site Search:


 
    All Forums Hot Topics Gallery






how-to block ads


 
Search Topic:
Uniqs:
2354
Share Topic
Posting?
Post a:
Post a:
Links: ·Hijack This logs? ·Panda Free Tools ·Vundo Removal
page: 1 · 2 · 3
AuthorAll Replies

BandHeight

join:2004-08-30

1 edit

Thoughts / Warnings On Bookmark Checking And Re-directs

I read through most of the posts and news stories a few days ago related to the teacher facing a prison term for porn pop-ups that opened in front of students. Since then, I became a "victim" of unintentional porn viewing, something that is very easy to do as others have noted.

To begin ... I'm security conscious. I use FireFox, Proxo, DNSKong, antivirus software, anti-trojan software, the latest updates on all software, I use Linux as well for some work, etc. Despite all that, while cleaning up some old bookmarks (some dating back to 1998-1999) which were supposed to link to MS Access resources, I clicked on a bookmark that had been entitled:

HelpTalk Online - MS Access Support

The underlying URL seemed safe enough:
h t t p : //www .helptalk.net/forums/access/

so I clicked the bookmark to see if it was dead or still contained any relevant info, and I was immediately taken to:

h t t p : //www .hotlocales*rts.com/search.asp

(WARNING: the above links contain adult content)

Obviously, that re-direct could have been embarrassing at best or illegal at worst depending on the environment in which I had checked the bookmark (I cannot comment on malware or pop-ups that may be generated at the site as I did not check the page without security apps / blockers running). Luckily, I was by myself when I checked the bookmark (no wisecracking, please. ) so I wasn't humiliated nor do I expect to be arrested any time soon.

The root address of w w w.helpdesk.net still shows some computer related resources, but it also contains advertising links to porn. I am 100%, absolutely certain that the site contained no such material when it was bookmarked as an Access resource many years ago.

I usually clean up bookmarks manually, but think about the tens and perhaps hundreds of inadvertent re-directs to pornographic or illegal material that may occur, without any user-awareness, if you are using a bookmark-culling utility such as AM-DeadLink.

And finally, having had that recent and topical experience, I would like to re-emphasize information I posted a while back regarding behavior of FireFox and its new feature, Live Titles (aka, microsummaries).

The functionality of Live Titles includes FireFox connecting to a site simply by right-clicking on a bookmark and checking properties. Without getting into details again, it is obvious that simply checking the properties of bookmarks may leave data on a PC that leads to false forensic conclusions about how / why certain sites were accessed. This was one of my concerns when I brought it up originally, and the case of the teacher being convicted of a crime by an incompetent prosecution / jury only adds to the concern.

If you did not read it before or find the information more compelling in light of recent events, see my posts here (includes a Proxomitron filter to stop the Live Titles functionality when simply checking Bookmark Properties):

»FireFox / Mozilla HTTP Headers: X-Moz

I'm not suggesting that any of us have been oblivious to re-directs and such (maybe the Live Titles issue is new to you), but having such things occur at the wrong time or place may put you in significant jeapardy. Be safe and don't get arrested if you can avoid it.

Edit:
Punctuation and extra word


beck
Premium,MVM
join:2002-01-29
On The Road
kudos:1
Reviews:
·Stablehost.com
·AllureHost

I guess I don't understand why they put microsummaries in there at all.

I hope they enable a way to turn this off in firefox 2.x. Or else you just have to edit filters when you have no access to the net.
--
It doesn't interest me who you know, or how you came to be here.
I want to know if you will stand in the center of the fire with me and not shrink back.
- Oriah Mountain Dreamer


SUMware
Premium
join:2002-05-21
kudos:2

reply to BandHeight

said by BandHeight:

(includes a Proxomitron filter to stop the Live Titles functionality when simply checking Bookmark Properties)
A good idea and a valuable filter. It's working fine in my Proxo config (Sidki's version). Thanks again, BandHeight.

BandHeight

join:2004-08-30

reply to beck

said by beck:

I guess I don't understand why they put microsummaries in there at all.

I hope they enable a way to turn this off in firefox 2.x. Or else you just have to edit filters when you have no access to the net.
It would be nice if they did provide an on / off ... at least in "about:config" if the developers are concerned with cluttering up the Preferences dialog. One major problem is that most people don't know that what I described is part of Live Titles functionality, even if those same people think they understand what Live Titles are. Turning off something that you don't know about is difficult in the extreme.

P.S.

