.e. to block indirect deletion of passwords from a browser's own feature. Thus, those hopefully few poor souls without a Master Password and a backup will get the harsh FATS treatment.

You could attempt a middle-ground, if easy to implement of course: add an (optional?) "Password will be deleted" warning if there is a stored password for the selected Site.

Or do it like FF and throw an annoying prompt (optional?) on every FATS attempt, explaining that passwords are going, too. This still does away with the fine ability to use FATS as a quick, website-troubleshooting method (clear all cookies/cache etc.) while still keeping passwords for them.

I'd love to hear from more users, although I assume many use a separate password manager so it's a non-issue.

[vannilla]

How about "Memory-hole site"?

[andyprough]

I'd love to hear from more users, although I assume many use a separate password manager so it's a non-issue.

I use a different password manager, but I also use the Pale Moon password manager for sites that I go to frequently. I clear all history, cookies, cache, logins, site data each time I close the browser instead of using the "Forget about this site" option. And I have a backup of every password in my external password manager. So this wouldn't really impact me.

However, it does seem wise to me to treat the built-in password manager as a bit more sacred. Might be better to keep it from being touched by routine housecleaning actions. Losing a password can be a pretty annoying setback.

[Gemmaugr]

I agree with Moonchild.

I don't use a password manager anything/anywhere, so deleting a password wouldn't mean anything to me. That said, I do allow PM to Remember me.

It's like three stages of being. Remember everything about me. Remember me but not [x] thing. Forget entirely about me. It's logical.

[tellu-white]

The second confirmation prompt ("Domain x is Forgotten.") is a bit overkill, since several clicks are required already. I'd remove it altogether. The action's effect is directly visible in the Permissions Manager anyway.

I've removed the second prompt, the one which confirms the execution of "Forget About Selected Site - Except Password" for the selected URL. In addition, I've removed some redundant code.

I didn't remove the first prompt because I wanted to avoid a possible mistake in selecting the desired site (from the list of URLs, in the "about:permissions" page).

***

Download link ( Forget About Selected Site - Except Password 1.1 ):

https://www.mediafire.com/file/kgh9s5rhlzj71qe/forget_about_selected_site_except_password_1_1.zip/file

[back2themoon]

I've removed the second prompt...

Perfect, thank you.

[tellu-white]

Perfect, thank you.

My pleasure, back2themoon. I'm glad my add-on meets your expectations.