News for hackers. Stuff that matters.
Re:Chromium calls home even in incognito mode with safe brow... by blub on Thursday October 22, 2015 @12:15PM (#10433043)
Using a web browser from a company basing most of its income on web advertising does come with such unpleasantness.

I was hoping mozilla would have their users' back, but a default install of Firefox also makes multiple connections to mozilla, google and other domains when started. Some extensions (notably NoScript and Ghostery) ping the mothership.

Safari connects to configuration.apple.com and the google website blacklist. uBlock for Safari tries to update itself even if no one asked it to.

Later edit: I have been told that I am perhaps being unfair to Mozilla. Let's see - I started reading https://support.mozilla.org/en-US/kb/how-stop-firefox-making..., to see how I can stop Firefox from connecting to servers without being requested to. While it's nice that they provide this page, this article's breadth only serves to prove that this browser is out of control when it comes to making connections to servers by itself.

I have the following settings:

* disabled Firefox health report

* disabled crash reporting

* never check for updates

* do not check for addon updates

* block reported attack sites

* block reported forgeries

After reading the page, it turns out that I also have to disable the following from about:config:

* the addons blocklist

* link prefetching

* DNS prefetching

* speculative pre-connections

* firefox Hello

* tiles, even if they were already disabled from the UI

* the default search engine geo-location

* the what's new page

* add-on metadata updating

* the heartbeat

For reference, here are the connections that Firefox tries to establish immediately after startup:

Outgoing to self-repair.mozilla.org (54.230.200.16), Port https (443), Protocol TCP (6), 0 B sent, 0 B received

Outgoing to shavar.prod.mozaws.net (52.26.89.67), Port https (443), Protocol TCP (6), 0 B sent, 0 B received

Outgoing to safebrowsing.google.com (2a00:1450:4001:809::1005), Port https (443), Protocol TCP (6), 0 B sent, 0 B received

Outgoing to tiles.r53-2.services.mozilla.com (52.25.98.110), Port https (443), Protocol TCP (6), 0 B sent, 0 B received

Outgoing to cmp-cdn.ghostery.com (54.152.180.212), Port https (443), Protocol TCP (6), 0 B sent, 0 B received

Outgoing to search.services.mozilla.com (54.69.18.27), Port https (443), Protocol TCP (6), 0 B sent, 0 B received

Re:Chromium calls home even in incognito mode with safe brow... by rockdoe on Thursday October 22, 2015 @12:19PM (#10433068)
I was hoping mozilla would have their users' back, but a default install of Firefox also makes multiple connections to mozilla, google and other domains when started.

Firefox checks for updates, and will update the malware/phishing databases a bit after startup. That's actually the same SafeBrowsing the OP mentions. All of this can be toggled. I'm not sure what your vague "other domains" is.

I'm a bit puzzled at the extreme shortsightedness of a browser checking for security updates being branded as "not having their users' back".

Re:Chromium calls home even in incognito mode with safe brow... by bobbyi_settv on Thursday October 22, 2015 @01:41PM (#10433606)
Isn't also shortsighted to expect every application to implement its own system for checking for security updates? Wouldn't it be more secure to have this managed by the OS or a package manager instead of hoping every application does it correctly?
Re:Chromium calls home even in incognito mode with safe brow... by mcherm on Thursday October 22, 2015 @02:36PM (#10434021)
That depends on whether the OS or package manager does a better job of providing security updates, or the application does.

Historically, browsers -- because of their enormous potential risk (easy to exploit) -- have done a better job of providing security updates quickly than have other tools.

Re:Chromium calls home even in incognito mode with safe brow... by acdha on Thursday October 22, 2015 @03:20PM (#10434382)
That's only true if the OS has a solid, secure and open package manager. Linux users have had that since the mid-90s but it still doesn't exist for Windows or OS X users unless you count their respective app stores or are talking about a few niches (Flash, drivers) where Microsoft is willing to distribute things through Windows Update.
Re:Chromium calls home even in incognito mode with safe brow... by Aissen on Thursday October 22, 2015 @12:53PM (#10433281)
At least Mozilla documents every connection made and explains why they're made, and how to disable them:

https://support.mozilla.org/en-US/kb/how-stop-firefox-making...

Re:Chromium calls home even in incognito mode with safe brow... by kalsk on Thursday October 22, 2015 @01:35PM (#10433564)
This is about Chromium, not Chrome. A lot of people assume that Chromium is safer because things like this should get caught by the community.

I think the lesson to be learned here is that FOSS can be just as dangerous as commercial software if not enough people are inspecting the code and following development. It seems there are a lot of people who unconditionally trust anything that's open-source.

Re:Chromium calls home even in incognito mode with safe brow... by rockdoe on Thursday October 22, 2015 @02:43PM (#10434069)
I have been told that I am perhaps being unfair to Mozilla...For reference, here are the connections that Firefox tries to establish immediately after startup

So: It connects to Mozilla itself and to Google (specifically their server for the malware/phishing DB). The fact that Ghostery is in there is because you have third party addons installed.

