All Products Community Forum

Firefox security features warning on Linux doesn't explain what kind of file to add to apparmor.d/firefox-local. Is it a .txt file, or something else?

I've noticed that Mozilla products (firefox, thunderbird etc) all phone home all the time, which is a violation of both my security as well as privacy policy. In the firewall one can observe persistent, periodic, repeated connections to various non-sanctioned sites and services, apparently run by Mozilla. These include, but are not limited to:

• .mozgcp.net
• .services.mozilla.net

firefox-portal-detection.com etc.

Specifically, there are persistent, periodic and repeated connection attempts to (just copy/pasting from the first page of firewall report; there are many more as well as similar connection attempts from thunderbird as well): firefox-settings-attachments.cdn.mozilla.net:443 assets-prod.sumo.prod.webservices.mozgcp.net:443 content-signature-2.cdn.mozilla.net:443 push.services.mozilla.com:443 etc

These begin at the startup of the browser/mua and continue throughout the session. Given that none of the sites actually browsed have anything to do with mozilla per se, and given that various privacy-violating features such as DNS-over-HTTPS (yes, that's a not a privacy-enhancing feature but the opposite - it just shifts the surveillance point from the ISP to the DoH provider) and other similar "features" are disabled in-browser, there should be no user/browser connections attempted to mozilla servers.

Also, by setting up a local security MITM proxy in order to observe and analyze the content sent to and received from these services and configuring the browser to connect via the proxy, the browser seems to *stop* trying to connect to these services, which indicates *active* measures by the browser/mua to avoid it's browser-fingerprinting and location-revealing content from being intercepted and analyzed.

This is especially concerning as Mozilla actively brands and markets it's products as privacy-respecting, as for-user-rights and as away-from-big-tech-dominated. Consequently I perceive this as complete breach of trust. Even by just *attempting* such phone-home connections a leak of metadata occurs, identifying the IP, the browser and consequently the user and user's location, sometimes actively (such as was the case with now apparently discontinued location.services.mozilla.net). Combined with whatever content these connections carry, this constitutes a serious breach. And there seems to be no way for the user to configure the browser to stop making these connections, other than by using an external application firewall.

And to top it off, with Firefox version 155.0.1, the browser now outright refuses to connect to *any* sites at all if firefox.settings.services.mozilla.com:443, firefox-settings-attachments.cdn.mozilla.net:443, firefox-portal-detection.com:80 and content-signature-2.cdn.mozilla.net:443 are *externally* blocked, at least on that profile (which worked just fine prior to upgrade to 155.0.1), showing a spinner and waiting indefinitely (not even timing out). These are the *only* connections it even attempts, completely ignoring the actual site that it was told to connect to. So that's at least 4 privacy-violating, security-policy-violating phoning-home connection attempts and a complete disregard for user's actual, sanctioned connection request.

ok this is what firefox claims you sent me this (Dangerous and deceptive content is not blocked Your exposure to scams and malware from websites is increased.) ok so you need to tell me what these websites are what malware because i dont believe any pile of yahoos what they say ? what security clearance certs do you people have ? ill tell you none ! so take you little yellow triangle and stick it where the sun dont shine and also when you put it there i will never have to be annoyed byu it again because thats all it does its a god damm annoying piece of crap thatnk you hasve a nice day

Hello Mozilla Support, I am not experiencing a technical problem with Firefox. I am contacting you because I would like guidance on how to properly secure my browsing activity and protect my privacy while using Firefox on my Android phone. I want to make sure my browsing history, personal information, accounts, and other online activity are as private and secure as possible. Please explain the recommended Firefox privacy and security settings and any steps I should take to protect my activity. Thank you.

How do I keep my online banking private when using Firefox as my browser? When using Google Chrome as my browser, I use incognito, but I'm changing to Firefox and need to know that my online banking is safe.

I have VPN set to On on Firefox 155.0 on a phone with Android 14. This is the VPN now built into Firefox mobile, not the Mozilla VPN subscription. When I restart the phone VPN turns off. Is there a way to keep VPN on so I do not have to turn it back on each time I restart the phone? Also, VPN sometimes turns off, but not always, when I quit and reopen Firefox. I use Firefox in private browsing mode with the setting on to delete Delete browsing data on quit.

I have several websites in my own LAN. They run on HTTP. When I open one of these sites Firefox forces me to jump through hoops before I am allowed to open the intended webpage, because they are not running HTTPS, nor have a certificate. The security mechanism is valid for remote hosted websites, and I like the functionality.

But I own, operate and trust my LAN based websites, but I cannot prevent Firefox from complaining about them. I must do the song and dance to finally be able to open the webpage. All webbrowsers (Safari, Firefox, Chrome) do this, and it is very annoying

Solution: Allow the user to create a whitelist, either based on the website's ip adress, mDns name or blanket subnet. Come up with a solution that is easy for the user, and inspiring for your competition!

