6 ms·

Who is able to get access to my browser history? I thought it was just my ISP/VPN, which can obviously track me better in other ways.

slipheen 6y ago
Consider for example, that many pages use remotely loaded resources. I would think things like Facebook/Twitter like buttons or Google Fonts might make it to assemble this history. Sites like FB are said to maintain "Shadow Profiles" of people, even when those people aren't using their service directly. I suppose in theory any sufficiently shared infrastructures such as AWS/Cloudflare could do so as well, but they are disincentivized to do so.
- WilTimSon 6y ago
  Would using Firefox's 'Containers' help prevent this? As far as I understand they quarantine the Facebook pages so they can't get data from other websites you visit.
  - cma 6y ago
    DNS resolve measurement to see if it is cached by the OS can potentially breach that.
    - laumars 6y ago
      Can JavaScript measure DNS resolve time?
      - cma 6y ago
        I think only indirectly, but if they control the endpoint they can ping you back, subtract rtt from initial request response time and then the difference from that can tell them whether initial request was cached in dns or not.
        laumars 6y ago
        Just so I understand correctly, does that mean you then need to control the end point of every site you want to use as part of fingerprinting? If so, wouldn’t that drastically reduce the effectiveness of using DNS resolve times as a work around for Firefox containers? Not trying to be argumentative here, just trying to understand how effective the sandboxing is, or whether I need to design more layers of indirection. :)
      - danielheath 6y ago
        It can measure response time. If you host your own dns and web server you can vary their response times and record from js.
  - deleted 6y ago
    [deleted]
- 627467 6y ago
  I've started using decentraleyes, hoping to mitigate this issue
  - ffpip 6y ago
    Use LocalCDN. A fork of Decentraleyes with many more resources for cache. https://addons.mozilla.org/en-US/firefox/addon/local-cdn-webextension/ https://addons.mozilla.org/en-US/firefox/addon/local-cdn-web...
    - Tarq0n 6y ago
      You linked to local CDN, I think you wanted localCDN (no space).
      - heresie-dabord 6y ago
        https://addons.mozilla.org/en-US/firefox/addon/localcdn-fork-of-decentraleyes/ https://addons.mozilla.org/en-US/firefox/addon/localcdn-fork...
      - ffpip 6y ago
        Thanks! Don't know how I missed it, when the extension's icon is on the toolbar itself
    - ffpip 6y ago
      * Wrong link https://addons.mozilla.org/en-US/firefox/addon/localcdn-fork-of-decentraleyes/?src=search https://addons.mozilla.org/en-US/firefox/addon/localcdn-fork...
- bleepblorp 6y ago
  Have there been any indications that AWS broadly captures connection data between AWS tenants and their respective users for illegitimate purposes? Some AWS services (such as TLS-terminating load balancers) do have access to sensitive cross-site information that could be fed into the adtech panopticon but I wonder if it would be cost-effective for AWS to gather. I doubt it would be cost effective for AWS to do broad captures for all of its services, however. There's probably not much value in slurping up the IP and SNI data for all HTTPS requests to every EC2 instance, for instance.
Barrin92 6y ago
extensions with the necessary permissions I think would be one obvious source.
stefan_ 6y ago
Malicious extensions are a likely culprit. This is the ultimate irony of the whole WebExtensions debacle; browser vendors wanted to stop the extensions from interacting with the browser because maintaining that interface is work, so now the most trivial extensions will request full access to all websites so they can inject scripts. To bring back "backspace navigates back" I have an extension that needs just that.
- contravariant 6y ago
  Needing javascript that embeds in every page for basic mouse and keyboard behaviour is insane. No clue why they decided it should be the only viable option.
  - wizzwizz4 6y ago
    It isn't intended to be. But supporting the old APIs meant that they had to have Microsoft levels of backwards-compatibility. • You want to refactor XUL so it doesn't duplicate features of HTML5? Whoops; you broke all the extensions. • You want multi-threading? What a shame; that API over there assumes it'll always be called from the main thread. • Update that database table's schema to store more data? Bah. Make another table, or you'll break extensions When every implementation detail is part of your interface, bad things happen.
    - liability 6y ago