FWIW shavar.prod.mozaws.net is a Mozilla server which updates the blocklist for Tracking Protection. Somewhat ironic you're complaining about it given the context.

Re:Chromium calls home even in incognito mode with safe brow... by hsivonen on Thursday October 22, 2015 @01:58PM (#10433746)
The flipside: https://groups.google.com/d/msg/mozilla.dev.planning/wBgLRXC...

"That said, the fact that Linux distros might switch off Telemetry and [Firefox Health Report] by default causes issues right in that way: they are undercounted and [Mozilla] may disregard them completely in data-driven decisions. If you are a Linux distro package manager, think about that."

Re:Chromium calls home even in incognito mode with safe brow... by click170 on Thursday October 22, 2015 @12:27PM (#10433119)
These requests are trivial to detect and block with a proper gateway firewall like pfsense or others. Consumer grade firewalls just don't have enough options, or resources to support those options.

Trust, but verify.

Re:Chromium calls home even in incognito mode with safe brow... by Sanddancer on Thursday October 22, 2015 @06:13PM (#10435480)
They do have the user's back. That means not wearing a tin foil hat. In order for a modern browser to work in a halfway decent manner, they need to ensure that things are reasonably up to date, that developers see crash reports so they can discover bugs and security flaws before someone malicious does, and that lists of malicious sites get updated. Not checking for updates, not providing bug reports is the opposite of good software hygiene.
Re:Chromium calls home even in incognito mode with safe brow... by ljk on Thursday October 22, 2015 @12:29PM (#10433132)
> Some extensions (notably NoScript and Ghostery) ping the mothership.

could you explain what this means? Been using uBlockOrigin+NoScript+Ghostery combo for quite a some time now and never realized how NoScript might be unsafe

Re:Chromium calls home even in incognito mode with safe brow... by rockdoe on Thursday October 22, 2015 @12:31PM (#10433139)
I'm going to guess they use lists of exceptions (NoScript) or of trackers (Ghostery) that need to be updated.
Re:Chromium calls home even in incognito mode with safe brow... by blub on Thursday October 22, 2015 @01:55PM (#10433712)
NoScript is unfortunately quite sketchy, I don't use it any more.

It has a whitelist supposedly to not break "top websites", but this list contained IMO some questionable choices last I checked it. It also tries to connect to the dev's website for no reason at all (addons are updated directly from Firefox) and after updates, "to show the release notes".

Last but not least, this is the same dev which got involved in a scandal for trying to underhandedly whitelist the said website into an ad-blocking addon.

Re:Chromium calls home even in incognito mode with safe brow... by okasaki on Thursday October 22, 2015 @02:27PM (#10433943)
What list is that? I'm looking at it and I'm pretty sure I personally whitelisted all of those domains. The only ones that seem to have come from NoScript are the about:... ones
Re:Chromium calls home even in incognito mode with safe brow... by blub on Friday October 23, 2015 @03:41AM (#10437332)
I reinstalled it to check again and it seems you are correct, there's nothing except about:* links. I remember it had some big portal websites I hadn't visited and would not enable JS for, however I am willing to accept I was wrong. Unfortunately, I can't edit my initial comment any more.

Thanks for checking and sorry for my confusing initial post...

Re:Chromium calls home even in incognito mode with safe brow... by ljk on Thursday October 22, 2015 @02:50PM (#10434127)
Wow, didn't know that. Any suggestions for NoScript alternatives?
Re:Chromium calls home even in incognito mode with safe brow... by JupiterMoon on Thursday October 22, 2015 @12:33PM (#10433153)
I guess it's a cost benefit. Does noscript block more than it leaks? Given the noscript is integrated into the tor browser bundle it can't be that bad... Right? We hope...
Re:Chromium calls home even in incognito mode with safe brow... by BuckRogers on Thursday October 22, 2015 @12:21PM (#10433079)
Perfect is the enemy of better. As long as you stay away from browsers with strong for-profit origins, especially Google who thrives on data mining, you'll be better off.
Re:Chromium calls home even in incognito mode with safe brow... by EC1 on Thursday October 22, 2015 @12:33PM (#10433151)
Yeah hold on let me fire up Opera. No. What do you suggest? Compile Chromium from source?
Re:Chromium calls home even in incognito mode with safe brow... by coldtea on Thursday October 22, 2015 @12:40PM (#10433203)
Firefox. Explorer. Safari. All three don't make their money off of data-mining / ad revenue.

Not that I'm advocating for them (I use Chrome myself), but those fit what the parent suggested.

Re:Chromium calls home even in incognito mode with safe brow... by Netbeing on Thursday October 22, 2015 @01:23PM (#10433485)
Browsers don't make money at all, not directly, as you know.

Microsoft pulls in 11 figures a year in online advertising revenue. As of earlier this year, Apple was still earning more mobile ad revenue than any other firm. And Mozilla is funded almost entirely by companies that earn billions in online ad revenue like Yahoo and Google.

