Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Firefox leaking data about you

github.com

Post reply on HN
Print view View original

61–70 of 97 posts

Re: Stop Firefox leaking data about you

#61

Post by scott_karana »

glass- wrote: post #44
scott_karana wrote: post #19

Earlier quoted context omitted.

Right, but then you're just changing who you leak data to, you're not stopping the leak. EDIT: wow, downvotes? Getting a list from EasyList is just as much a leak as getting a list from Google. Someone has your IP either way.

> Getting a list from EasyList is just as much a leak as getting a list from Google. Someone has your IP either way. The problem with SafeBrowsing isn't downloading the list, it's that it sends data back to Google if it finds a match. Malware lists with AdBlock plugins don't do this.

My understanding was that Google's malware list is a two prong approach:

  1: An all-in-one lump download of blacklists
  2: Optionally, "Enhanced" also sends hashed URLs to Google in case specific sub-pages aren't on the list, etc
Easylist, of course, only offers #1. Firefox, by default, uses both, which is less private, but seemingly still configurable to use only #1.

Citations:

http://www.google.com/tools/firefox/safebrowsing/faq.html

https://developers.google.com/safe-browsing/firefox3_privacy...

http://www.pclinuxos.com/forum/index.php?topic=124878.0

Re: Stop Firefox leaking data about you

#62

Post by JoshTriplett »

RolloTom wrote: post #40
avian wrote: post #20

Another thing worth noting is that if you are using Debian-rebranded Firefox (Iceweasel), you have a very unique user agent that is easy to track. There is a bug opened ( https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=748897 ), but as far as I know, no simple solution exists yet. You can change the user agent with an extension to keep it identical with the most popular Firefox version, but then you have to manuall…

If you don't want edit manually user agent, oscpu and platform in "about:config" then blender can do it for you: https://addons.mozilla.org/it/firefox/addon/blender-1/ EDIT: seems that this extension need to be updated, sorry... But I don't know, if you allow javascript maybe you will leak your real user agent? I like to switch between iceweasel and seamonkey, and I'm "proud" of my different and unique user agent :)…

> But I don't know, if you allow javascript maybe you will leak your real user agent?

The user-agent provided to JavaScript is the same one sent via HTTP.

Re: Stop Firefox leaking data about you

#63

Post by chimeracoder »

RexRollman wrote: post #37
dao- wrote: post #25

Seems like lots of FUD; how do Firefox Hello, Pocket and Geolocation "leak data about you" if you don't explicitly use them? How do DRM and Reader mode leak data at all? Also, Safe Browsing, DRM, Search suggestions, Telemetry and Health report can be disabled in the preferences UI. Don't need sensationalist about:config protips for that.

I would prefer it if they stripped out Hello and Pocket. They don't need to be there and their inclusion makes me wonder whay Mozilla's Firefox goals really are.

> I would prefer it if they stripped out Hello and Pocket. They don't need to be there and their inclusion makes me wonder whay Mozilla's Firefox goals really are.

In the case of Hello, the goal is to provide a fully FOSS video chat client built entirely on top of HTML5 APIs. That's huge! Skype, Hangouts, Facetime, etc. are all proprietary. Firefox Hello doesn't even require anyone to sign up for an account!

With Firefox Hello, I could paste a link in this comment that any reader with a WebRTC-enabled browser could click on and start a video chat with me. They don't even need to be using Firefox - they could be using Chrome on the laptop, or even Firefox for Android[0].

People keep bringing up the Telefonica branding, but that's kind of a red herring. Basically, since not all devices have globally addressable IP addresses (yet), they can't have it be fully P2P (yet), and they need some server that can facilitate the initial connection. Telefonica sponsors these servers, so they get their name listed alongside Hello.

What would "stripping out" Firefox Hello provide? It's built entirely on top of HTML5 APIs (which is why it works in all browsers with WebRTC support), so it doesn't actually increase the browser surface area at all.

[0] Yes, I can use my phone's FOSS web browser to place a video chat using a FOSS web client. If that doesn't sound amazing, I don't know what is!

Re: Stop Firefox leaking data about you

#64

Post by pseud »

zbraniecki wrote: post #2

It would be awesome to turn it into an extension that makes it a single toggle.