By the way, this feature is new in 2.0, but I believe it was Beck's intention to suggest that Mozilla still has an opportunity in version 2 incremental updates to provide a solution.

Mele20
Premium
join:2001-06-05
Hilo, HI
kudos:4

1 edit

This is just another reason to not use Fx 2.0. All you do if you have 2.0 is constantly fix it so that it not a terrible privacy invader. I would never check properties for a bookmark so I guess that weird microsummeries is no worry for me. I do have 2.0 on a virtual machine but I'm removing it. I am sick of constantly fixing 2.0 to work properly. I use 1.5 on my main machine and do not plan to upgrade even after April.

i tried doing a properties check on some bookmarks in both 1.5 and 2.0 to see what you were talking about. Sure enough, in some bookmarks in 2.0, clicking on properties gave me some dumb summary of the site. I don't need a summary of any bookmark. I already know what the bookmark is for...why would I ever click on properties to get a summary? That is plain crazy. So, I find the thing utterly stupid and worthless besides being an obvious privacy invader like so much else now is in 2.0. Fx 2.0 is a BAD browser. Never thought I would say that about Fx. 1.5 is fine...don't go above it. One of the bookmarks I tried in 2.0 that gave me the summary also popped up a cookie window! Inexcusable. And if you can't turn this off in about:config...well that is so bad as to make Fx 2.0 worthless SHIT.

I have Proxo so I am so glad I read this thread and then went and read your earlier one just now. I can use the filter but I have such a filthy taste in my mouth now about Fx 2.0 because this is not the first major privacy invader in 2.0, I intend to avoid 2.0 completely. Fx has been my browser of choice for over 5 years but now it is rapidly becoming as bad or worse than IE. It still has some things that I don't want to give up (extensions) so I will use 1.5 and I guess begin to prepare myself to one day not using Fx (unless 3.0 cares more about my privacy). Have you asked about this at Mozillazine?

Edited to ask if you know if there are any bugs filed on this?
--
"If you want to do DRM on a PC then you need to treat the user as the enemy." Ross Anderson in "`Trusted Computing' Frequently Asked Questions"

»www.msfirefox.com/



Grail Knight
Who Dares Wins
Premium
join:2003-05-31
Valhalla
kudos:5
Reviews:
·Time Warner Cable

1 edit

reply to BandHeight
Are you saying that Live Titles can not be turned off easily in Firefox as well as summeries?

Seems if you just change the bookmarks address to the Normal Url you will not have the summery or live marks.

As this is still in development there is no GUI for it but it is under development.

»blog.mozilla.com/faaborg/2006/12···-titles/

»wiki.mozilla.org/Microsummaries



Grail Knight
Who Dares Wins
Premium
join:2003-05-31
Valhalla
kudos:5
Reviews:
·Time Warner Cable

reply to Mele20

quote:
All you do if you have 2.0 is constantly fix it so that it not a terrible privacy invader.
Please explain yourself here.

quote:
One of the bookmarks I tried in 2.0 that gave me the summary also popped up a cookie window!
Please provide a link to the site you claim does this.
--
When the going gets tough the tough run away.



Grail Knight
Who Dares Wins
Premium
join:2003-05-31
Valhalla
kudos:5
Reviews:
·Time Warner Cable

reply to beck
Microsummaries is just the next step in making bookmarks more versatile. Considering the complaints over the years about feature stagnation in IE this is a welcomed feature by some.

There is a whole thread at MozillaZine Forum discussing this feature.

Microsummaries
--
When the going gets tough the tough run away.



hpguru
Curb Your Dogma
Premium
join:2002-04-12

said by Grail Knight:

Considering the complaints over the years about feature stagnation in IE...
ROTF!! Blame it on MSIE!

*...this is a welcomed feature by webmasters.*

Fixed it for you.
--
Where's Jesus?
Dear Jesus!


hpguru
Curb Your Dogma
Premium
join:2002-04-12

reply to BandHeight
FYI this filter will not kill the connection. It removes the X-Moz header only. I am using this filter.

[HTTP headers]
In = FALSE
Out = TRUE
Key = "X-Moz: Kill Microsummary Connections (Out)"
Match = "*"
Replace = "\k"

--
Where's Jesus?
Dear Jesus!


