Abrowser - What dangers in removing all HTTPS web addresses from "about:config"

> What would be the dangers of removing all (except for dns resolvers, certificate verifications?) http(s) web addresses in Abrowser's "about:config"?

Can you give us an example? I don't see web addresses in about:config in abrowser.

Hello andyprough,
Thanks.
Yes, there are also www(s) in my abrowser's about:config, so I await this opportunity to learn more about something I misunderstand, based upon your question to my query. I guess regarding the (mis-)characterization of the www(s) versus the other addresses.

Here are some example addresses that resolve when entered into the abrowser address bar.
https://nightly.mozilla.org ;
https://safebrowsing.google.com/safebrowsing/diagnostic?site= ;
https://monitor.firefox.com/user/breach-stats?includeResolved=true ;

There are so many, so I apologize for just trying a few randomly.

I do not know how those that do not resolve from the address bar are processed by the servers, as that is hidden to me. That were part of the concern and purpose of query as well.
However, if you can tell me how my sense is not common that those addresses are not just there to look important, but for purposes of use, I would much appreciate the relief.

Also, I can't expect to be able to catch up with the members' vast knowledge on these subjects, I find it difficult. So if there is any way you could explain it to me that I as a novice (who barely understands how you turn electricity into an instruction and mechanical actuator) might understand, I would much appreciate that as well.

Hello andyprough,
Thanks.
I'll have to read the paper. I think I found some copy.

One thing I didn't get. If I were to go into about:config and either removing those addresses, or altering them in a way that made them unresolvable, would that not work?
Or, are some of those abrowser files in /.mozilla, /etc and elsewhere also initiating contacting those servers as you listed above?
It is interesting that there is the hosts.deny file and that that won't do the denying.

Not having read the article yet, that list you've highlighted suggests there is a valid question to be asked about why the contacting is in force in the first place. This especially with the well observed widespread discussions on 'opting in' rather than having to opt out.

And more, who would suspect that this condition exists when privacy (and security) is being touted as a feature?

Hello andyprough,

I have read the research study document, "Web Browser Privacy: What Do Browsers Say When They Phone Home?" Douglas J. Leith, School of Computer Science & Statistics, Trinity College Dublin, Ireland 24th Feb 2020, that you referenced.

It would seem that yes, Mozilla (Firefox, etc.) is collecting data on its users' behaviors, and that even typing in the address bar results in transmission.
That relates to another thread topic regarding my attempt to block the Abrowser from searching from the address bar, as well.

I go out on a limb and speculate that the list of servers' and sites' addresses that you referenced from the paper cited could change (via developers, version and other updates, etc.), and that a non-expert would not be readily able to detect the additional server(s) being connected to, nor the nature and purpose of the connections.

Aside: Open Source originally instilled confidence that all code was checked by a community and thereby safety in usage was secured. That questionable assumption could cause un-safe behavior by users experiencing a false sense of assuredness that someone else has done the work which they themselves for reason(s) have not done. There is too much to check and it is constantly changing, not to mention varying levels of competence of the individual checkers themselves.

The authors of the paper suggest, and I support the suggestion, that autocomplete ought to either be turned off by default, or ought to be an opt-in immediately after first launch of the new instance of a browser. I would add that a brief explanation regarding the loss of privacy should be attached to the option.

Further, safe-browsing and other 'safety' devices open the door for user behavior data accumulation. Is that paradoxical or oxymoronic?

I don't feel as 'free' as I did before I read the paper.

Hello andyprough,
Thanks.

In another thread (Abrowser - Address Bar - Preference to use as search: Button unchecked, but still insists on search), I expressed concern that Abrowser's address bar was contacting the 'default' search engine when any thing was typed into the address box.
The Abrowser exhibited dropping down a search engine choice box as the letters were being typed, while indicating the default choice, which is mandatory to choose in settings.

Although I made some changes as you had suggested, and that the DuckDuckGo logo now disappears after continuing to type more letters into the address bar, after reading the above cited study paper, I do believe Abrowser is still regularly 'phoning' home to some server(s).

" ...Trisquel's abrowser web browser is that many of those things are turned off already..."

Unfortunately, I can't know which ones are turned off or are turned on.

That again was brought into question by the abrowser's address box behavior, which is constistent with the cited study showing that Firefox (Mozilla) is watching and listening for activity and collecting data and modelling behavior patterns, and etc.