Hi I've been using add on Tab Mix - Rename Tab in the past and lately it's no working. Found reason to be permission for "Access local files on your computer", see attached

I can't remember what it was in previous version of Firefox, but want to know if it's safe to turn on permission, guessing there's a reason why it's now off, thanks

I'm getting popup ads that open a new page after I punch a link I hit the link and an unrelated page comes up inn addition to the link I intended to open. It even does that when I click on an email. Is there a way for me to stop this? This was happening before I upgraded to the version I'm on now.

I'm blaming the latest Firefox update from a couple of days ago, since this problem only arose yesterday. Now cut off from reading and following news that I really want to receive.

This is what I get when trying to access links within a few of the websites that I regularly access for links to articles it posts:

The site ahead may contain harmful programs

Firefox blocked this page because it might try to trick you into installing programs that harm your browsing experience (for example, by changing your homepage or showing extra ads on sites you visit).

Advisory provided by Google Safe Browsing.

I run Firefox on a retro Linux system that is currently running a personal "Frankenbuntu". Basically, Kubuntu 14.04 LTS with lots of components updated either "in-tree" or via a pkgsrc-like collection of "ports" installed under /opt/local that includes GTk3, Mesa, VAAPI plugins etc. I use that tree with a combination of built-in rpath settings (for apps installed under /opt/local) and wrapper scripts setting LD_LIBRARY_PATH, so as to maintain the possibility to run system apps independently, in particular while booting. (Sounds complicated, but it's also a rewarding fun project for me, allowing me to keep using an old and familiar DE with modern features on 2017 hardware,)

I have never yet dared to update my glibc from the stock 2.19, so with every Firefox update I fear to run into problems with that. I do have a 2.27 build but that is installed in another parallel prefix (/opt/glibc/2) because one cannot simply use LD_LIBRARY_PATH to use a newer glibc (I think because the ELF interpreter, ld-linux.so, has to match).

I already use patchelf with success to change the ELF interpreter to the 2.27 one, for instance with Ferdium, a Node/Electron application. This works and as far as I can tell, it will load all Mesa and DRI components from my /opt/local tree so hw-accelerated video works as it should.

But when I try this with Firefox, I get what appears to be a sandboxing issue when attempts are made to load Mesa DRI libraries: ``` libva info: VA-API version 1.24.0 libva info: Trying to open /opt/local/lib/dri/iHD_drv_video.so libva info: Found init function __vaDriverInit_1_23 [GFX1-]: VideoBridgeParent receives IPC close with reason=AbnormalShutdown MESA-LOADER: failed to open iris: libsensors.so.4: cannot open shared object file: Permission denied (search paths /opt/local/lib/dri, suffix _dri) failed to load driver: iris MESA-LOADER: failed to open kms_swrast: libsensors.so.4: cannot open shared object file: Permission denied (search paths /opt/local/lib/dri, suffix _dri) failed to load driver: kms_swrast MESA-LOADER: failed to open swrast: libsensors.so.4: cannot open shared object file: Permission denied (search paths /opt/local/lib/dri, suffix _dri) failed to load swrast driver libva info: VA-API version 1.24.0 libva info: Trying to open /opt/local/lib/dri/iHD_drv_video.so libva info: Found init function __vaDriverInit_1_23 [GFX1-]: VideoBridgeParent receives IPC close with reason=AbnormalShutdown ``` Copying libsensors into /opt/local/lib turns the above error into the same one about the next library available in the system (/lib/x86_64-linux-gnu/libtinfo.so.5). The DRI module I actually need (iHD) does load but I still get the GFX abnormal shutdown error. I've tried the interpreter change in other applications using libva and don't see the issue.

I do see this in the syslog: ``` Aug 31 15:18:47 Bmbl kernel: [2043645.959690] MediaSu~isor #1[17692]: segfault at 290 ip 00007f2b0815b284 sp 00007f2ad913e990 e rror 4 in ld-2.29.so[7f2b0814f000+21000] Aug 31 15:18:47 Bmbl kernel: [2043645.959702] Code: 04 49 83 fc 06 44 0f 44 c8 81 e6 ff 7f 00 00 45 89 8f 08 04 00 00 48 8d 04 76 4d 89 b7 00 04 00 00 4c 8d 04 c7 4d 85 c0 74 0f <41> 8b 48 08 b8 00 00 00 00 85 c9 4c 0f 44 c0 41 8b 3e 6a 00 48 8d Aug 31 15:18:47 Bmbl kernel: [2043646.080407] MediaSu~isor #1[17732]: segfault at 290 ip 00007f2b0815b284 sp 00007f2ad913e990 e rror 4 in ld-2.29.so[7f2b0814f000+21000] ```

Any idea why this is, and what can be done to prevent this, beyond actually updating my system glibc? I'd have no problems disabling sandboxing.