Re:Chromium calls home even in incognito mode with safe brow... by coldtea on Thursday October 22, 2015 @01:33PM (#10433550)
>Browsers don't make money at all, not directly, as you know.

Which is neither here, not there. As I wrote those three browsers don't make money off of ad revenue and/or private data. Chrome does.

Whether the money are made directly or indirectly is beside the point for the purposes of the discussion.

>Microsoft pulls in 11 figures a year in online advertising revenue. As of earlier this year, Apple was still earning more mobile ad revenue than any other firm. And Mozilla is funded almost entirely by companies that earn billions in online ad revenue like Yahoo and Google.

Not that relevant either. Apple sells display ads (iAds etc) and that's it. They don't deal in personal data. Mozilla even less -- whether Yahoo/Google pays it to be the default search engine or not.

Re:Chromium calls home even in incognito mode with safe brow... by cromwellian on Thursday October 22, 2015 @03:48PM (#10434556)
Apple sells targeted advertising and their T&C say they may use data for targeting.
Re:Chromium calls home even in incognito mode with safe brow... by Confusion on Thursday October 22, 2015 @12:54PM (#10433287)
You should really read up on where Mozilla's money comes from. See the financing section of https://en.m.wikipedia.org/wiki/Mozilla_Foundation
Re:Chromium calls home even in incognito mode with safe brow... by coldtea on Thursday October 22, 2015 @01:36PM (#10433569)
From selling its "default search engine" spot -- I'm on this web business professionally since 1995, I know that.

That's not direct ad sales and Mozilla wasn't created with the specific purposes to sell ads or collect private information, nor is owned by an ad-selling company.

Besides you can change the default search engine in a heartbeat.

Re:Chromium calls home even in incognito mode with safe brow... by Confusion on Friday October 23, 2015 @03:10AM (#10437250)
I certainly consider that funding by direct ad sales. It's like any other affiliate model: your contribution is to get their product to be sold.
Re:Chromium calls home even in incognito mode with safe brow... by EC1 on Thursday October 22, 2015 @01:01PM (#10433345)
Someone said that that all of those call home as well. I need a browser that just lets me browse instead of filling me with constant "1984-esque" anxiety and paranoia for every URL I go to, and apparently all the extensions I run ALSO call home and leave a uniquely identifying finger print.

Honestly I'm moving to backend work and using a terminal browser. This is so fucking stupid. Wish there was at least one program on my computer that isn't trying to constantly stab me in the back.

Re:Chromium calls home even in incognito mode with safe brow... by coldtea on Thursday October 22, 2015 @01:39PM (#10433591)
>Someone said that that all of those call home as well

Obviously, since all have update-check (and auto-update) features, live content (e.g. intro page), etc.

That's not the same as mining your every search, and they don't own an add company or anything.

>I need a browser that just lets me browse instead of filling me with constant "1984-esque" anxiety and paranoia for every URL I go to, and apparently all the extensions I run ALSO call home and leave a uniquely identifying finger print.

It's even worse: EVERY IP (and/or page) you visit is registered on your ISP.

About apps phoning home specifically, you can install an application firewall like Little Snitch and be warned and in control of any such attempt.

It's not something that you should trust on the browser vendors not to do, anyway...

Re:Chromium calls home even in incognito mode with safe brow... by Kristine1975 on Thursday October 22, 2015 @12:52PM (#10433276)
Opera 12 still works for most web sites (including HN).
Re:Chromium calls home even in incognito mode with safe brow... by rasz_pl on Thursday October 22, 2015 @01:25PM (#10433497)
True, but it will need someone with magic touch soon to binary patch OpenSSL, more and more websites require ECDSA (cloudflare giving out free certs)

Im seeing more and more Error 40 every week :(

Other than elliptic curve BS Opera 12 is a perfect browser for me.

Re:Chromium calls home even in incognito mode with safe brow... by newman314 on Thursday October 22, 2015 @05:03PM (#10435058)
It would be nice if there was an extension/script that enabled "max privacy mode" by frobbing all these config bits.
Re:Chromium calls home even in incognito mode with safe brow... by moron4hire on Thursday October 22, 2015 @01:17PM (#10433454)
Where do you think Mozilla makes most of its money? Hint: it ain't donations.
Re:Chromium calls home even in incognito mode with safe brow... by rockdoe on Thursday October 22, 2015 @02:37PM (#10434027)
They get money from Yahoo for putting it as their default search engine in the USA.

What was your point exactly? I fail to see any relation here.

Re:Chromium calls home even in incognito mode with safe brow... by moron4hire on Thursday October 22, 2015 @02:47PM (#10434099)
Is it Yahoo again? I thought it was Bing now. But it's advertising. It's advertising for whomever gets their shitty search engine in the prime real estate.
Re:Chromium calls home even in incognito mode with safe brow... by drzaiusapelord on Thursday October 22, 2015 @03:15PM (#10434351)
I believe yahoo search is bing.
Re:Chromium calls home even in incognito mode with safe brow... by wonkaWonka on Thursday October 22, 2015 @12:22PM (#10433090)
...and don't forget: WGET is a "hacker tool"