Firefox's massive overhaul moves to beta

FF 38.0 Stable Portable updated this morning via Portableapps.

 

Wow firefox 38 overrides web site abuse of disabling password field auto fill, I always considered that fake security and it made users more exposed to keyloggers and using weak passwords, it seems Mozilla agrees and they have removed the function from the browser for username and password fields

 

Firefox is going worse and worse these days

 

Blocking "tiles.services.mozilla.com" in the behind-the-scene scope (uBlock or uMatrix) should foil that Firefox data-mining. Examples of what can be see in the behind-the-scene scope when clicking on a tile from New Tab:

https://tiles.services.mozilla.com/v2/links/click
https://tiles.services.mozilla.com/v2/links/view

 

Unfortunately this doesn't work for me in Nightly 41.0a1. Although "tiles.services.mozilla.com" is blocked in the behind-the-scene scope of uMatrix, the tiles are shown in the new tab and open normally when I click on them.

 

@summerheat: You say the host is blocked, and I'm assuming those red entries are consistent with blocking. Note that tiles.services.mozilla.com is used to fetch special tiles and also to report tile activity to Mozilla. Assuming no special tiles were distributed with the build and no special tiles were retrieved from tiles.services.mozilla.com prior to blocking that host, you shouldn't see any of those tiles. However, you would still see the normal history tiles. Are you sure you are seeing something that is unexpected?

 

Haven't used stupid tiles since they came out and I still don't. It's the first thing I turn off when I install firefox.

about:config -> browser.newtab.url -> about:blank

**possibly offensive phrases removed** I often check various things through Google, last time I was in a discussion about infectious diseases, evolution and **** and after googling few nasty things, I'd end up having all this weird stuff nicely thumbnailed WITH IMAGES on the front page of the browser. Like WHY!? If I want quick to reach data, I use damn bookmarks. That's why they are there. Sometimes I wonder what moron makes GUI decisions in high profile apps like Firefox browser that is used by millions...

 

Okay, what I'm seeing is this:



These tiles are not based on my browsing history. So I might have misunderstood gorhill's remark. Thanks for your hint!

 

Not yet, it's still in the dev release, I believe.

 

I don't know if you did misunderstand anything. I just felt that some things needed to be made explicit. Those tiles you showed all appear to be special tiles that would have come from Mozilla. Having clarified that, the question becomes: how did they come to be on your machine?

1. Were they bundled with your install? I'm thinking no for a couple of reasons, but bottom line is I'm not 100% positive this isn't being done.
   
2. Were they retrieved from tiles.services.mozilla.com BEFORE you configured uMatrix to block that host? This seems the most likely to me but I'm not in the position to know.
   
3. Some other explanation, such as uMatrix failing to actually block the site it should have or your build downloading tiles from some place else or whatever.

Did you determine the cause?

 

Another way this advertising system could leak info to Mozilla would be through telemetry like mechanisms. I haven't tried to inventory the datapoints they are currently collecting, but I did stumble across a disturbing telemetry experiment listed at https://telemetry-experiment.cdn.mozilla.net/:

It appears that their objective was to collect information about normal history tiles and top sites. I think someone glancing at the bug report would have realized the potential to reveal some private and sensitive information to Mozilla. If that wasn't enough, Ed Lee ("Tiles guy") posted sample output that literally showed the capturing of financial websites. Yet Benjamin Smedberg ("Engineering Manager") responded "strikes a good balance of privacy versus getting useful data"

People often test beta builds against the websites they normally use in order to make sure things work. Some literally use beta builds as if they were regular builds in order to do more extensive testing. Since many sites use subdomains for login purposes and some often visit (if not pin) those sites, I think the experiment would have explicitly revealed some of the financial, etc sites that experiment victims log into.

FWIW, that particular experiment appears hard coded to send data to tiles.services.mozilla.com. It is the general security/privacy threat posed by telemetry, health report, experiment, and similar mechanisms that is the issue though, and some other servers are involved. Make sure you have things locked down BEFORE you allow applications to have a network connection!

 

Not really. First of all, I should have mentioned that I've selected "Clear history when Nightly closes" which includes browsing history. So there's not really a browsing history that could be (ab)used for ads. That's why I always see the tiles shown in my previous post when I start Nightly. After surfing some hours there are one or two new tiles if I open a new tab - but those are no ads but sites I had visited before during the current browsing session.

I'm using Nightly with the profile I had used before with my "non-Nightly" Firefox. And I had blocked behind-the-scene requests (and hence tiles.services.mozilla) in uMatrix before by default. I guess I should try to temporarily allow those requests to see what happens.

 

FF38 has Tiles based upon sites visited ...No data is collected when a user deactivates the Enhanced Tiles experience.
https://www.mozilla.org/en-US/firefox/tiles/
I expect FF39 Tiles based upon Firefox suggestion and I expect turn Off in Options.
I wonder if I turn Off all Advanced Data Choices whether FF still collects data from Tiles.

 

Introducing Extension Signing: A Safer Add-on Experience

https://blog.mozilla.org/addons/2015/02/10/extension-signing-safer-experience/

I had nineteen signed extension updates today.

 

I think the Advanced Data Choices are for Telemetry, Health Report, and Crash Reporter only. So if you disable those then no tile related information should be sent to Mozilla *via those mechanisms*. However, the New Tab Page mechanisms appear to be [mostly] separate and separately controlled.

Of course, what we're seeing now are the early variants. It will probably evolve over the months and years to come.

 

I had nine. NoScript not as yet.
Anyone know if digitally signed vendor extensions will display .1-signed. eg: Norton Toolbar
Anyone know if plugins will display .1-signed. eg: Flash

 

When will be the first 64-bit stable release?
And will a Firefox update give you a choice to go to 64-bit?
How will it that work? I am guessing we will have to uninstall Firefox 32-bit.

I am also using Cyberfox 64-bit Intel Optimized, and it flies in comparison to Firefox 32-bit.

 

OK. Thanks JRViejo.
It can't be far off.
I guess it will be an uninstall job to switch to 64-bit.