5 ms·
It's not Mozilla that learns about your IP address, it's all the hops between you and Mozilla. An encrypted HTTP request typially contains the following info:
by rhn_mk1 4y ago
It's not Mozilla that learns about your IP address, it's all the hops between you and Mozilla. An encrypted HTTP request typially contains the following info:
- source IP:port
- source OS (through TCP fingerprints)
- destination IP:port
- destination hostname
Now you have to consider where your packets may be diverted and who might want to do what with them.
- coldpie 4y agoOkay. Can you please describe a theoretical attack?
- rhn_mk1 4y ago1. X sniffs my connection. 2. X learns my address uses Firefox on Linux. 3. X sells the data to Y, whom I never visit. 4. Y correlates the IP with Z's subscriber data, and adds Linux to my shadow profile. As the sibling said, the burden of proof is on them. They are the ones who push that on users when there's no technical need.
- coldpie 4y agoSurely that same information is made available by visiting any website, no?
- rhn_mk1 4y agoYes, except the attacker gets it without visiting the attacker's web site.
- coldpie 4y agoYou lost me. Why can an attacker do this to Firefox's telemetry, but not when I visit https://google.com/ https://google.com/?
- rhn_mk1 4y agoIf you decide to visit google, that's your problem. Visiting mozilla should be optional too. Otherwise it creates attack surface area that wasn't there before.
- coldpie 4y agoOkay, so in conclusion, the attack vector from analytics that people spill dozens of comments on in every Mozilla thread is not unique to Firefox but rather shared with every website on the planet.
- rhn_mk1 4y agoYes. Except in most cases people aren't sent to $website unless they request it. That Mozilla does this is an opsec failure for anyone using it.
- coldpie 4y agoIf any network request will result in this vulnerability, then why do you have an Internet connection at all? This isn't a Mozilla problem.
- rhn_mk1 4y agoI can decide to connect only to trusted hosts. Having an automatic connection breaks that limitation. You ask for a real attack, but you don't seem to accept the example that you were given. I'm not sure what your point is.