It could do with some updates (e.g. Pocket is missing), but most of these are set automatically (and can be toggled on/off en masse) by TinFoil:

https://addons.mozilla.org/en-US/firefox/addon/tinfoil/

https://github.com/cohjam/tinfoil

Re: Stop Firefox leaking data about you

#65

Post by chimeracoder »

madez wrote: post #59
brador wrote: post #58

Earlier quoted context omitted.

Mozilla is reliant on the money integrations bring. The search engine integration alone brings in millions.

That's the crux of this situation. Mozilla needs money. Unless they find another way to finance themselves, they will continue selling user data, directly or indirectly. This will not change however we cry out.

> Mozilla needs money. Unless they find another way to finance themselves,

Firefox Hello and Pocket are not attempts to "sell user data". In the case of the latter, Mozilla isn't even getting paid by Pocket, as they have said numerous times.

But yes, Mozilla is dependent on money, like all corporations. If you want to ensure that their funding sources are never in conflict with what users want, there's a very easy solution to that: https://sendto.mozilla.org/page/contribute/givenow-seq

(If every Firefox user gave $2, they wouldn't need their partnerships with Yahoo/Google for search integration, which has been their primary funding source for years).

Re: Stop Firefox leaking data about you

#66

Post by [deleted] »

amq wrote: post #31
detaro wrote: post #26

Earlier quoted context omitted.

http://kb.mozillazine.org/Browser.safebrowsing.remoteLookups That's configured here

I couldn't find Browser.safebrowsing.remoteLookups in my about:config. Does it still apply? upd: I am searching for it in the Firefox sources now. Just for curiosity: there are 117512 files in 8610 directories totaling 743 MB, and search in files is really slow even on SSD.

[deleted]

Re: Stop Firefox leaking data about you

#67

Post by SapphireSun »

chimeracoder wrote: post #22

Don't forget about WebRTC: https://github.com/diafygi/webrtc-ips If you have WebRTC enabled, any website can determine both your local IP address (e.g. 192.168.1.1) and your globally-addressable IP address. The combination of these is essentially unique, and can even be better than cookie tracking or browser fingerprinting. It's possible to disable WebRTC in Firefox, but AFAIK not in Chrome/Chromium[0]. As for Firefo…

You're really not going to like IPv6 are you?

Re: Stop Firefox leaking data about you

#68

Post by amq »

amq wrote: post #31
detaro wrote: post #26

Earlier quoted context omitted.

http://kb.mozillazine.org/Browser.safebrowsing.remoteLookups That's configured here

I couldn't find Browser.safebrowsing.remoteLookups in my about:config. Does it still apply? upd: I am searching for it in the Firefox sources now. Just for curiosity: there are 117512 files in 8610 directories totaling 743 MB, and search in files is really slow even on SSD.

browser.safebrowsing.remoteLookups works indeed, I could confirm this using Fiddler. For some reason, Notepad++ couldn't find a mention of 'remoteLookups' in sources.

Re: Stop Firefox leaking data about you

#69

Post by Brakenshire »

madez wrote: post #59
brador wrote: post #58

Earlier quoted context omitted.

Mozilla is reliant on the money integrations bring. The search engine integration alone brings in millions.

That's the crux of this situation. Mozilla needs money. Unless they find another way to finance themselves, they will continue selling user data, directly or indirectly. This will not change however we cry out.

> they will continue selling user data, directly or indirectly

Their main revenue comes from setting the default search engine. It's a bit of stretch to say that is selling user data.

Re: Stop Firefox leaking data about you

#70

Post by vbcr »

chimeracoder wrote: post #63
RexRollman wrote: post #37

Earlier quoted context omitted.

I would prefer it if they stripped out Hello and Pocket. They don't need to be there and their inclusion makes me wonder whay Mozilla's Firefox goals really are.

> I would prefer it if they stripped out Hello and Pocket. They don't need to be there and their inclusion makes me wonder whay Mozilla's Firefox goals really are. In the case of Hello, the goal is to provide a fully FOSS video chat client built entirely on top of HTML5 APIs. That's huge ! Skype, Hangouts, Facetime, etc. are all proprietary. Firefox Hello doesn't even require anyone to sign up for an account! With Fi…

Yes. Hello sounds amazing, but it could have been an extension along with hundreds of other amazing extensions for firefox. The point is there are extensions that I use and there are extensions that I do not use. There is no reason to stuff something down my throat however amazing they sound.
Post reply on HN