Grail Knight
Who Dares Wins
Premium
join:2003-05-31
Valhalla
kudos:5

reply to hpguru
Fix away if you must but I do recall having been an IE user that not much was done by MS with it until competition woke them up



hpguru
Curb Your Dogma
Premium
join:2002-04-12

reply to BandHeight
I wonder if there is a potential DOS attack lurking here. I was reading that if the microsummary page is formatted as plaintext, FF2.0 does nothing and uses the text as-is, but if the page contains markup FF will convert it to text. I imagine a malicious webmaster could keep FF pretty busy if they wanted to.
--
Where's Jesus?
Dear Jesus!


Mele20
Premium
join:2001-06-05
Hilo, HI
kudos:4

1 edit

reply to Grail Knight

Click for full size
You can't turn off microsummeries. I have live bookmarks/titles turned off but if I do a properties check on a bookmark many of them show me a microsummery. I can't see how to turn that off. You asked which one also gave me a cookie box when I all did was look at properties for that bookmark. It was Speakeasy bandwidth test site.

As for privacy invasion in 2.0, I was thinking of Client Side Session and Persistent Storage which, because of how I happen to have Cookies set, will not deposit garbage on my computer but will for most folks UNKNOWN to them and the only way to stop it is to set cookies as I have always done because there is no GUI for Persistent Storage.

2.0 also removes the safeguard to accept cookies from the orginating site only. It also removes (although you can fix both in about:config) the setting to accept images from the orginating site only. I shouldn't have to fix all this stuff in about:config. There is more but I'd have to think about it for a bit as I hardly use my VMWare machine now because I don't want to use 2.0 so offhand I can't remember what else is a privacy invader. I have made so many adjustments in about:config that it is ridiculous. I never did hardly anything in there as I didn't need to...until 2.0.
--
"If you want to do DRM on a PC then you need to treat the user as the enemy." Ross Anderson in "`Trusted Computing' Frequently Asked Questions"

»www.msfirefox.com/

Curiosity

join:2001-10-01
Dawson Creek, BC

reply to Grail Knight

said by Grail Knight:

Are you saying that Live Titles can not be turned off easily in Firefox as well as summeries?

Seems if you just change the bookmarks address to the Normal Url you will not have the summery or live marks.

As this is still in development there is no GUI for it but it is under development.

»blog.mozilla.com/faaborg/2006/12···-titles/

»wiki.mozilla.org/Microsummaries
If you mean live bookmarks, I just set up Firefox options - feeds section to "Subscribe using" and "No application selected". I do not get any live bookmarks.


Grail Knight
Who Dares Wins
Premium
join:2003-05-31
Valhalla
kudos:5

I think the OP is referring to something else but not sure as to what he is referring to.

I have Live Bookmarks disabled the same as you and use Sage for my RSS Reader.



Grail Knight
Who Dares Wins
Premium
join:2003-05-31
Valhalla
kudos:5
Reviews:
·Time Warner Cable

reply to Mele20
Nice pictures but I asked for a link.

You know that there are cookie handling extensions available that give you exactly what you want so your complaint is moot. Even your image issue is just that an issue you have that is easily fixed if you want.

Ever heard of CookieSafe? ImgLikeOpera?

Most people do not know how you have your cookie handling set up because most people are not concerned with cookies. A greater threat to your privacy is someone stealing your mail or having your credit card info stolen.

Did you look at the Microsummery links before you posted. Kind of early in development to judge something.

Seems Fx may be moving in a direction you can not handle.

You have choices though Mele. Opera, IE, either shell for IE (Maxthon/Avant/Slim Browser)or get a Mac and run Safari. I left a few browser out but you can look them up.
--
When the going gets tough the tough stop posting.



Grail Knight
Who Dares Wins
Premium
join:2003-05-31
Valhalla
kudos:5

reply to hpguru
You should voice your concerns to Mozilla and see what they have to say. They are requesting testing of this feature as it is in beta still.


BandHeight

join:2004-08-30

reply to Mele20

said by Mele20:

I would never check properties for a bookmark so I guess that weird microsummeries is no worry for me.
Why would you NEVER check bookmark properties? With the properties dialog, you can change the bookmark description, add or modify keywords and you can could check the underlying URL before accessing the site via the bookmark.

said by Mele20:

i tried doing a properties check on some bookmarks in both 1.5 and 2.0 to see what you were talking about. Sure enough, in some bookmarks in 2.0, clicking on properties gave me some dumb summary of the site ...

One of the bookmarks I tried in 2.0 that gave me the summary also popped up a cookie window! Inexcusable. And if you can't turn this off in about:config...well that is so bad as to make Fx 2.0 worthless SHIT.
As I've noted in this current thread and all previous ones linked here, the feature was implemented with version 2.0, so yes, you would not have noted its existence in version 1.5. Certainly, it is understandable that you would want to test for yourself, but I wanted to be as clear as possible.

