Stop Firefox leaking data about you • Hacker News Board

Re: Stop Firefox leaking data about you

#81

Post by RubyPinch » Fri, Jun 26, 2015, 1:48 AM UTC

dec0dedab0de wrote: post #35

garrettr_ wrote: post #27

Please for the love of god do not disable the Google SafeBrowsing preferences. SafeBrowsing protects you from a lot of malicious websites, and does not leak much information to Google. For most people the security benefits of SafeBrowsing far outweigh the privacy concerns. It is important to remember that malicious websites and malware in general may negatively impact your security and privacy in extremely harmful wa…

Please for the love of god do not disable the Google SafeBrowsing preferences. SafeBrowsing protects you from a lot of malicious websites, and does not leak much information to Google. For most people the security benefits of SafeBrowsing far outweigh the privacy concerns. I would never disable it for my mom, or any non technical friends. But I would hope the majority of HN users are pretty good at spotting, and stee…

sure, you might not click on an advert or the such, but XSS isn't exactly visible, along with a whole host of other problems

Re: Stop Firefox leaking data about you

#82

Post by madez » Fri, Jun 26, 2015, 3:18 AM UTC

quesera wrote: post #79

madez wrote: post #74

Earlier quoted context omitted.

They are selling the information what you are searching for to Yahoo, not directly but indirectly by configuring their software in a way such that Yahoo can collect your data easily. That information is incredible personal. This is the reason why Yahoo pays for it. There is no stretch at all in what I've said.

That's nonsensical. You have to use some search engine. Whatever search engine you choose is going to get that incredibly personal information. Mozilla sold the default choice position to Yahoo. Any user who considers Yahoo to be more nefarious than some other choice can switch with about 10 seconds of effort.

That it is possible to opt out does not change the fact that personal information is sold, indirectly.

You know what would be nonsensical? If Yahoo didn't collect data about you.

If Mozilla did not need to sell our data it could ask which provider we want to use or integrate technology like YaCy.

Re: Stop Firefox leaking data about you

#83

Post by magicalist » Fri, Jun 26, 2015, 3:28 AM UTC

TheLoneWolfling wrote: post #50

akavel wrote: post #48

Earlier quoted context omitted.

Also, from the description of the Safe Browsing feature (as linked on the above page), it seems that it doesn't actually send (and thus leak) URLs; rather, it downloads a blacklist from Google periodically (~30min), and checks URLs against it locally ... https://support.mozilla.org/en-US/kb/how-does-phishing-and-m... (Though, for file downloads , some meta information seems to be sent if I'm reading correctly.)

Note that it does indeed recheck against the remote copy on a blacklist hit. So Google could indeed easily track URLs by adding it on the periodic check and then returning false on the specific check.

I'm quite late with this, but this is incorrect. At no time is the URL sent to Google; in fact, at no time is even the hash of the full URL sent to Google. I'd suggest you re-read the safebrowsing protocol.

As ploxiln notes, if a hit is found with a matching prefix to the (canonicalized) URL, a request is made for all hashes of URLs beginning with that hashed prefix. The hash of the current URL can then be checked against that list locally.

Re: Stop Firefox leaking data about you

#84

Post by magicalist » Fri, Jun 26, 2015, 3:34 AM UTC

dec0dedab0de wrote: post #35

garrettr_ wrote: post #27

Please for the love of god do not disable the Google SafeBrowsing preferences. SafeBrowsing protects you from a lot of malicious websites, and does not leak much information to Google. For most people the security benefits of SafeBrowsing far outweigh the privacy concerns. It is important to remember that malicious websites and malware in general may negatively impact your security and privacy in extremely harmful wa…

Please for the love of god do not disable the Google SafeBrowsing preferences. SafeBrowsing protects you from a lot of malicious websites, and does not leak much information to Google. For most people the security benefits of SafeBrowsing far outweigh the privacy concerns. I would never disable it for my mom, or any non technical friends. But I would hope the majority of HN users are pretty good at spotting, and stee…

> But I would hope the majority of HN users are pretty good at spotting, and steering clear of malicious websites

yeah, about that:

http://arstechnica.com/security/2013/02/web-forum-for-iphone...

http://arstechnica.com/security/2015/02/pwned-in-7-seconds-h...

etc etc

Re: Stop Firefox leaking data about you

#85

Post by quesera » Fri, Jun 26, 2015, 4:04 AM UTC

madez wrote: post #82

quesera wrote: post #79

Earlier quoted context omitted.

