Stop Firefox leaking data about you
github.com
github.com
Also, Safe Browsing, DRM, Search suggestions, Telemetry and Health report can be disabled in the preferences UI. Don't need sensationalist about:config protips for that.
Firefox Hello and Pocket are not attempts to "sell user data". In the case of the latter, Mozilla isn't even getting paid by Pocket, as they have said numerous times.
But yes, Mozilla is dependent on money, like all corporations. If you want to ensure that their funding sources are never in conflict with what users want, there's a very easy solution to that: https://sendto.mozilla.org/page/contribute/givenow-seq
(If every Firefox user gave $2, they wouldn't need their partnerships with Yahoo/Google for search integration, which has been their primary funding source for years).
Their main revenue comes from setting the default search engine. It's a bit of stretch to say that is selling user data.
You have to use some search engine. Whatever search engine you choose is going to get that incredibly personal information.
Mozilla sold the default choice position to Yahoo. Any user who considers Yahoo to be more nefarious than some other choice can switch with about 10 seconds of effort.
You know what would be nonsensical? If Yahoo didn't collect data about you.
If Mozilla did not need to sell our data it could ask which provider we want to use or integrate technology like YaCy.
Users use search engines. In fact it's pretty much a required feature to display a search bar proudly in the UI of a browser.
Users therefore give their search data to search engines. You can quibble about which corps are good corps and which corps are bad corps, but users cannot use search engines without giving search engines their search queries. Obviously.
Mozilla does no concomitant damage to users' privacy by allowing them to use their browser to use search engines. Mozilla, therefore, is not complicit in any wrongdoing which you ascribe to them.
If Mozilla made a deal with a manifestly worse option than the popular ones, measured either by results quality or by user abuse, the yes -- Mozilla would be reprehensible.
DDG is better, but it's not what users want.
> You know what would be nonsensical? If Yahoo didn't collect data about you.
Sure. Cool. That'd be neat.
> If Mozilla did not need to sell our data ...
Repeating that doesn't make it true. Mozilla does not sell your data. They sell placement of choice. We can agree that most users won't change the default choice, but we must also agree that almost no users will choose !google !yahoo !bing !ddg. In that order.
> ... it could ask which provider we want to use or integrate technology like YaCy.
The choice exists and is highly accessible. Are you suggesting a first-run dialog to ask the user to pick a search engine, a la Internet Explorer post-DOJ judgement? That's usability insanity.
YaCy doesn't even exist in Mozilla's user population's awareness. What's better? A good browser option or a dead browser?
In the case of Hello, the goal is to provide a fully FOSS video chat client built entirely on top of HTML5 APIs. That's huge! Skype, Hangouts, Facetime, etc. are all proprietary. Firefox Hello doesn't even require anyone to sign up for an account!
With Firefox Hello, I could paste a link in this comment that any reader with a WebRTC-enabled browser could click on and start a video chat with me. They don't even need to be using Firefox - they could be using Chrome on the laptop, or even Firefox for Android[0].
People keep bringing up the Telefonica branding, but that's kind of a red herring. Basically, since not all devices have globally addressable IP addresses (yet), they can't have it be fully P2P (yet), and they need some server that can facilitate the initial connection. Telefonica sponsors these servers, so they get their name listed alongside Hello.
What would "stripping out" Firefox Hello provide? It's built entirely on top of HTML5 APIs (which is why it works in all browsers with WebRTC support), so it doesn't actually increase the browser surface area at all.
[0] Yes, I can use my phone's FOSS web browser to place a video chat using a FOSS web client. If that doesn't sound amazing, I don't know what is!
Then it doesn't need to be a irremovable part of the binaries, right?
"What would "stripping out" Firefox Hello provide? It's built entirely on top of HTML5 APIs (which is why it works in all browsers with WebRTC support), so it doesn't actually increase the browser surface area at all."
The question to ask is not "why should we remove it" but "why should we include it". And if it is just "built entirely on top of HTML5 APIs" then why should it need its privileged position above that of an addon?
(Though, for file downloads, some meta information seems to be sent if I'm reading correctly.)
So Google could indeed easily track URLs by adding it on the periodic check and then returning false on the specific check.
As ploxiln notes, if a hit is found with a matching prefix to the (canonicalized) URL, a request is made for all hashes of URLs beginning with that hashed prefix. The hash of the current URL can then be checked against that list locally.
However.
Generally there are only one or two URLs that start with the hash prefix that is explicitly sent to Google. Which means in practice it may as well be leaking the actual URL to Google.
Especially as there are multiple hashes per URL (5 worst-case?).
