Where is Wally? Firefox, HTML5 and Google know this

If we blindfolded Wally, took him incognito to a certain small town in Jaén and once there, in an isolated room and already with his eyes uncovered, we let him perform some Searches on Google with a laptop and a Firefox more or less updated, he would see in the left margin of the search window something that could initially question his own self-esteem: Guarromán. Even if you were doing new searches, again and again the same little word would appear in the results window, on your left. But Wally would breathe a sigh of relief when it was explained to him that Guarromán was the name of the town in which he was located and that it appeared even in Wikipedia itself. Yes, he would breathe a sigh of relief only until he realized that Google was also transmitting to him next to the search results, subliminally, the following message: "Be very careful about what you do on the Internet, that we know where you are"...

We're going to do like Wally and use that same laptop in Guarromán. In the left margin of the search window in Google.es we see a series of options: Everything, Images, Video, News ... and below our location, the village from which we connect.

Also immediately after we see that Google offers us the possibility of "Change location", only if Firefox has JavaScript activated, but as soon as we perform a "Clean the history" and access a new search in Google.es Guarromán will inevitably come out. Why?... why would I think to ask "Why"?
The version of Firefox that we are using is 3.6.19 and one of its features is to use HTML5. If we look in the section "New APIs and Javascript" we will see in its third and fifth points:

"3º=> Geopositioning API for devices that support it.
5º=> FUTURE STANDARD. System Information API. Access to hardware at a low level: network, files, CPU, Memory, USB ports, cameras, microphones... very interesting but with numerous safety caveats."

(On this last point better not to think.)

For Google to detect that we are in Guarromán, will that geopositioning API have to do with anything? Let's look at the "Deployment in web browsers" section of Wikipedia: since version 3.5 it has been applied in Firefox! What Mozilla says on this subject has no waste... and without GPS!:

- Publicidad -

a) "Firefox collects information about nearby wireless access points and the IP address of your computer. Firefox then sends this information to the default geolocation service provider, Google Location Services, to get an estimate of your location. That estimate of your location is then sent to the website that requested it."
(b) "Accuracy varies considerably from location to location. In some places, our service providers can provide a location with an accuracy of a few meters."
c) "By default, Firefox uses Google Location Services to determine your location by sending:
* The IP address of your computer.
* Information about nearby wireless access points.
* A random client ID, which is assigned by Google, expires every 2 weeks."

As apparently that "random client identifier" is in a cookie has nothing to do with the ten-digit number assigned by Firefox-Google and reflected in the entry
user_pref("urlclassifier.keyupdatetime.https://sb-ssl.google.com/safebrowsing/newkey", 1xxxxxxxxx);
that we can see if we edit the Prefs configuration file.js of Firefox (http://kb.mozillazine.org/Urlclassifier.keyupdatetime.*).

Even if we deactivate in Options => Security => the boxes "Block sites reported as attackers" and "Block sites reported as counterfeit" what we would get is, in theory, that our browser does not make frequent feedback with Google looking for updates and that the assigned number does not vary and is fixed. To make it clearer, that number, whether fixed, variable or modified by hand by editing Prefs.js, will always constitute one more data that will identify us. What if we deleted that prefs entry.js? Well, when you start Firefox, a new key will be created and we will be in them (by the way, the key can only start with 1 or 2). How curious.

Curious because Firefox presents two entries that coincide in the quantity (10 numbers) and the same figures, although they are not the same as the newkey that we talked about before:
- places.last_vacuum
- idle.lastDailyNotification

Since the value as an integer of these two entries is, for example, that of 1314014967, if we visit http://www.onlineconversion.com/unix_time.htm we will see that the utility 'Convert Unix timestamp to Readable Date/time' converts that 10-digit number into 'Mon, 22 Aug 2011 12:09:27 GMT'. Therefore the value of 'newkey' could well reflect something similar since it only allows to start the 10 figures by 1 or by 2.

This is a mess, right? Well, to try to get something clear from all this gibberish it will be better to start from scratch. We have a recovery image of the operating system partition, we have uninstalled Firefox deleting personal data and preferences (this option is offered during the process), deleted all those remaining folders that have the name Firefox or Mozilla and also those registry entries that have something to do with both words (which will be kicked, so in principle we will concentrate on those that we believe are most relevant). A visit to ftp://ftp.mozilla.org/pub/firefox/releases/3.6.20/win32/es-ES/ and downloaded the latest version of series 3; today it is the "Firefox Setup 3.6.20.exe" file. We perform the installation disconnected from the internet with the wifi of the router and laptop turned off. We configure Firefox by disabling JavaScript in Tools => Options => Content (in this version the option to disable Java is no longer offered) and in Tools => Add-ons => Plugins => we deactivate them all except the Mozilla Default Plug-In. And now comes the good thing: we are going to finish configuring the browser to sack and without contemplation.

A) Removal (yes, as it sounds) of GPSDGeolocationProvider.js and NetworkGeolocationProvider files.js.B) We open Firefox, type about:config and enter. As the entries appear in alphabetical order it will be easy to locate and modify them with double click:
- geo.enabled => true is changed to false
- geo.wifi.uri => is changed http://www.google.com/loc/json to http://about:blank
- all entries privacy.clearOnShutdown.xxxxxxx => must be set to true
- all entries privacy.cpd.xxxxxxx => must be set to true
- close Firefox.C) We now search for the Firefox file.js and edit it (Notepad++ is a perfect program for these things). We locate the entrance
- pref("geo.wifi.uri", "https://www.google.com/loc/json");
and we leave it as
pref("geo.wifi.uri", "http://about:blank");
We save.D) Edit All.js and look for the entry
pref("geo.enabled", true);
and we leave it as
pref("geo.enabled", false);
Keep.
We already have Firefox configured and JavaScript disabled. Now we will try to connect to the internet with the wifi of the laptop and the router turned off, connecting the laptop to the router with a network cable. We enter http://www.google.es and start looking for any word: the results come out immediately and... ¡zas!, ¡Guarromán!. Uaaarghhh!.

Frustrating. I don't know where but the first thing that comes to mind is that somewhere on the Google/Firefox hard drive they have stored that data. Either that or maybe that:

the Internet access provider has distributed its IP addresses by ranges (IPs between such and such) so that each city is assigned one of them and that information is provided to Google, directly or indirectly, so that it has us identified. GoogleEarth, which is also installed, make your own.en Google have a specialized unit of men staring at the goats.
But after diving a little through the pages http://www.maxmind.com/app/ip-location and http://www.maxmind.com/app/ip-locate I almost believe the distribution of IP addresses by cities (or streets) by our internet access providers.
Is there a solution to feel well hidden and protected in our homes? Seen what has been seen, it seems not. Well, better say that there is a solution but it is of the type "eyes that do not see, heart that does not feel":
we can perform Google searches from the address http://www.google.com/ncrpodemos install the extension / addon 'Hide Google Options' (http://www.seotoolset.com/tools/free_tools.html) or we can navigate using the latest version of Firefox 2, 2.0.0.20, which does not have HTML5 or show the location. The problem is that many of the extensions/addons we're used to won't work.
Conclusion: they locate us, we are lost.

[...]

- Publicidad -

Source: Kriptopolis

See original.