Also, to be very clear, the microsummaries, as you found in your own testing, are currently being pushed out by a limited number of sites. However (and this is very important), checking a bookmark's properties ALWAYS establishes a connection to verify with the site whether a Live Summary is available or not. If it is available, it is downloaded. During this checking, content is still downloaded to cache and if the site sets a cookie, you will also be presented with that as well (how the cookie is handled depends on your normal FF cookie settings).

said by Mele20:

Have you asked about this at Mozillazine?

Edited to ask if you know if there are any bugs filed on this?
Seeing how this isn't a bug, but a deliberate feature, I doubt there are any bugs filed (unless someone has noted that their microsummaries aren't being downloaded properly. ).

Mele20
Premium
join:2001-06-05
Hilo, HI
kudos:4

reply to Grail Knight
»www.speakeasy.net/speedtest/

I assumed you'd know the address. Speakeasy used to have the best speed tests (justin's applet but allowing for MS JVM usage if done from Speakeasy site instead of here) for years until they went to Flash. I assumed you had done their tests at some time. (When I went to post this the site told me the link has been posted 476 times).

There is nothing that handles Persistent Storage unless you have cookies set as I do. And MoFo doesn't plan on giving users a GUI for it or even telling them about it. That sucks.

I don't need cookie handling extensions and no I have never heard of CookieSafe or ImgLikeOPera whatever that is. I fixed everything in about:config but I should not have to do that as these things should not have been removed from the GUI so that you have to hunt about to have the privacy that was right there in early versions of Fx. MoFo should certainly tell users about Persistent Storage and let them decide whether they want to allow it or not and what exactly they want allowed from sites. Sort of like how Flash does it.

Yes, I read the other thread about Microsummery. I mentioned that in my first post in this thread and said I would use one of the Proxo filters given there. I also read the link you gave to the four page thread at Mozillazine and read the bugzilla report, read the pages at »wiki.mozilla.org/Microsummaries/Using

According to the latter:

"When you bookmark a page that has a microsummary, the Name field in the Add Bookmark dialog window will turn into a menu:

If the Name field isn't a menu, no microsummaries are available for the page. Note that even if the field is a menu, you can always choose to just display the regular name (or any name of your choosing) by selecting that from the menu."

That Speakeasy bookmark has no Name field menu so why is it displaying a microsummary? I don't use live bookmarks so if I were to look at properties for a bookmark it certainly should not have any microsummery and should not contact the site. As I said earlier, I don't have any reason to look at a bookmark's properties so it is sort of moot as long I don't do that or incorporate one of the Proxo filters. But that is not really the point. It is the principle involved that I thought I had Live Bookmarks turned off ... it's a really ugh! feature IMO. Yet, turns out, you apparently can't completely turn it off...because there it is, invading your privacy with calling home, if you open properties on a bookmark. This, along with Persistent Storage and other things indicate that Fx is now focused not on the user and what is good for the user (privacy for one thing) but has become focused on commercialism and how much money it can generate for the developers. Web site owners are salivating at the idea of microsummeries. Ugh. Very invasive of privacy and it is this decision by MoFo to disrespect users privacy that offends and worries me. If some users don't care about their privacy and want microsummeries fine but these privacy invasion things should not be shoved down all Fx users throats. There should be choices. All I can say is THANK GOD for PROXO!
--
"If you want to do DRM on a PC then you need to treat the user as the enemy." Ross Anderson in "`Trusted Computing' Frequently Asked Questions"

»www.msfirefox.com/



Grail Knight
Who Dares Wins
Premium
join:2003-05-31
Valhalla
kudos:5
Reviews:
·Time Warner Cable


No Cookie
Never assume anything Mele.

I do not test my connection as I know it is working fine.

I just visited your site and the only cookie I was asked for was the site cookie.

I then deleted that cookie and right-clicked the properties of the cookie and I did not receive a request for a cookie. The Description was gone as soon as I deleted the cookie and has not come back even after checking the bookmarks properties.
--
When the going gets tough the tough stop posting.


Thursday, 09-Feb 18:07:44 Terms of Use & Privacy | feedback | contact | Hosting by nac.net - DSL,Hosting & Co-lo
over 12.5 years online! © 1999-2012 dslreports.com.
Most commented news this week
Hot Topics