21–30 of 97 posts
Don't forget about this; "media.peerconnection.enabled = false" WebRTC leaks IP when you use TOR/VPN, test it with ipleak.net "beacon.enabled = false" Blocks https://w3c.github.io/beacon/ analytics. Also recommend using plugins; uBlock, NoScript if you use VPN.
If you have WebRTC enabled, any website can determine both your local IP address (e.g. 192.168.1.1) and your globally-addressable IP address. The combination of these is essentially unique, and can even be better than cookie tracking or browser fingerprinting.
It's possible to disable WebRTC in Firefox, but AFAIK not in Chrome/Chromium[0].
As for Firefox Hello and Pocket integration, you can turn these off if you want, but I'm 99% certain that they don't actually send any data about you unless you actually use them.
[0] https://productforums.google.com/forum/#!topic/chrome/gJ8HF-...
Earlier quoted context omitted.
I wouldn't use it since it: - Disables the malware and phishing lists/warnings. - Disables HTML5-video DRM (even if this has nothing to do with leaking data). - Geo location already brings up a popup (and thus disabling it seems petty).
>* - Disables HTML5-video DRM (even if this has nothing to do with leaking data).* I would rather live in a browser without video support, than with DRM
Don't forget about this; "media.peerconnection.enabled = false" WebRTC leaks IP when you use TOR/VPN, test it with ipleak.net "beacon.enabled = false" Blocks https://w3c.github.io/beacon/ analytics. Also recommend using plugins; uBlock, NoScript if you use VPN.
That is really disappointing. Particularly for firefox with their supposed focus on privacy, to enable a service that leaks ip when I run a vpn, contradicting the plain intention of the user, shocks me.
Firefox doesn't necessarily know that you're using a VPN, so it's not really contradicting "plain intention". The problem is the way that WebRTC works; it has to have access to this information in order to function.
The real issue is that there should be a prompt guarding this information, the way there is when a website requests your location. Hopefully this can be fixed.
Also, for what it's worth, Firefox lets you disable this, but I don't think Chrome/Chromium let you disable it at all: https://productforums.google.com/forum/#!topic/chrome/gJ8HF-...
Also, Safe Browsing, DRM, Search suggestions, Telemetry and Health report can be disabled in the preferences UI. Don't need sensationalist about:config protips for that.
Seems like a bad idea turning off phishing notifications and browser warnings http://kb.mozillazine.org/Browser.safebrowsing.enabled Firefox 2.0 incorporates the Google Safe Browsing extension in its own Phishing Protection feature to detect and warn users of phishy web sites.
It does send your IP address to Google, when you download the filter. And I can't tell if "Enhanced Protection" is enabled which actually sends your URLs to Google.
It is important to remember that malicious websites and malware in general may negatively impact your security and privacy in extremely harmful ways (malware compromises PII, website credentials, financial information, uses webcam and microphone to photograph/film/record you from blackmail/revenge porn purposes, ...)
For context, please see these relevant Mozilla bugs about SafeBrowsing privacy concerns: [0], [1]. tl;dr Firefox must set a cookie for SafeBrowsing, but it uses a separate cookie jar for SafeBrowsing so Google cannot tie the Safebrowsing activity to anything else you do related to Google or their services (which is the biggest concern here). They can learn a limited profile of your browsing activity, along the lines of "Random user x often uses their browser between 9am and 5pm on M-F".
The Safebrowsing implementation is specifically designed to be privacy-preserving. [2] It uses a Bloom filter to implement fast lookups in a minimally sized hash table of known malicious URL's. The only time a full URL (actually various hashes of multiple prefixes of the full URL, including the full URL) that you browse it sent to Google is when a prefix of it collides with a known malicious URL, in which case the URL must be sent to Google to resolve the question of whether the URL you are trying to visit is actually malicious or just a false positive from the Bloom Filter. Yes, the hashes are unsalted so it would be possible for Google to check if you were trying visit some pre-determined URL ("were they trying to visit www.thoughtcrime.org?") but only if it collided with a known malicious URL.
It would be helpful to know what the average rates of collisions and false positives are to get a sense of how much of an average user's browsing history is leaked to Google through Safe Browsing - can anybody from Google comment?
[0]: https://bugzilla.mozilla.org/show_bug.cgi?id=368255 [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=897516 [2]: https://code.google.com/p/google-safe-browsing/wiki/SafeBrow...
Earlier quoted context omitted.
I think using a blocker extension like uBlock Origin restores (at least partially) this functionality without involving Google.
Right, but then you're just changing who you leak data to, you're not stopping the leak. EDIT: wow, downvotes? Getting a list from EasyList is just as much a leak as getting a list from Google. Someone has your IP either way.
(Edit: Oh, it seems it was updated in the meantime.)
While visiting google every 30 minutes or so is a way of leaking, you aren't leaking much more than ip and the fact that this up is in Firefox. Isn't reader an offline functionality?
You're leaking when your computer is on/active, with fine granularity. Pulling out reasonable estimation of your daily schedule from that data is easy.
Seems like lots of FUD; how do Firefox Hello, Pocket and Geolocation "leak data about you" if you don't explicitly use them? How do DRM and Reader mode leak data at all? Also, Safe Browsing, DRM, Search suggestions, Telemetry and Health report can be disabled in the preferences UI. Don't need sensationalist about:config protips for that.