4 ms·

Firefox Private Network uses Cloudflare Warp, which discloses to origin IP address to Cloudflare-enabled websites via a HTTP header [1]. Does Mozilla use a cust

Firefox Private Network uses Cloudflare Warp, which discloses to origin IP address to Cloudflare-enabled websites via a HTTP header [1]. Does Mozilla use a custom version of Warp which keeps the IP address of users private? [1] https://news.ycombinator.com/item?id=19544845 https://news.ycombinator.com/item?id=19544845

mirimir 7y ago
Ummm, it's not really a "VPN service" if it shares your IP address with websites. I mean, even high-end proxies don't do that. Edit: It's pretty clear from the following comment that this is not a "VPN service", as most people understand it. So Mozilla is being extremely disingenuous in calling it one. > > The intended use of the proxy service is to shield HTTP/HTTPS requests from eavesdropping by edge network providers such as public WiFi hotspots. Avoidance of geographical restrictions on content access is explicitly not a goal. > > The Mozilla extension will always make a secure request to the Cloudflare network, regardless if the request is for TLS or plaintext > (From Cloudflare's privacy notice: https://www.cloudflare.com/mozilla/firefox-private-network-privacy-notice/ https://www.cloudflare.com/mozilla/firefox-private-network-p...) https://news.ycombinator.com/item?id=20930194 https://news.ycombinator.com/item?id=20930194
- skybrian 7y ago
  On the other hand, from the Firefox announcement: "Firefox Private Network will mask your IP address providing protection from third party trackers around the web." [1] I'm guessing this means the IP address is partially masked, but there is enough info to determine the region the request comes from? Maybe someone should test this? [1] https://blog.mozilla.org/blog/2019/09/10/firefoxs-test-pilot-program-returns-with-firefox-private-network-beta/ https://blog.mozilla.org/blog/2019/09/10/firefoxs-test-pilot...
  - mirimir 7y ago
    Good idea. But you'd need both a Firefox account, and a website that uses Cloudflare. I have neither. Still, if this remains an open question, perhaps it's interesting enough to setup a website to test. I'd probably need at least an entry-level paid Cloudflare account, though. Meanwhile, it'd be great if someone from Mozilla could clarify this. That is, does Firefox Private Network share users' IP addresses with websites? As Warp clearly does.
- jedimastert 7y ago
  > Edit: It's pretty clear from the following comment that this is not a "VPN service", as most people understand it. So Mozilla is being extremely disingenuous in calling it one. I couldn't find "vpn" anywhere in the article. I don't think they are calling it one.
  - mirimir 7y ago
    Touché :) But they are also not being at all clear that it's not a VPN service. They say: > Internet Protocol (IP) addresses are hidden so it’s harder to track you – Your IP address is like a home address for your computer. One of the reasons why you may want to keep it hidden is to keep advertising networks from tracking your browsing history. Firefox Private Network will mask your IP address providing protection from third party trackers around the web. Sure, you get to the end of that, and you see "providing protection from third party trackers around the web". But the bullet starts with talk about keeping your IP address hidden. How many will realize that it's not hidden from websites that you visit? Not many, I think. It's a dark pattern deception.
rgbrenner 7y ago
So if you use cloudflare for your website, they'll give you extra information. Bad for users, but also bad for the people that run websites and the internet overall. Mozilla encourages users and server operators to consolidate the internet around Cloudflare. I'm sure Cloudflare is loving Mozilla's enthusiasm in helping them build a new monopoly on the web.
mehhh 7y ago
De-anonymization seems like a pretty bad anti-feature of Warp, I hope that Mozilla would demand better of Cloudflare for Firefox users. Certain VPN providers have moved to fully libre Power based servers and are working to enable a fully user auditable production VPN server, which should become the baseline among VPN providers IMO.
dessant 7y ago
I can no longer edit the comment, but I've just tested the Firefox extension, and both CF-Connecting-IP and X-Forwarded-For are set to a Cloudflare IP address, so the user's IP address is hidden. CF-IPCountry contains the location of the Cloudflare IP address. The requests appear to be routed through the nearest Cloudflare data center [1], so the service likely reveals the coarse location of users through these proxy IP addresses. I do not have an Enterprise account to check the True-Client-IP [2] header. [1] https://www.cloudflare.com/network/ https://www.cloudflare.com/network/ [2] https://support.cloudflare.com/hc/en-us/articles/206776727-What-is-True-Client-IP- https://support.cloudflare.com/hc/en-us/articles/206776727-W...
- mirimir 7y ago
  Damn. So you need an Enterprise account in order to determine whether this thing reveals users' IP addresses. And that probably isn't cheap, and can't be created anonymously. Someone from Mozilla really needs to clarify this.
  - dessant 7y ago
    True-Client-IP looks like an alias for CF-Connecting-IP, so far everything points to the design goals of Firefox Private Network being respected.
    - mirimir 7y ago
      If that's true, those goals are dangerous, and not clearly disclosed. They should prominently disclose something like this: "This extension does not hide your IP address from websites that use Cloudflare." And not leave it for people to discover that themselves.
      - dessant 7y ago
        The extension does hide the user's IP address from all websites, as stated in their marketing material and privacy policy. What it cannot be used for is to evade geoblocking, which is also stated in the privacy policy.

