Stop Firefox leaking data about you • Hacker News Board

Re: Stop Firefox leaking data about you

#91

Post by pdkl95 » Fri, Jun 26, 2015, 10:12 AM UTC

garrettr_ wrote: post #89

pdkl95 wrote: post #46

Earlier quoted context omitted.

"separate cookie"? Just correlate it by IP address (or whatever) + time. While I'm not a database expert, I'm sure I could make something like this work: SELECT users.id AS google_user_id sb_hits.ip_addr AS safebrowsing_update_ip_addr sb_hits.request_time AS safebrowsing_update_time FROM all_page_hits AS user_hits, all_page_hits AS sb_hits, normal_google_accounts AS users, safebrowsing_pseudo_accounts AS sb_users WHE…

I don't understand the skeptical scare quotes around "separate cookie". If you read the linked bugs, you would see that when SafeBrowsing was originally added to Firefox, it used the same cookie jar, which meant that SafeBrowsing requests included a cookie for safebrowsing.google.com (necessary for it to function) but also all cookies for *.google.com, which is clearly undesireable from a privacy perspective and has…

Sceptical scare quotes? I was quoting your previous post.

Re: Stop Firefox leaking data about you

#92

Post by TheLoneWolfling » Fri, Jun 26, 2015, 12:45 PM UTC

magicalist wrote: post #83

TheLoneWolfling wrote: post #50

Earlier quoted context omitted.

Note that it does indeed recheck against the remote copy on a blacklist hit. So Google could indeed easily track URLs by adding it on the periodic check and then returning false on the specific check.

I'm quite late with this, but this is incorrect. At no time is the URL sent to Google; in fact, at no time is even the hash of the full URL sent to Google. I'd suggest you re-read the safebrowsing protocol. As ploxiln notes, if a hit is found with a matching prefix to the (canonicalized) URL, a request is made for all hashes of URLs beginning with that hashed prefix. The hash of the current URL can then be checked ag…

I was oversimplifying, sorry. You are correct that the URL isn't ever explicitly sent.

However.

Generally there are only one or two URLs that start with the hash prefix that is explicitly sent to Google. Which means in practice it may as well be leaking the actual URL to Google.

Especially as there are multiple hashes per URL (5 worst-case?).

If Google wants to track a URL, they can do so.

Re: Stop Firefox leaking data about you

#93

Post by fapjacks » Fri, Jun 26, 2015, 3:39 PM UTC

m3Lith wrote: post #45

fapjacks wrote: post #42

Wow. What the fuck, Mozilla? Here I was, really hopeful that you were actually serious about honoring user desire for privacy.

Did you even check out the link? There is nothing sensational or exceptional about collecting/sending basic user data when using certain features, most of which can be easily disabled/not used.

"Easily disabled" for example like tweaking about:config? Yeah, that's super easy and accessible for the average user!

Re: Stop Firefox leaking data about you

#94

Post by wodenokoto » Fri, Jun 26, 2015, 3:59 PM UTC

TheLoneWolfling wrote: post #51

wodenokoto wrote: post #5

While visiting google every 30 minutes or so is a way of leaking, you aren't leaking much more than ip and the fact that this up is in Firefox. Isn't reader an offline functionality?

You're missing that any blacklist hits are rechecked against Google. So it leaks a heartbeat, and any hits against the blacklist .

Is that new? Back when they started implementing they were saying that the did it as privately as possible, so that google couldn't track your browsing. It seems unnessecary. You do t get hits very often, so they could just redownload the entire list when there is a hit if they feel like double checking.

Re: Stop Firefox leaking data about you

#95

Post by ygjb » Sat, Jun 27, 2015, 1:31 PM UTC

dec0dedab0de wrote: post #35

garrettr_ wrote: post #27

Please for the love of god do not disable the Google SafeBrowsing preferences. SafeBrowsing protects you from a lot of malicious websites, and does not leak much information to Google. For most people the security benefits of SafeBrowsing far outweigh the privacy concerns. It is important to remember that malicious websites and malware in general may negatively impact your security and privacy in extremely harmful wa…

Please for the love of god do not disable the Google SafeBrowsing preferences. SafeBrowsing protects you from a lot of malicious websites, and does not leak much information to Google. For most people the security benefits of SafeBrowsing far outweigh the privacy concerns. I would never disable it for my mom, or any non technical friends. But I would hope the majority of HN users are pretty good at spotting, and stee…

Safebrowsing protects you from more than tricky websites - it blocks sites and services that are known to serve malware. It doesn't matter how clever a user you are, if your browser (doesn't matter which one) navigates to a site that hosts malicious code that targets an unpatched vulnerability, you're hosed.

Re: Stop Firefox leaking data about you

#96

Post by anonbanker » Sat, Jun 27, 2015, 9:22 PM UTC

JetSpiegel wrote: post #73

sdalfakj wrote: post #72

Earlier quoted context omitted.

> Seems like lots of FUD; how do Firefox Hello, Pocket and Geolocation "leak data about you" if you don't explicitly use them? How do DRM and Reader mode leak data at all? You really don't expect much from your browser at this point any more, do you? I want a browser that connects only to the website I asked it to display and let me configure how any (ANY) third party connection will be handled. I shouldn't have to u…

You can just use uMatrix or Policeman.

Then point is, we just used Firefox for this before. Now we're becoming a niche market. That change should be terrifying to more than just me.

Re: Stop Firefox leaking data about you

#97

Post by gerv » Thu, Jul 02, 2015, 4:47 PM UTC

fapjacks wrote: post #93

m3Lith wrote: post #45

Earlier quoted context omitted.

Did you even check out the link? There is nothing sensational or exceptional about collecting/sending basic user data when using certain features, most of which can be easily disabled/not used.

"Easily disabled" for example like tweaking about:config? Yeah, that's super easy and accessible for the average user!

The fact that he only lists the about:config way doesn't mean that this is the only way to do it. Many of these options have GUI prefs.