      Fine, XUL had to go. But where is the replacement? How many more years should we expect Mozilla to need to implement configurable bindings? It doesn't even need to be extension-accessible, just give users a tab in the preferences menu like damn near any other application has been doing since the dawn of GUIs. Do they even have one engineer working on this?
      - wizzwizz4 6y ago
        Considering they fired half the people working on this, probably not.
dheera 6y ago
Facebook. Their embedded like buttons are all over the damn internet. Google Analytics. Google Fonts. Javascript CDNs. Image CDNs. Imgix. CDNs in general. Akamai. Cloudflare. Any of the several ads platforms. Disqus, or any of the commenting platforms. Youtube. Lots of people embed their video content. AWS, Google Cloud, Azure. Every time you visit a page that has an embedded content from a remote host, that host knows you visited that page.
afrcnc 6y ago
Install one shady Android app and it will immediately dump your browsing history, rest assured.
- lostmsu 6y ago
  How exactly would it do it? Android permissions prohibit access to other app data, except shared storage.
  - afrcnc 6y ago
    1. LPE/rooting exploit 2. Win
gkoberger 6y ago
Hmm this is a bit of an interesting question. The original study (2012) exploited a security bug, which let anyone see which sites you had visited. (Basically, by checking the color of links with JS to see if :visited styling had been applied.) That bug doesn't exist anymore, and the new survey just uses opt-in data to "confirm" it. So, I don't actually think this research is particularly relevant anymore? It can't really be exploited (and when it can, there's much better ways to track the person).
throwaway2474 6y ago
How do you imagine the ISP/VPN gets your browsing history for https traffic beyond domain names?
- liability 6y ago
  > beyond domain names "..other than that, how was the play Mrs. Lincoln?"
liability 6y ago
Does Mozilla Pocket get browsing history if it isn't disabled? Last I heard it's not using E2E encryption and Mozilla still hasn't open sourced the server side of it.
- ta95846893 6y ago
  My understanding of pocket recommendations is that it gets a list of articles from a server every day and uses a local algorithm to match them to your browsing history so your history never leaves the device. Idk if any metadata about which decisions it made is leaked though. https://help.getpocket.com/article/1142-firefox-new-tab-recommendations-faq#personalized https://help.getpocket.com/article/1142-firefox-new-tab-reco...
  - liability 6y ago
    I'm under the impression that syncing browsing history between instances of Firefox is a feature Mozilla provides through Pocket, but admittedly I don't have first-hand knowledge of this.
    - ta95846893 6y ago
      I think syncing is done with a Firefox account (Firefox Sync) and i can't find implementation details, but I did find: "Firefox Accounts uses your password to encrypt your data (such as bookmarks and passwords) for extra security. When you forget your password and have to reset it, this data could be erased. To prevent this from happening, generate your recovery key before having to reset your password."[1] So it appears they may be encrypting data locally and syncing encrypted data without having keys. I think you are right though, there are more website saving features available through pocket other than recommendations and I'm not sure how any of that works. [1] https://support.mozilla.org/en-US/kb/reset-your-firefox-account-password-recovery-keys https://support.mozilla.org/en-US/kb/reset-your-firefox-acco...
MikusR 6y ago
Mozilla was sending your Firefox history to Cliqz (in Germany). And currently is sending it to Cloudflare (in US).
- tpxl 6y ago
  Got a source for that one?
taneq 6y ago
Anyone with a widely distributed analytics package or tracking beacon can track your hits on pages with that beacon. How many pages DON'T use Google Analytics or a Facebook 'like' button?
gpvos 6y ago
It's in the article. You can do some clever Javascript/CSS tricks to sniff the browser history. Browsers are not trying to block this.
- gpvos 6y ago
  *now trying to block this (oops)

slipheen 6y ago

Consider for example, that many pages use remotely loaded resources. I would think things like Facebook/Twitter like buttons or Google Fonts might make it to assemble this history. Sites like FB are said to maintain "Shadow Profiles" of people, even when those people aren't using their service directly. I suppose in theory any sufficiently shared infrastructures such as AWS/Cloudflare could do so as well, but they are disincentivized to do so.

