How to fix strange connection to 1e100.net

[mant]

I run Firefox and do nothing, just watching my Firewall log

It's strange connection to:

pv-in-f190.1e100.net
yo-in-f104.1e100.net
pv-in-f133.1e100.net
...etc. (https or http).




I try disabling all addons, but it's still happened.
It seems Google spy's things, I scan no malware detected.

Anybody?

[trolly]

Google Earth or Google Analytic?
http://www.dslreports.com/forum/r232201 ... et-on-boot

[mant]

Hello, thanks for the link and i keep following it.

1. Yes, Google Earth installed in my PC (not running it).
2. No, Google Analytic not installed in my PC (don't know what it is).



I don't have any suspicious process running.



I don't have 3rdparty's toolbars searchbars etc.




So, it's really strange.

[mant]

I fix it.

Using HttpFox, I found it's about Google Safebrowsing



Then I go to about:config to disable browser.safebrowsing




NO STRANGE CONNECTION ANYMORE!

[trolly]

You know what safe browsing is? Disabling it may increase the risk of getting infected.

[mant]

Thanks, I don't know that.
Btw, I found this article.



Why The Fool blocks Google Safe-Browsing
August 29, 2009 · Filed Under Networking, News

The Fool is an Italian start-up founded by Matteo Flora, a security consultant known for having helped Silvio Berlusconi’s Mediaset to put together the data required to bring a 500 million euros lawsuit against Google and YouTube in July 2008. On the blog of FoolDNS, the main product offered by The Fool, the company has recently explained the reasons why Google Safe-Browsing is part of the service blacklist hence it is blocked for users and companies which use it.

FoolDNS is a website filtering and Internet usage monitoring system working at the DNS level, likewise to other services as the well known OpenDNS. Google Safe-Browsing, on the other hand, started as an optional add-on for Mozilla Firefox and eventually turned into an anti-phishing and anti-malware API-based service, currently implemented on Firefox, Safari and obviously the Google-browser Chrome.

“For years we said that SafeBrowsing is the main reason for the millionaire agreement between Mozilla Foundation and Google - the FoolDNS blog states - because the system allows to trace the behaviours of single users behind any IP effectively allowing the user identification by his browser’s UniqueID even after Cookies deletion and roaming between home and office“.



The Italian company says that, essentially, Google uses and abuses the (real) protection offered by Safe-Browsing to have the chance to (presumably) track users in a univocal way, without depending on cookies or other temporary identification systems that are easy to bypass. To corroborate its theory, FoolDNS quotes “the very highly esteemed” site Ha.ckers.org in a post that highlights the oddities of Safe-Browsing’s home-phoning system.

“When I started looking at Chrome I noticed two additional pieces of information that were being phoned home outside of Safe Browsing” the Ha.ckers.org post says. This two extra data pieces, tagged machineid and userid, “both computed information based on machine/user information“, and were sent together with other data useful to Google to decide if there was the need of a protection update.

“The real question“, the post continues, is “why would Google need to know my machineid and userid to give me an update - wouldn’t the version number of my browser be enough to make that decision? I just can’t believe this isn’t used for tracking“. “There’s no more plausible deniability“, Ha.ckers.org and FoolDNS say together, Google Safe-Browsing is “a perfect way to spy on people” by exploiting the browser against users in the name of security.

The conclusion of the post is that “Safe Browsing is a great feature since it protects you from phishing and malware sites“, but despite of what stated in the Google privacy policy, facing a law court order Mountain View would be obliged to blurt out everything the company knows about a particular user, including the eventual tracking data gathered up to that time. On Firefox it is possible to disable the service to protect one’s own privacy, but as of Chrome the only useful advice is “don’t use it“.

[trolly]

There is always one you have to trust. Your ISP for example can store all your browsing information, much more than Google is able to get at all. And several governments are trying to get these information.

[Jim too]

I run Firefox and do nothing, just watching my Firewall log

It's strange connection to:

pv-in-f190.1e100.net
yo-in-f104.1e100.net
pv-in-f133.1e100.net
...etc. (https or http).




I try disabling all addons, but it's still happened.
It seems Google spy's things, I scan no malware detected.

Anybody?

This is actually Mozillazine using googlesyndication.com (either directly or indirectly). Using noscript, if I don't allow googlesyndication.com I don't see the connections to 1e100.net IP addresses. As soon as I allow googlesyndication.com I see lots of connections establish.

Edit.
You are correct that one or two connections are the google safebrowsing mechanism within Firefox. The Googlesyndication connections number in the 50-100 range, not the 2-3 I see with safebrowsing.

[mant]

Hi, it's done, and nothing to do with Mozillazine (not visiting any webpage).