Can't stop Firefox background connections

[emanruse]

Using tcpdump I notice that Firefox continues to make background connections regardless of the fact that I use this user.js. I even tried the additional privacy settings suggested at https://wiki.archlinux.org/index.php/Firefox/Privacy (except those for omni.ja) but still, the moment I start Firefox (which shows nothing but about:blank tab) tcpdump shows:

...
IP mycomputer.53304 > server-143-204-209-52.fra53.r.cloudfront.net.https: tcp 31
IP mycomputer.53302 > server-143-204-209-52.fra53.r.cloudfront.net.https: tcp 24
IP mycomputer.53302 > server-143-204-209-52.fra53.r.cloudfront.net.https: tcp 0
IP mycomputer.53302 > server-143-204-209-52.fra53.r.cloudfront.net.https: tcp 0
IP mycomputer.53304 > server-143-204-209-52.fra53.r.cloudfront.net.https: tcp 0
IP mycomputer.53304 > server-143-204-209-52.fra53.r.cloudfront.net.https: tcp 0
IP mycomputer.53304 > server-143-204-209-52.fra53.r.cloudfront.net.https: tcp 0
IP mycomputer.53304 > server-143-204-209-52.fra53.r.cloudfront.net.https: tcp 0
IP mycomputer.53304 > server-143-204-209-52.fra53.r.cloudfront.net.https: tcp 0
IP mycomputer.53302 > server-143-204-209-52.fra53.r.cloudfront.net.https: tcp 0
IP mycomputer.38710 > server-52-85-121-65.bud50.r.cloudfront.net.https: tcp 0
IP mycomputer.38710 > server-52-85-121-65.bud50.r.cloudfront.net.https: tcp 0
IP mycomputer.38710 > server-52-85-121-65.bud50.r.cloudfront.net.https: tcp 513
IP mycomputer.38710 > server-52-85-121-65.bud50.r.cloudfront.net.https: tcp 0
IP mycomputer.38710 > server-52-85-121-65.bud50.r.cloudfront.net.https: tcp 0
...

Why is this happening? (even without extensions)

I don't want to announce to Amazon (or anyone else) "Hey, I have just started my browser, here is my IP address (personal data as per GDPR) for your purposes". I want to connect only to the websites I explicitly type in the URL bar.

[pyllyukko]

Have you manually disabled tracking protection? Even after that Firefox seems to make some automatic connections to places like detectportal.firefox.com. Are you sure those are from Firefox as tcpdump shows all connections from your host?

You can check the DNS queries made before those connections for more clues what are those particular connections.

[emanruse]

Have you manually disabled tracking protection?

I have all these: user_pref("privacy.trackingprotection.annotate_channels", false); user_pref("privacy.trackingprotection.enabled", false); user_pref("privacy.trackingprotection.pbmode.enabled", false); user_pref("privacy.trackingprotection.fingerprinting.enabled", false); user_pref("privacy.trackingprotection.socialtracking.enabled", false); user_pref("privacy.trackingprotection.cryptomining.enabled", false);

Even after that Firefox seems to make some automatic connections to places like `detectportal.firefox.com`.

So what should one do?

Are you sure those are from Firefox as `tcpdump` shows all connections from your host?

Yes, I am sure. I have taken care to test correctly.

[emanruse]

Can anyone please suggest how to block all background connections?

[pyllyukko]

Can you provide the DNS requests happening before these connections so we can narrow down the culprits?

[emanruse]

Could you explain how to do this?

[Atavic]

Hi, I can't see browser.selfsupport.url in current user.js
According to mozilla support that entry is responsible for startup persistent connections.

BTW for a non-backgorund connections setup, check about:networking while disconnected; then remove URLs via about:config

[emanruse]

Hi, I can't see **browser.selfsupport.url** in current user.js According to [mozilla support](https://support.mozilla.org/en-US/questions/1076594) that entry is responsible for startup persistent connections.

I tested that too. It changes nothing (plus the setting seems outdated). Background connections still happen.

