Hacker News Reader

Comment by pbiggar | Hacker News Reader

This is what happens when folks with a radically-non-mainstream view of privacy try to use an app built for mainstream folks by folks with slightly more mainstream opinions about privacy.

View on HN

If Iceweasel is not hardline about freedom and privacy, what does it offer compared to vanilla Firefox?

Edit: Since this is getting upvotes, I was wrong and pigeons is right.

The sole purpose of Iceweasel is to not be subject to any restrictions (mozilla approval of changes) that may come with distributing trademarked "Firefox" software.

I looked into it further, and know I see where my confusion came from.

    [Debian] Iceweasel is a fork [from Firefox] with the following purpose :

    backporting of security fixes to declared Debian stable version.
    no inclusion of trademarked Mozilla artwork (because of #1 above) 

    Beyond that, they will be basically identical. (quoting Roberto C.
    Sanchez post in debian-devel mailing list)

But there was another Iceweasel, GNU Iceweasel. To avoid confusion with Debian Iceweasel, it has been renamed to GNU Icecat.

    GNU IceCat, formerly known as GNU IceWeasel,[3] is a free software
    rebranding of the Mozilla Firefox web browser distributed by the GNU
    Project. It is compatible with Linux, Windows, Android and OS X.[4]

    The GNU Project keeps IceCat in synchronization with upstream development
    of Firefox while removing all trademarked artwork. It also maintains a
    large list of free software plugins. In addition, it features a few
    security features not found in the mainline Firefox browser.

This article is about Debian's Iceweasel, which is why my comment was wrong.

https://wiki.debian.org/Iceweasel https://en.wikipedia.org/wiki/GNU_IceCat

It's not obvious to me that "I want my browser to tell Google about every site I visit" actually is the mainstream view of privacy.

"Privacy

Google maintains the Safe Browsing Lookup API, which has a privacy drawback: "The URLs to be looked up are not hashed so the server knows which URLs the API users have looked up". The Safe Browsing API v2, on the other hand, has the following privacy advantage: "API users exchange data with the server using hashed URLs so the server never knows the actual URLs queried by the clients". The Firefox and Safari browsers use the latter." https://en.wikipedia.org/wiki/Google_Safe_Browsing#Privacy

Heh. The next paragraph after that quote is:

> Safe Browsing also stores a mandatory preferences cookie on the computer[9] which the US National Security Agency allegedly uses to identify individual computers for purposes of exploitation.[10]

That may or may not be true, but must one be a radical to be concerned?

It's true, but slightly misleading.

If you open firefox and browse to a few sites, it will send that cookie. If you then take your computer down to the coffee shop and keep browsing, even if you don't log into anything, it will still send that cookie in the clear.

There are other ways that the NSA can figure out a list of IP addresses you've been using, but this is 1) totally silent, and 2) is common to a lot of systems.

Deleted comment

Firefox's safebrowsing feature uses a separate cookie jar, so if you are logged into Google those cookies will never be sent via the safebrowsing API.

Also, Firefox hashes the URL and compares the prefix of that hash to a master table downloaded from Google. If the URL matches a prefix in the table, Firefox requests all URLs that begin with that prefix hash. Google is never sent the full hashed URL.

> "API users exchange data with the server using hashed URLs so the server never knows the actual URLs queried by the clients".

Privacy Theater. No real information is lost since all you need to do is have a database of domains and boom, hash easily reversed.

Please tell me you didn't just edit that wikipedia article and cite your own comment.

Not only is that not a valid wikipedia cite, it's not even right. Only hash prefixes are ever sent to Google, and only if it's already tested locally that the hash prefix includes malicious sites.

Humorously this exact same exchange took place in the linked conversation: https://lists.debian.org/debian-devel/2015/07/msg00232.html

edit: wow, it was you. https://en.wikipedia.org/w/index.php?title=Google_Safe_Brows...

> wow, it was you.

Yes, I did that for two reasons:

- I couldn't find a better link for the citation and it seemed like rather important info that should be in the wiki. Maybe someone else would find a better one to replace it with.

- I figured linking to an HN discussion would serve as a great citation, even if I was mistaken about something. Looks like HN didn't disappoint. :)

EDIT: I've updated the wiki text to remove my previous edits and added a mention about the use of hash prefixes.

> Not only is that not a valid wikipedia cite, it's not even right. Only hash prefixes are ever sent to Google, and only if it's already tested locally that the hash prefix includes malicious sites. Humorously this exact same exchange took place in the linked conversation: https://lists.debian.org/debian-devel/2015/07/msg00232.html

Thanks for the link and pointing that out, I stand corrected. I'm curious to know how big the prefix is. Depending on its size this either remains privacy theater or not.

> I'm curious to know how big the prefix is

I haven't looked at it in depth for a little while, but according to this it's the first 32 bits of the 256 bit hash:

https://developers.google.com/safe-browsing/developers_guide...

You're making a substantially different claim than the article. Where did you get the idea that it's sending every URL to google?

The follow up email.

Is false. Google is big, but even they couldn't handle the load of a large fraction of the world's web browsers sending them a request for every page loaded. That'd be insane.

Google Safe Browsing is based on a Bloom filter. The browser downloads the filter in a series of requests when it first starts up, or when the filter is out of date. It also sends a followup request if it finds a hit, but this is rare unless you're actually about to visit a site that's been flagged as unsafe.

Maybe? They essentially do this with Google Analytics? No?

Not to mention Google Chrome's search suggestions?

> It also sends a followup request if it finds a hit, but this is rare unless you're actually about to visit a site that's been flagged as unsafe

And the followup still doesn't send the URL or even a hash of the URL. It sends just a prefix of the hash to download all URL hashes matching that prefix to do the comparison to the actual current URL locally.

Apparently I need to clarify.

I doubt most mainstream users are even aware of safe browsing or how it works. They could very well be ok with it, but that is not obvious to me.

Nor would I say that a desire to disable safe browsing represents a particularly "radical" view.

Define "I". A GET request for a favicon sans cookies doesn't say much about "I", and doesn't leak anything useful.

I thought it was just downloading favicons? Is the POST request suppose to be sending stuff?

The POSTs aren't sending anything important. The POST to google is documented here: https://developers.google.com/safe-browsing/developers_guide...

Quote:

  The request body is used to specify what the client has and wants:

  * The client optionally specifies the maximum size of the download it wants to retrieve.
  * The client specifies which lists it wants to retrieve.
  * For each list, the client specifies the chunk numbers it already has.

Reply on news.ycombinator.com