As the study showed, many server contacting behaviors built in to the browser are very difficult to change if even possible, and others are completely hidden with no obvious way to change. This is by the experts, which I am not.
Further, the study tells that they only tested for cetain 'problems'. There are many more potential liabilities that require separate study techniques to test and reveal personal information and data theft.

This entire discussion goes directly to the question of avoiding bad actors such as a government, because there is no guarantee that a server or a company is not working with any given government. Big tech does not seem to have a problem doing the bidding of even certain big governments' censoring and tracking. Otherwise, how could they be permitted to operate at all in those countries? It begs, where does big government end and big tech begin, or?

And, there is no reason to believe that any country's defense departments would not want to use all technology at hand to secure their own existences.

It would be easier for me if I were knowledgeable enough to know the answers to my many questions.

Here is a guide to disable safebrowsing and more tracking features on FireFox:

https://privacytools.io/browsers/#about_config

The best way to "clean" unsolicited hosts is by using a user.js that clears all automatic connections.

A couple of examples:
https://pastebin.com/raw/d6PDPK8v
(https://old.reddit.com/r/privacy/comments/d3obxq/firefox_privacy_guide/)

https://git.nixnet.services/Narsil/desktop_user.js/raw/branch/master/user.js
(https://git.nixnet.services/Narsil/desktop_user.js)

Other users.js are not recommended (like arkenfox) due to they maintain several connections with Mozilla and Google.

So if you write about:networking you'd see this way:

Hello,
In fairness to the authors of the cited study, here are a few quoted statements from the introduction and conclusion sections.

"Chrome, Firefox and Safari all share details of web pages visited with backend servers."

"In addition, Firefox includes identifiers in its telemetry transmissions that can potentially be used to link these over time."

"Firefox also maintains an open websocket for push notifications that is linked to a unique identifier and so potentially can also be used for tracking and which cannot be easily disabled."

"Chrome, Firefox and Safari all tag requests with identifiers that are linked to the browser instance (i.e. which persist across browser restarts but are reset upon a fresh browser install). All three share details of web pages visited with backend servers."

This is one study on some potential hazards, not an exhaustive study on all potential hazards built in to the browsers, and then there are the extensions and other apps associated, not to mention Are there potential consequences?

"An important dimension to privacy that we do not consider here is the issue of giving and revoking consent for data use. Our measurements do raise questions..... However we leave this to future work."

"In the first (most private) group lies Brave, in the second Chrome, Firefox and Safari and in the third (least private) group lie Edge and Yandex."

This is interesting in that Brave seems to acknowledges by their business model (via their web site) that they need to profit to function and have chosen to allow the user to determine the extent of participation (or contribution). It is the only one in this study to be put in the top group. There are only three groups by this study's design, so being in the top group is better than being in the middle group of only three (for those that don't have time to read it).

If you write about:networking you'll only see detectportal and shavar.

Hello andyprough,
Thanks again. Your and others' assistance is highly accommodating. That allows me to stick with Trisquel and Abrowser.

"Agreed. I turn off all auto-complete, spell checking, "top sites", browser password managers, safe-browsing checks (which simply send all your browsing to Google), telemetry, etc."

I ask, should you really have to?

"One good thing about Trisquel's abrowser web browser is that many of those things are turned off already..."

Again, I can not know what those many things are and whether or not they are on by default or not.

Nothing that spies on or reports on or profiles me should be turned on by default. That would be freedom.

Hello,
Thanks.

I can not speak for the authors of the study so here is what they found.

"Chrome, Firefox and Safari all share details of web pages visited with backend servers. For all three this happens via the search autocomplete feature, which sends web addresses to backend servers in realtime as they are typed."

Which behavior Abrowser (derived from mozilla firefox?) it appears exhibits out of the box by default. That ought to be changed and not ignored. (Stallman is back, maybe I can ask him)
Apparently, if you accidentally type (paste) your password, bank account, credit card number, or other in that address (search) box, it is already revealed. That ought to be changed and not ignored.

"Firefox includes identifiers in its telemetry transmissions that can potentially be used to link these over time. Telemetry can be disabled, but again is silently enabled by default."

Is this turned off by default in Abrowser?