If Google wants to track a URL, they can do so.
You really don't expect much from your browser at this point any more, do you?
I want a browser that connects only to the website I asked it to display and let me configure how any (ANY) third party connection will be handled.
I shouldn't have to use lynx for that.
There is a bug opened (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=748897), but as far as I know, no simple solution exists yet. You can change the user agent with an extension to keep it identical with the most popular Firefox version, but then you have to manually keep it up-to-date.
EDIT: seems that this extension need to be updated, sorry...
But I don't know, if you allow javascript maybe you will leak your real user agent?
I like to switch between iceweasel and seamonkey, and I'm "proud" of my different and unique user agent :) Speaking of privacy, actually I'm more concerned about referer, third-party sites, content delivery networks and so on.
The user-agent provided to JavaScript is the same one sent via HTTP.
http://kb.mozillazine.org/Browser.safebrowsing.enabled Firefox 2.0 incorporates the Google Safe Browsing extension in its own Phishing Protection feature to detect and warn users of phishy web sites.
EDIT: wow, downvotes? Getting a list from EasyList is just as much a leak as getting a list from Google. Someone has your IP either way.
(Edit: Oh, it seems it was updated in the meantime.)
The problem with SafeBrowsing isn't downloading the list, it's that it sends data back to Google if it finds a match. Malware lists with AdBlock plugins don't do this.
1: An all-in-one lump download of blacklists
2: Optionally, "Enhanced" also sends hashed URLs to Google in case specific sub-pages aren't on the list, etc
Citations:
http://www.google.com/tools/firefox/safebrowsing/faq.html
https://developers.google.com/safe-browsing/firefox3_privacy...
upd: I am searching for it in the Firefox sources now. Just for curiosity: there are 117512 files in 8610 directories totaling 743 MB, and search in files is really slow even on SSD.
> time egrep -Rni remotelookup .
./toolkit/devtools/gcli/source/lib/gcli/types/selection.js:81: spec.remoteLookup = (typeof this.lookup === 'function');
./toolkit/devtools/gcli/source/lib/gcli/types/selection.js:128: if (this.remoteLookup) {
egrep -Rni remotelookup . 2.01s user 0.32s system 99% cpu 2.346 totalMozilla's new "social" features don't have a turn-off option in the Preferences. You can disable them by going to "about:config", creating the tag "social.enabled" (it doesn't even exist by default) and it to False. Mozilla provides no easy way to do that. This add-on takes care of those convenient little omissions.
Obviously, Mozilla is doing all this to tie users to their mothership and make it harder for them to leave. It's not like users were crying out for "Pocket" integration in the browser.
[1] http://www.winbeta.org/news/surface-2-no-longer-has-rt-brand...
"media.peerconnection.enabled = false" WebRTC leaks IP when you use TOR/VPN, test it with ipleak.net
"beacon.enabled = false" Blocks https://w3c.github.io/beacon/ analytics.
Also recommend using plugins; uBlock, NoScript if you use VPN.
Firefox doesn't necessarily know that you're using a VPN, so it's not really contradicting "plain intention". The problem is the way that WebRTC works; it has to have access to this information in order to function.
The real issue is that there should be a prompt guarding this information, the way there is when a website requests your location. Hopefully this can be fixed.
Also, for what it's worth, Firefox lets you disable this, but I don't think Chrome/Chromium let you disable it at all: https://productforums.google.com/forum/#!topic/chrome/gJ8HF-...
and a setting buried in a pile of configuration is the same as it not existing for 99.99% of users
Tor Browser disables this by default and if you're using Tor over standard Firefox you already have far bigger problems.
Do you also disable <img>? Beacon is a performance optimization but it doesn't offer anything more than site owners could already see.
It is important to remember that malicious websites and malware in general may negatively impact your security and privacy in extremely harmful ways (malware compromises PII, website credentials, financial information, uses webcam and microphone to photograph/film/record you from blackmail/revenge porn purposes, ...)
For context, please see these relevant Mozilla bugs about SafeBrowsing privacy concerns: [0], [1]. tl;dr Firefox must set a cookie for SafeBrowsing, but it uses a separate cookie jar for SafeBrowsing so Google cannot tie the Safebrowsing activity to anything else you do related to Google or their services (which is the biggest concern here). They can learn a limited profile of your browsing activity, along the lines of "Random user x often uses their browser between 9am and 5pm on M-F".