That's nonsensical. You have to use some search engine. Whatever search engine you choose is going to get that incredibly personal information. Mozilla sold the default choice position to Yahoo. Any user who considers Yahoo to be more nefarious than some other choice can switch with about 10 seconds of effort.

That it is possible to opt out does not change the fact that personal information is sold, indirectly. You know what would be nonsensical? If Yahoo didn't collect data about you. If Mozilla did not need to sell our data it could ask which provider we want to use or integrate technology like YaCy.

I do not follow your logic, at all.

Users use search engines. In fact it's pretty much a required feature to display a search bar proudly in the UI of a browser.

Users therefore give their search data to search engines. You can quibble about which corps are good corps and which corps are bad corps, but users cannot use search engines without giving search engines their search queries. Obviously.

Mozilla does no concomitant damage to users' privacy by allowing them to use their browser to use search engines. Mozilla, therefore, is not complicit in any wrongdoing which you ascribe to them.

If Mozilla made a deal with a manifestly worse option than the popular ones, measured either by results quality or by user abuse, the yes -- Mozilla would be reprehensible.

DDG is better, but it's not what users want.

> You know what would be nonsensical? If Yahoo didn't collect data about you.

Sure. Cool. That'd be neat.

> If Mozilla did not need to sell our data ...

Repeating that doesn't make it true. Mozilla does not sell your data. They sell placement of choice. We can agree that most users won't change the default choice, but we must also agree that almost no users will choose !google !yahoo !bing !ddg. In that order.

> ... it could ask which provider we want to use or integrate technology like YaCy.

The choice exists and is highly accessible. Are you suggesting a first-run dialog to ask the user to pick a search engine, a la Internet Explorer post-DOJ judgement? That's usability insanity.

YaCy doesn't even exist in Mozilla's user population's awareness. What's better? A good browser option or a dead browser?

Re: Stop Firefox leaking data about you

#86

Post by Tiksi » Fri, Jun 26, 2015, 5:25 AM UTC

amq wrote: post #68

amq wrote: post #31

Earlier quoted context omitted.

I couldn't find Browser.safebrowsing.remoteLookups in my about:config. Does it still apply? upd: I am searching for it in the Firefox sources now. Just for curiosity: there are 117512 files in 8610 directories totaling 743 MB, and search in files is really slow even on SSD.

browser.safebrowsing.remoteLookups works indeed, I could confirm this using Fiddler. For some reason, Notepad++ couldn't find a mention of 'remoteLookups' in sources.

    > time egrep -Rni remotelookup . 
    ./toolkit/devtools/gcli/source/lib/gcli/types/selection.js:81:    spec.remoteLookup = (typeof this.lookup === 'function');
    ./toolkit/devtools/gcli/source/lib/gcli/types/selection.js:128:  if (this.remoteLookup) {
    egrep -Rni remotelookup .  2.01s user 0.32s system 99% cpu 2.346 total

Re: Stop Firefox leaking data about you

#87

Post by garrettr_ » Fri, Jun 26, 2015, 5:45 AM UTC

dec0dedab0de wrote: post #35

garrettr_ wrote: post #27

Please for the love of god do not disable the Google SafeBrowsing preferences. SafeBrowsing protects you from a lot of malicious websites, and does not leak much information to Google. For most people the security benefits of SafeBrowsing far outweigh the privacy concerns. It is important to remember that malicious websites and malware in general may negatively impact your security and privacy in extremely harmful wa…

Please for the love of god do not disable the Google SafeBrowsing preferences. SafeBrowsing protects you from a lot of malicious websites, and does not leak much information to Google. For most people the security benefits of SafeBrowsing far outweigh the privacy concerns. I would never disable it for my mom, or any non technical friends. But I would hope the majority of HN users are pretty good at spotting, and stee…

They're designed to trick you, so I don't think any population, no matter how sophisticated, should trust themselves to correctly identify malicious websites 100% of the time.