WilTimSon 6y ago
Would using Firefox's 'Containers' help prevent this? As far as I understand they quarantine the Facebook pages so they can't get data from other websites you visit.
- cma 6y ago
  DNS resolve measurement to see if it is cached by the OS can potentially breach that.
  - laumars 6y ago
    Can JavaScript measure DNS resolve time?
    - cma 6y ago
      I think only indirectly, but if they control the endpoint they can ping you back, subtract rtt from initial request response time and then the difference from that can tell them whether initial request was cached in dns or not.
      - laumars 6y ago
        Just so I understand correctly, does that mean you then need to control the end point of every site you want to use as part of fingerprinting? If so, wouldn’t that drastically reduce the effectiveness of using DNS resolve times as a work around for Firefox containers? Not trying to be argumentative here, just trying to understand how effective the sandboxing is, or whether I need to design more layers of indirection. :)
    - danielheath 6y ago
      It can measure response time. If you host your own dns and web server you can vary their response times and record from js.
- deleted 6y ago
  [deleted]
627467 6y ago
I've started using decentraleyes, hoping to mitigate this issue
- ffpip 6y ago
  Use LocalCDN. A fork of Decentraleyes with many more resources for cache. https://addons.mozilla.org/en-US/firefox/addon/local-cdn-webextension/ https://addons.mozilla.org/en-US/firefox/addon/local-cdn-web...
  - Tarq0n 6y ago
    You linked to local CDN, I think you wanted localCDN (no space).
    - heresie-dabord 6y ago
      https://addons.mozilla.org/en-US/firefox/addon/localcdn-fork-of-decentraleyes/ https://addons.mozilla.org/en-US/firefox/addon/localcdn-fork...
    - ffpip 6y ago
      Thanks! Don't know how I missed it, when the extension's icon is on the toolbar itself
  - ffpip 6y ago
    * Wrong link https://addons.mozilla.org/en-US/firefox/addon/localcdn-fork-of-decentraleyes/?src=search https://addons.mozilla.org/en-US/firefox/addon/localcdn-fork...
bleepblorp 6y ago
Have there been any indications that AWS broadly captures connection data between AWS tenants and their respective users for illegitimate purposes? Some AWS services (such as TLS-terminating load balancers) do have access to sensitive cross-site information that could be fed into the adtech panopticon but I wonder if it would be cost-effective for AWS to gather. I doubt it would be cost effective for AWS to do broad captures for all of its services, however. There's probably not much value in slurping up the IP and SNI data for all HTTPS requests to every EC2 instance, for instance.

Barrin92 6y ago

extensions with the necessary permissions I think would be one obvious source.

stefan_ 6y ago

Malicious extensions are a likely culprit. This is the ultimate irony of the whole WebExtensions debacle; browser vendors wanted to stop the extensions from interacting with the browser because maintaining that interface is work, so now the most trivial extensions will request full access to all websites so they can inject scripts. To bring back "backspace navigates back" I have an extension that needs just that.

