Firefox 3.5 and DNS Prefetches
Perhaps not a very new feature, but Firefox 3.5 prefetches de DNS results of all links on a page.
What does this mean? That firefox does a lot of DNS requests in cleartext(no encryption) for all links in a website, even if the page itself is encrypted, on a local network or is a local file. When viewing secure pages it then leaks information on what page you are looking at (e.a. if you do a lot of .indymedia.org dns requests, you’re probably looking at the indymedia.nl frontpage), same for pages on an intranet.
For people using webmail, this also means someone(for instance a spammer) can implement a callback/phonehome method by putting a domainname in the mail and whith a 0 cache value.
I’d consider this a bad policy, luckily you can turn it off, but not too easy.
A short howto:
go to the page “about:config”, it might give you a warning about voiding your waranty, I don’t think you have any anyway, so go ahead.
- Rightclick on something white in the page and select new->boolean
- Name the boolean: network.dns.disablePrefetch
- Set the value to True
- Rightclick again on something white and select again new->boolean
- Name the boolean: network.dns.disablePrefetchFromHTTPS
- set the value to True
If you now type network.dns in the filter you should see 2 entries in bold with the names you’ve given them (network.dns.disablePrefetch and network.dns.disablePrefetchFromHTTPS) of the type ‘boolean’ with the values set to ‘true’. Your firefox should now no longer try to fetch lots dns results and it’ll improve your privacy a little bit.
For those running apache webservers, you can control it from the server-side by doing the following:
- Enable mod_headers (a2enmod headers)
- Add this line to your apache or virtual host configuration: Header add x-dns-prefetch-control “off”
- Restart your webserver
For those only having control over the HTML you can add the following to your <head></head> section:
<meta http-equiv="x-dns-prefetch-control" content="off">








