Re: dns-prefetch
Daniel Veditz wrote: 4. Acknowledge privacy is dead and don't worry about it. I tend to like that solution, but as this weakness will allow email existence confirmation for spam senders, it's not really adequate here. ___ dev-security mailing list dev-security@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security
Re: dns-prefetch
Johnathan Nightingale wrote on 7/24/2009 9:26 AM: On regular http connections, this kind of disclosure is obviously inevitable since the page contents themselves are visible to eavesdroppers, but when the connection is over https, there is a reasonable expectation of some privacy, so we try to preserve it as much as possible. Great, thanks for the explanation. - Bil ___ dev-security mailing list dev-security@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security
Re: dns-prefetch
Johnathan Nightingale wrote: But with prefetch enabled, they could potentially harvest a significant amount of information about the contents of your emails by watching all the prefetch requests But it will be disclosed anyway if he actually follows the link. And I get a lot of spam from adultfriendfinder.com ;-) The most serious attack seem to me to be than the attacker can know *when* exactly you read any given mail. ___ dev-security mailing list dev-security@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security
Re: dns-prefetch
Jean-Marc Desperrier wrote on 7/24/2009 1:09 PM: The most serious attack seem to me to be than the attacker can know *when* exactly you read any given mail. I hadn't thought of that, but I do now see that as a reason to turn it off entirely for any messaging application. You're right, it wouldn't be too hard to marry wildcard DNS with specially-crafted tracking links to know when the user has viewed the message (which is why many messaging applications disable remote image fetching by default). - Bil ___ dev-security mailing list dev-security@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security
dns-prefetch
In [1], it's mentioned that: Furthermore, as a security measure, prefetching of embedded link hostnames is not done from documents loaded over https. If you want to allow it in that context too, just set the preference network.dns.disablePrefetchFromHTTPS to true. Can someone explain the security concerns with DNS prefetching from a HTTPS site? - Bil [1] http://bitsup.blogspot.com/2008/11/dns-prefetching-for-firefox.html ___ dev-security mailing list dev-security@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security
Re: dns-prefetch
On Thu, Jul 23, 2009 at 7:10 PM, Bil Corryb...@corry.biz wrote: Can someone explain the security concerns with DNS prefetching from a HTTPS site? The concern is privacy. Prefetching DNS for host names referenced in an HTTPS page leaks some info contained in that page. Wan-Teh ___ dev-security mailing list dev-security@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security
Re: dns-prefetch
Wan-Teh Chang wrote on 7/23/2009 9:29 PM: On Thu, Jul 23, 2009 at 7:10 PM, Bil Corryb...@corry.biz wrote: Can someone explain the security concerns with DNS prefetching from a HTTPS site? The concern is privacy. Prefetching DNS for host names referenced in an HTTPS page leaks some info contained in that page. Thanks for the response. Who is the data being leaked to? The DNS provider? The advisory sniffing packets off a public hotspot? And what information is being leaked? The hostname(s) that are referenced on the HTTPS page? I'm just trying to understand the complete risk involved. - Bil ___ dev-security mailing list dev-security@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security