contravariant 6y ago
Needing javascript that embeds in every page for basic mouse and keyboard behaviour is insane. No clue why they decided it should be the only viable option.
- wizzwizz4 6y ago
  It isn't intended to be. But supporting the old APIs meant that they had to have Microsoft levels of backwards-compatibility. • You want to refactor XUL so it doesn't duplicate features of HTML5? Whoops; you broke all the extensions. • You want multi-threading? What a shame; that API over there assumes it'll always be called from the main thread. • Update that database table's schema to store more data? Bah. Make another table, or you'll break extensions When every implementation detail is part of your interface, bad things happen.
  - liability 6y ago
    Fine, XUL had to go. But where is the replacement? How many more years should we expect Mozilla to need to implement configurable bindings? It doesn't even need to be extension-accessible, just give users a tab in the preferences menu like damn near any other application has been doing since the dawn of GUIs. Do they even have one engineer working on this?
    - wizzwizz4 6y ago
      Considering they fired half the people working on this, probably not.

dheera 6y ago

Facebook. Their embedded like buttons are all over the damn internet. Google Analytics. Google Fonts. Javascript CDNs. Image CDNs. Imgix. CDNs in general. Akamai. Cloudflare. Any of the several ads platforms. Disqus, or any of the commenting platforms. Youtube. Lots of people embed their video content. AWS, Google Cloud, Azure. Every time you visit a page that has an embedded content from a remote host, that host knows you visited that page.

afrcnc 6y ago

Install one shady Android app and it will immediately dump your browsing history, rest assured.

lostmsu 6y ago
How exactly would it do it? Android permissions prohibit access to other app data, except shared storage.
- afrcnc 6y ago
  1. LPE/rooting exploit 2. Win

gkoberger 6y ago

Hmm this is a bit of an interesting question. The original study (2012) exploited a security bug, which let anyone see which sites you had visited. (Basically, by checking the color of links with JS to see if :visited styling had been applied.) That bug doesn't exist anymore, and the new survey just uses opt-in data to "confirm" it. So, I don't actually think this research is particularly relevant anymore? It can't really be exploited (and when it can, there's much better ways to track the person).

throwaway2474 6y ago

How do you imagine the ISP/VPN gets your browsing history for https traffic beyond domain names?

liability 6y ago
> beyond domain names "..other than that, how was the play Mrs. Lincoln?"

liability 6y ago

Does Mozilla Pocket get browsing history if it isn't disabled? Last I heard it's not using E2E encryption and Mozilla still hasn't open sourced the server side of it.

ta95846893 6y ago
My understanding of pocket recommendations is that it gets a list of articles from a server every day and uses a local algorithm to match them to your browsing history so your history never leaves the device. Idk if any metadata about which decisions it made is leaked though. https://help.getpocket.com/article/1142-firefox-new-tab-recommendations-faq#personalized https://help.getpocket.com/article/1142-firefox-new-tab-reco...
- liability 6y ago
  I'm under the impression that syncing browsing history between instances of Firefox is a feature Mozilla provides through Pocket, but admittedly I don't have first-hand knowledge of this.
  - ta95846893 6y ago
    I think syncing is done with a Firefox account (Firefox Sync) and i can't find implementation details, but I did find: "Firefox Accounts uses your password to encrypt your data (such as bookmarks and passwords) for extra security. When you forget your password and have to reset it, this data could be erased. To prevent this from happening, generate your recovery key before having to reset your password."[1] So it appears they may be encrypting data locally and syncing encrypted data without having keys. I think you are right though, there are more website saving features available through pocket other than recommendations and I'm not sure how any of that works. [1] https://support.mozilla.org/en-US/kb/reset-your-firefox-account-password-recovery-keys https://support.mozilla.org/en-US/kb/reset-your-firefox-acco...

MikusR 6y ago

Mozilla was sending your Firefox history to Cliqz (in Germany). And currently is sending it to Cloudflare (in US).

tpxl 6y ago
Got a source for that one?

taneq 6y ago

Anyone with a widely distributed analytics package or tracking beacon can track your hits on pages with that beacon. How many pages DON'T use Google Analytics or a Facebook 'like' button?

gpvos 6y ago

It's in the article. You can do some clever Javascript/CSS tricks to sniff the browser history. Browsers are not trying to block this.

gpvos 6y ago
*now trying to block this (oops)