Additionally, some sites may potentially contain exploits that run as soon as you visit the site (vulnerabilities in plugins like Java or Flash, drive-by downloads, etc.) in which case it doesn't matter if you correctly identify the website as malicious and hit the "Back" button - it's already too late. Much better to avoid loading the content at all, which is exactly what is achieved with SafeBrowsing.

Re: Stop Firefox leaking data about you

#88

Post by aorth » Fri, Jun 26, 2015, 5:59 AM UTC

Recommends turning on Firefox's built-in tracking protection[0] (which matured in Firefox 37 or so), but has anyone compared this to uBlock? I guess the first thing to measure would be number of trackers blocked, but then of course memory and CPU usage would be interesting as well. uBlock has done this comparison[1] against AdBlock Plus, Disconnect, etc, so it would be very interesting...

[0] https://support.mozilla.org/en-US/kb/tracking-protection-fir...

[1] https://github.com/gorhill/uBlock/#performance

Re: Stop Firefox leaking data about you

#89

Post by garrettr_ » Fri, Jun 26, 2015, 6:07 AM UTC

pdkl95 wrote: post #46

garrettr_ wrote: post #27

Please for the love of god do not disable the Google SafeBrowsing preferences. SafeBrowsing protects you from a lot of malicious websites, and does not leak much information to Google. For most people the security benefits of SafeBrowsing far outweigh the privacy concerns. It is important to remember that malicious websites and malware in general may negatively impact your security and privacy in extremely harmful wa…

"separate cookie"? Just correlate it by IP address (or whatever) + time. While I'm not a database expert, I'm sure I could make something like this work: SELECT users.id AS google_user_id sb_hits.ip_addr AS safebrowsing_update_ip_addr sb_hits.request_time AS safebrowsing_update_time FROM all_page_hits AS user_hits, all_page_hits AS sb_hits, normal_google_accounts AS users, safebrowsing_pseudo_accounts AS sb_users WHE…

I don't understand the skeptical scare quotes around "separate cookie". If you read the linked bugs, you would see that when SafeBrowsing was originally added to Firefox, it used the same cookie jar, which meant that SafeBrowsing requests included a cookie for safebrowsing.google.com (necessary for it to function) but also all cookies for *.google.com, which is clearly undesireable from a privacy perspective and has since been fixed.

If pattern-of-life analysis is a concern of yours, you should be using the Tor Browser and taking a whole host of other precautions. Fiddling with a bunch of prefs in about:config and using an ad blocker isn't going to cut it.

And again, it's not a zero-sum game. Safe Browsing provides some meaningful benefit of terms of protecting users from malicious websites, which on balance is probably worth the compromise to their privacy (which is comparatively minor and was minimized through careful and intentional engineering).

I agree that it's worthwhile to try to stop the trend towards increasing surveillance of Internet users using whatever techniques are available, but it's really at the core of the Internet's business model and some fundamental changes are necessary.

Re: Stop Firefox leaking data about you

#90

Post by Aissen » Fri, Jun 26, 2015, 7:50 AM UTC

tux wrote: post #9

Don't forget about this; "media.peerconnection.enabled = false" WebRTC leaks IP when you use TOR/VPN, test it with ipleak.net "beacon.enabled = false" Blocks https://w3c.github.io/beacon/ analytics. Also recommend using plugins; uBlock, NoScript if you use VPN.

Just tried it on ipleak.net, it seems WebRTC only leaked a local IP address, so if you're behind a router, it's almost meaningless… Until there's an attack involving a device on your local network.