mirimir 7y ago

Ummm, it's not really a "VPN service" if it shares your IP address with websites. I mean, even high-end proxies don't do that. Edit: It's pretty clear from the following comment that this is not a "VPN service", as most people understand it. So Mozilla is being extremely disingenuous in calling it one. > > The intended use of the proxy service is to shield HTTP/HTTPS requests from eavesdropping by edge network providers such as public WiFi hotspots. Avoidance of geographical restrictions on content access is explicitly not a goal. > > The Mozilla extension will always make a secure request to the Cloudflare network, regardless if the request is for TLS or plaintext > (From Cloudflare's privacy notice: https://www.cloudflare.com/mozilla/firefox-private-network-privacy-notice/ https://www.cloudflare.com/mozilla/firefox-private-network-p...) https://news.ycombinator.com/item?id=20930194 https://news.ycombinator.com/item?id=20930194

skybrian 7y ago
On the other hand, from the Firefox announcement: "Firefox Private Network will mask your IP address providing protection from third party trackers around the web." [1] I'm guessing this means the IP address is partially masked, but there is enough info to determine the region the request comes from? Maybe someone should test this? [1] https://blog.mozilla.org/blog/2019/09/10/firefoxs-test-pilot-program-returns-with-firefox-private-network-beta/ https://blog.mozilla.org/blog/2019/09/10/firefoxs-test-pilot...
- mirimir 7y ago
  Good idea. But you'd need both a Firefox account, and a website that uses Cloudflare. I have neither. Still, if this remains an open question, perhaps it's interesting enough to setup a website to test. I'd probably need at least an entry-level paid Cloudflare account, though. Meanwhile, it'd be great if someone from Mozilla could clarify this. That is, does Firefox Private Network share users' IP addresses with websites? As Warp clearly does.
jedimastert 7y ago
> Edit: It's pretty clear from the following comment that this is not a "VPN service", as most people understand it. So Mozilla is being extremely disingenuous in calling it one. I couldn't find "vpn" anywhere in the article. I don't think they are calling it one.
- mirimir 7y ago
  Touché :) But they are also not being at all clear that it's not a VPN service. They say: > Internet Protocol (IP) addresses are hidden so it’s harder to track you – Your IP address is like a home address for your computer. One of the reasons why you may want to keep it hidden is to keep advertising networks from tracking your browsing history. Firefox Private Network will mask your IP address providing protection from third party trackers around the web. Sure, you get to the end of that, and you see "providing protection from third party trackers around the web". But the bullet starts with talk about keeping your IP address hidden. How many will realize that it's not hidden from websites that you visit? Not many, I think. It's a dark pattern deception.

rgbrenner 7y ago

So if you use cloudflare for your website, they'll give you extra information. Bad for users, but also bad for the people that run websites and the internet overall. Mozilla encourages users and server operators to consolidate the internet around Cloudflare. I'm sure Cloudflare is loving Mozilla's enthusiasm in helping them build a new monopoly on the web.

mehhh 7y ago

De-anonymization seems like a pretty bad anti-feature of Warp, I hope that Mozilla would demand better of Cloudflare for Firefox users. Certain VPN providers have moved to fully libre Power based servers and are working to enable a fully user auditable production VPN server, which should become the baseline among VPN providers IMO.

dessant 7y ago

I can no longer edit the comment, but I've just tested the Firefox extension, and both CF-Connecting-IP and X-Forwarded-For are set to a Cloudflare IP address, so the user's IP address is hidden. CF-IPCountry contains the location of the Cloudflare IP address. The requests appear to be routed through the nearest Cloudflare data center [1], so the service likely reveals the coarse location of users through these proxy IP addresses. I do not have an Enterprise account to check the True-Client-IP [2] header. [1] https://www.cloudflare.com/network/ https://www.cloudflare.com/network/ [2] https://support.cloudflare.com/hc/en-us/articles/206776727-What-is-True-Client-IP- https://support.cloudflare.com/hc/en-us/articles/206776727-W...

mirimir 7y ago
Damn. So you need an Enterprise account in order to determine whether this thing reveals users' IP addresses. And that probably isn't cheap, and can't be created anonymously. Someone from Mozilla really needs to clarify this.
- dessant 7y ago
  True-Client-IP looks like an alias for CF-Connecting-IP, so far everything points to the design goals of Firefox Private Network being respected.
  - mirimir 7y ago
    If that's true, those goals are dangerous, and not clearly disclosed. They should prominently disclose something like this: "This extension does not hide your IP address from websites that use Cloudflare." And not leave it for people to discover that themselves.
    - dessant 7y ago
      The extension does hide the user's IP address from all websites, as stated in their marketing material and privacy policy. What it cannot be used for is to evade geoblocking, which is also stated in the privacy policy.