Can't stop Firefox background connections about user.js HOT 24 OPEN

from user.js.

Short answer: you can use firewall rules or modify hosts file, See:
https://github.com/arkenfox/user.js/issues/917#issuecomment-609007023

You may also look at athe aliases with the nslookup command:
uBlockOrigin/uBlock-issues#1641 (comment)

from user.js.

2nd CRT appears in autograph and everything is hosted by amazon

Reddit linked to this

from user.js.

you can use firewall rules or modify hosts file

DNS/hosts file level filtering is indeed the simplest way to prevent these connections. Firewall/IP-based level filtering is extremely hard to enforce unless you know in advance to which IP these names will resolve (frequently changing IP addresses/CDN)

How do I do this on Linux?

https://wiki.archlinux.org/title/Transport_Layer_Security#Certificate_authorities

I don't think Firefox uses the OS certificate store though? Trusted certificate authorities are hardcoded in https://github.com/mozilla/gecko-dev/blob/master/security/nss/lib/ckfw/builtins/certdata.txt

from user.js.

Have you manually disabled tracking protection? Even after that Firefox seems to make some automatic connections to places like detectportal.firefox.com. Are you sure those are from Firefox as tcpdump shows all connections from your host?

You can check the DNS queries made before those connections for more clues what are those particular connections.

from user.js.

from user.js.

from user.js.

Can you provide the DNS requests happening before these connections so we can narrow down the culprits?

from user.js.

from user.js.

Hi, I can't see browser.selfsupport.url in current user.js
According to mozilla support that entry is responsible for startup persistent connections.

BTW for a non-backgorund connections setup, check about:networking while disconnected; then remove URLs via about:config

from user.js.

from user.js.

Could you explain how to do this?

tcpdump -i any -n 'port 53' or using Wireshark.

from user.js.

from user.js.

[https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2021-06-11-15-04-32.chain](The URI) lists 3 certificates:

remote-settings.content-signature.mozilla.org
Content Signing Intermediate/emailAddress=[email protected]
root-ca-production-amo

You can view source and check CRT with these services:
www.view-page-source.com/
www.sslshopper.com/certificate-decoder.html

You may get errors in the future when the Certificates expire.

from user.js.

Totally.
You can:

• reduce the trustwothiness of the many certificates present by default. Same goes with systems as a whole, see here
• The best source I have found about this is @ScottHelme , who says that revocation-checking-is-pointless
• Lastly, obfuscasting the User Agent String has lost interst for most people, but it's still useful in limited cases. Check Eclipsed Moon addon for Palemoon/Mypal in Smart mode if interested.

from user.js.

from user.js.

How do I do this on Linux?
https://wiki.archlinux.org/title/Transport_Layer_Security#Certificate_authorities

from user.js.

How do I do this on Linux?

I was referring to the OS, incidentally Arch uses CA certificates from Mozilla CA Certificate Store as a default

On topic, these connections are security related as insure that the Mozilla services delivered to the browser are indeed legitimate and there's no man-in-the-middle. It's called Autograph

I personally have no use of any service within the broswer, so I'd like to stop all of this.
In Firefox Zero there's an entry related to this:

user_pref("services.settings.server", ""); // Disable contacting settings server

Sorry, but it's an old user.js applied on a non-updated firefox. Also, this entry is widely available with a search like this that focuses on kinto, the server used for global synchronization.

Devs insert a dummyServerURL instead. The orginal URL to a chain of certificates that link to a trusted root is called x5u

from user.js.

services.settings.server

This pref is still present for me (Firefox ESR 78.12.0esr-1~deb10u1, Debian 10), it is set to the default value https://firefox.settings.services.mozilla.com/v1/

It seems there is some related documentation at https://remote-settings.readthedocs.io/en/latest/ and https://docs.kinto-storage.org/en/latest/tutorials/synchronisation.html#polling-for-remote-changes

@emanruse does changing this pref to a dummy URL such as https://localhost change anything to the connections you are seeing in tcpdump/wireshark?

To make your research easier I suggest enabling logging of DNS queries. If you are using a Linux distribution with network-manager you can create /etc/NetworkManager/conf.d/localdns.conf:

[main]
dns=dnsmasq

(make NetworkManager use a local, caching DNS server, maybe it is already setup this way on your distribution, check with grep -r dns= /etc/NetworkManager)

Then setup dnsmasq to log queries in /etc/NetworkManager/dnsmasq.d/options:

log-queries

from user.js.

Is there a reason why there is no about:config setting for this? Is there an upstream bug for this, or was it rejected for some reason?

from user.js.

from user.js.

As per:

• arkenfox/user.js#1807

Do you agree that pursuing the Radio Silence feature (no phone home, no background connections by default) is a laudable goal for a browser dedicated to enhancing user privacy?

In other words, can this ticket still being open be interpret as this being a good development goal, yet not done because it is difficult to implement?

from user.js.

from user.js.