intika / Librefox

Librefox: Firefox with privacy enhancements
https://librefox.org
Mozilla Public License 2.0
1.7k stars 91 forks source link

Prefs update v65 #102

Closed Atavic closed 5 years ago

Atavic commented 5 years ago

network.connectivity-service prefs in FF 65:

pref("network.connectivity-service.DNSv4.domain", "mozilla.org");
pref("network.connectivity-service.DNSv6.domain", "mozilla.org");
pref("network.connectivity-service.enabled", true);
pref("network.connectivity-service.IPv4.url", "http://detectportal.firefox.com/success.txt?ipv4");
pref("network.connectivity-service.IPv6.url", "http://detectportal.firefox.com/success.txt?ipv6");

...are a group of unneeded entries unless you use Sync account and maybe Push notifcations.

Windows NCSI is exactly the same as FF network.connectivity-service prefs, as both do:

http://www.msftncsi.com/ncsi.txt and http://detectportal.firefox.com/success.txt

These FF 65 entries go against the security principle of a reduced attack surface, as there's a DNS Hijack opportunity.

intika commented 5 years ago

Great thanks for reporting back i'll take care of that ;)