"Firefox also maintains an open websocket for push notifications that is linked to a unique identifier and so potentially can also be used for tracking and which cannot be easily disabled."

Is this turned off by default in Abrowser?

Is Abrowser better than other browsers in a hundred different ways? I have heard that. That does not negate remaining security concerns.
So even though I give some thumbs up, and I obviously like it, I am still appropriately concerned.

Hello,
It remains unclear to me as to the security and privacy considerations discussed as they pertain to Abrowser.

While I would like to see vulnerabilities resolved, I certainly would not be justified in demanding it be done.

However, if security and privacy issues exist in Abrowser, and of those that are known or suspected, I believe Abrowser (and Trisquel) should then come with appropriate specific warnings.

It is also even more imperative to do so where it has been suggested or advertised that certain security and privacy measures have been implemented, but while others not mentioned have not. Because, a false sense of security could arise from bad assumptions, e.g. dangerous things have been taken care of.
Thanks.

> I would like to see vulnerabilities resolved

You have not shown us any actual security vulnerabilities.

> However, if security and privacy issues exist in Abrowser, and of those that are known or suspected, I believe Abrowser (and Trisquel) should then come with appropriate specific warnings.

That would be true if actual security vulnerabilities were truly suspected. But we have access to all the actual security CVE's for firefox, and I see no reason to believe that abrowser is doing anything to make users more vulnerable to them.

You and I might like for some of the default privacy protecting settings to be tightened down more where possible, but those are not actual security vulnerabilities. And ultimately, securing your privacy is not something that someone else can do for you. You have to educate yourself and take steps for yourself.

.............................................

By the way, I turned off everything related to "push" in about:config, and have not noticed any bad effects for abrowser:
dom.push.connection.enabled - toggle to "False"
network.http.spdy.allow-push - toggle to "False"
dom.push.serverURL - delete the 'wss://push.services.mozilla.com/' server URL

There is also a setting in Preferences to turn off the ability for websites to ask to place notifications. Preferences-Privaty & Security-Settings Notification Permissions- check the box that says "Block new requests asking to allow notifications".

Hello andyprough,
Thanks.

> "You have not shown us any actual security vulnerabilities. "

Are you saying that the Study has not shown any actual security vulnerabilities? Or are you saying that you disagree with the study?

I thought I was plain in that I do not have the expertise to prove out these things one way or the other. To reassert, I do not.

> "...I see no reason to believe that abrowser is doing anything to make users more vulnerable to them."

Do you suggest that Firefox is not vulnerable and coincidentally that Abrowser is equally not vulnerable? Or, is Firefox vulnerable and Abrowser equally as vulnerable?

> "You and I might like for some of the default privacy protecting settings to be tightened down more where possible, but those are not actual security vulnerabilities. And ultimately, securing your privacy is not something that someone else can do for you. You have to educate yourself and take steps for yourself. "
and
> "Preferences-Privaty & Security-Settings..."

I have no reason to consider Privacy and Security as separate issues. Compromising vulnerabilities in eithers' catagorizations opens the windows to the other's. Would you dispute that potential?

> "...securing your privacy is not something that someone else can do for you."

I disagree wholeheartedly. e.g. I would not like to hear that from the engineers and builders of airplanes or automobiles. Neither would I like to find out that the engineers or builders took a popularity vote to see which way things ought be done. I prefer it to be done the best way and in a way that makes things work perfectly. This for obvious reasons.

Hello,

After changes in Abrowser's about:config attempting to disallow various servers being contacted without notice, at least one web site,

Amazon.com now demands completion of a "captcha" in order to proceed to its main page.

Amazon.com claims the verification is needed to prove Abrowser is not a bot. (Bots aid Amazon and others to increase web presence, so I don't 'buy it'.)

This indicates to me that Abrowser was previously communicating information about my system that Amazon.com, for one, at least, feels it has an absolute right to.
Abrowser is doing this without notification to the user.
And I thought I was already blocking Amazon and others from knowing anything about me other than my ISP location, and of course the current series of searches and clicks.

I have not run into this demand for proof of life while using another of the mozilla browsers also having removal of server addresses from about:config. That is, not while merely perusing a site, as opposed to sending to the site or receiving guarded information.

Abrowser, with its birth in the 'free' software movement, illuminates the need to answer the question: Can there be "libre" without privacy?

Thanks.