BTW for a non-backgorund connections setup, check **about:networking** while disconnected; then remove URLs via about:config

I played a lot with that and unfortunately background connections still happen. My findings: 1. Disabling (and setting URLs to empty strings) anything pocket-related doesn't stop the background connections. 2. Setting network.dns.disabled to false stops background connections, but it stops DNS resolving too, so practically the browser becomes useless. Using -jsconsole command line option to see exactly what happens I noticed XHR connections to https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2021-06-11-15-04-32.chain on each browser start (and afterwards too). I couldn't find a similar URL in about:config. It seems some certificate file is downloaded and I have no idea why it should be requested again and again. To rule out any possibility of another *.cdn.mozilla.* URL affecting this I replaced all "cdn.mozilla" with "xdn.mozilla" in about:config. Even that didn't help, so I restored them. After all that I "took the big hammer" and edited my /etc/hosts adding a line: 0.0.0.0 content-signature-2.cdn.mozilla.net Result: no more background connections to that host. I understand this is an ugly approach and I wish there was a more elegant one. Unfortunately I couldn't find any. I hope someone more knowledgeable can look into this and probably propose a better solution. * During one of my tests I also noticed connections to 1.2.3.4.bc.googleusercontent.com (1.2.3.4 being some other IP address). I have no clue what this might be related to. All this happened without opening any URLs at all.

[pyllyukko]

Could you explain how to do this?

tcpdump -i any -n 'port 53' or using Wireshark.

[emanruse]

tcpdump -i any -n 'port 53' -t gives: wlan0 Out IP 192.168.43.196.44037 > 192.168.43.1.53: 43937+ A? content-signature-2.cdn.mozilla.net. (53) wlan0 In IP 192.168.43.1.53 > 192.168.43.196.44037: 43937 5/0/0 CNAME d2nxq2uap88usk.cloudfront.net., A 52.84.118.59, A 52.84.118.121, A 52.84.118.42, A 52.84.118.5 (157)

[Atavic]

[https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2021-06-11-15-04-32.chain](The URI) lists 3 certificates:

remote-settings.content-signature.mozilla.org
Content Signing Intermediate/emailAddress=foxsec@mozilla.com
root-ca-production-amo

You can view source and check CRT with these services:
www.view-page-source.com/
www.sslshopper.com/certificate-decoder.html

You may get errors in the future when the Certificates expire.

[Atavic]

2nd CRT appears in autograph and everything is hosted by amazon

Reddit linked to this

[emanruse]

Thanks for the links. The main issue remains though: I don't want to tell Amazon (or anyone else) each and every time I run my browser "Hey, I am online, here is my IP address and the exact time I connected for your needs". That's personal data and as per GDPR I have the legal right NOT to give it to Amazon without that affecting the way I use my browser to connect to non-Amazon hosts. A browser like Ungoogled Chromium (or lynx) does not connect to anything in order to function without any errors due to expiry of a certificate. Why should the "privacy respecting" (and additionally fine tuned by this user.js) Firefox made by the "non-profit" Mozilla Foundation do the opposite? There must be a way to avoid that without privacy or security compromises. Would you agree?

[Atavic]

Totally.
You can:

• reduce the trustwothiness of the many certificates present by default. Same goes with systems as a whole, see here
• The best source I have found about this is @ScottHelme , who says that revocation-checking-is-pointless
• Lastly, obfuscasting the User Agent String has lost interst for most people, but it's still useful in limited cases. Check Eclipsed Moon addon for Palemoon/Mypal in Smart mode if interested.

[emanruse]

Thanks for the info.

- reduce the trustwothiness of the many certificates present by default

How do I do this?

Same goes with systems as a whole, see here

That article is for Windows. How do I do this on Linux?

- The best source I have found about this is @ScottHelme , who says that revocation-checking-is-pointless

I don't see content-signature-2.cdn.mozilla.net on any of his lists. Or what am I missing? Will any of the things you mention remove the unwanted background connections Firefox makes?