The Safebrowsing implementation is specifically designed to be privacy-preserving. [2] It uses a Bloom filter to implement fast lookups in a minimally sized hash table of known malicious URL's. The only time a full URL (actually various hashes of multiple prefixes of the full URL, including the full URL) that you browse it sent to Google is when a prefix of it collides with a known malicious URL, in which case the URL must be sent to Google to resolve the question of whether the URL you are trying to visit is actually malicious or just a false positive from the Bloom Filter. Yes, the hashes are unsalted so it would be possible for Google to check if you were trying visit some pre-determined URL ("were they trying to visit www.thoughtcrime.org?") but only if it collided with a known malicious URL.
It would be helpful to know what the average rates of collisions and false positives are to get a sense of how much of an average user's browsing history is leaked to Google through Safe Browsing - can anybody from Google comment?
[0]: https://bugzilla.mozilla.org/show_bug.cgi?id=368255 [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=897516 [2]: https://code.google.com/p/google-safe-browsing/wiki/SafeBrow...
I would never disable it for my mom, or any non technical friends. But I would hope the majority of HN users are pretty good at spotting, and steering clear of malicious websites.
yeah, about that:
http://arstechnica.com/security/2013/02/web-forum-for-iphone...
http://arstechnica.com/security/2015/02/pwned-in-7-seconds-h...
etc etc
Additionally, some sites may potentially contain exploits that run as soon as you visit the site (vulnerabilities in plugins like Java or Flash, drive-by downloads, etc.) in which case it doesn't matter if you correctly identify the website as malicious and hit the "Back" button - it's already too late. Much better to avoid loading the content at all, which is exactly what is achieved with SafeBrowsing.
SELECT users.id AS google_user_id
sb_hits.ip_addr AS safebrowsing_update_ip_addr
sb_hits.request_time AS safebrowsing_update_time
FROM all_page_hits AS user_hits,
all_page_hits AS sb_hits,
normal_google_accounts AS users,
safebrowsing_pseudo_accounts AS sb_users
WHERE users.cookie = user_hits.cookie
AND sb_users.cookie = sb_hits.cookie
AND user_hits.ip_addr = sb_hits.ip_addr
AND (sb_hits.request_time BETWEEN (user_hits.request_time - interval '1 hour')
AND (user_hits.request_time + interval '1 hour'))
The IP betrays information as well, but that's not a reason to make it even easier with a cookie.
"Random user x often uses their browser between 9am and 5pm on M-F"
That's exactly the important information that should be protected, to resist pattern-of-life analysis.
(apologies for any SQL errors; it's been a while since I did any serious db work)
If pattern-of-life analysis is a concern of yours, you should be using the Tor Browser and taking a whole host of other precautions. Fiddling with a bunch of prefs in about:config and using an ad blocker isn't going to cut it.
And again, it's not a zero-sum game. Safe Browsing provides some meaningful benefit of terms of protecting users from malicious websites, which on balance is probably worth the compromise to their privacy (which is comparatively minor and was minimized through careful and intentional engineering).
I agree that it's worthwhile to try to stop the trend towards increasing surveillance of Internet users using whatever techniques are available, but it's really at the core of the Internet's business model and some fundamental changes are necessary.
Isn't reader an offline functionality?
You're leaking when your computer is on/active, with fine granularity. Pulling out reasonable estimation of your daily schedule from that data is easy.
So it leaks a heartbeat, and any hits against the blacklist.
If you have WebRTC enabled, any website can determine both your local IP address (e.g. 192.168.1.1) and your globally-addressable IP address. The combination of these is essentially unique, and can even be better than cookie tracking or browser fingerprinting.
It's possible to disable WebRTC in Firefox, but AFAIK not in Chrome/Chromium[0].
As for Firefox Hello and Pocket integration, you can turn these off if you want, but I'm 99% certain that they don't actually send any data about you unless you actually use them.
[0] https://productforums.google.com/forum/#!topic/chrome/gJ8HF-...
[0] https://support.mozilla.org/en-US/kb/tracking-protection-fir...
- Reader mode is confirmed not leaking data. No need to disable it.
- There is a way to stop leaking the browser history to Google while keeping Safe Browsing.
* both tested using Fiddler
https://history.google.com/history/ and https://plus.google.com/settings/endorsements etc.?
- Disables the malware and phishing lists/warnings.
- Disables HTML5-video DRM (even if this has nothing to do with leaking data).
- Geo location already brings up a popup (and thus disabling it seems petty).
Disabling HTML5 video DRM could be annoying and geolocation is solved by the popup, as you say.
I would rather live in a browser without video support, than with DRM
127.0.0.1 www.hosted-pixel.com
The political candidates are the worst.