Modar HIJAZI

Private Browsing mode should prevent most Web browsers from saving loaded content in any way. Any such information such as that in your browser’s cache, its history, or cookie information should be stored temporarily for the current session, and then discarded when you close your browser window. However, in Safari your pages might be logged by a small but overlooked aspect of how Safari handles Web pages.

As described by MacIssues reader Tyler C.:

“I was troubleshooting some issues with Safari and opened up ~/Library/Safari/WebpageIcons.db, and in that file, I was surprised to find all the URLs of sites (stored in plain text) that I and others using my Mac visited in “private windows” in Safari. The URLs seem to stay in there basically forever unless you clear out all your browsing data (which defeats the entire purpose of using a “private window”).”

This Webpageicon database is the location in which Safari stores the small associated “favicon” image for the visited address (such as the small crossed tools for MacIssues, or the Apple icon for Apple’s sites). This image can be loaded from the Web server each time you access it, but as with many fairly static features of Web pages, Safari will cache this in a small database so it can be used in features like your browser history and bookmarks, among others.Unfortunately, it appears that even when in Private Browsing mode, Safari will store this favicon information. While this is normal behavior and is not at all a security risk, it may be considered a privacy issue as pages you might not want a trace of on your system will be logged to this database, which is a simply SQLite database commonly used in OS X, and which can be opened with a number of SQLite readers (including the built-in “sqlite3″ Terminal utility). Since the database is not encrypted, if your Mac is not using FileVault, then someone can technically access the file and even open it in a text editor to see the visited URLs.

Of course Private Browsing features are

sometimes associated with underground and illicit activities, but in addition, can be used to help protect one from prying eyes. For instance, when on a break at a workplace, one might wish to visit a personal or social media site, or a messaging service like Gmail, and not be at risk of storing information from this site on the local system. Private Browsing features ought to allow for that; however, with this bug, an employer can see exactly what sites were visited.

Safari does not contain any settings for managing how this database is handled, so for now, if you are concerned about this as a privacy issue, then you have the following choices:

1. Use another browser

While other browsers may have their problems as well, this specific issue so far does not occur in Firefox or Chrome, so you can download and use one of those browsers in Private Mode and avoid Safari.

2. Use a private and encrypted system

If you are worried about the retrieval of such files, then use a personal system for your browsing needs and avoid shared or public ones. Also ensure this system uses FileVault to encrypt all drive contents and make retrieval impossible without your Mac’s administrative password.

3. Manually delete the icon database

After using Safari, you can manually remove the Webpageicon.db file that holds all of this information:

1. Open the Go menu in the Finder, and hold the Option key to reveal the Library
2. In the Library, go to the Safari folder
3. Delete the file called “Webpageicon.db”

An alternative to this is to use the following Terminal command to delete the file (copy and paste this entire line into the Terminal utility, and then press Enter):

rm -f ~/Library/Safari/WebpageIcons.db

Unfortunately this will be required each time you wish to hide visited pages in Safari, so it may not be a practical solution. Additionally, it is a somewhat crude approach that will remove all of your stored Web page icons and not just those for the current private session. These will load again when you next visit your Web sites, but until then, lists such as history and bookmarks will have generic blue sphere icons to represent them.