Google could be keeping track of the time you spend online through Firefox

Firefox seems to be giving Google some pretty revealing information in regular updates, even when you're not visiting Google.

Opening up Wireshark (formely Ethereal) and examining network traffic going through my machine I've noticed time and time again, HTTP requests to Google even when Firefox is sitting idle. I attributed this to having Gmail open, thinking it must be one of those Javascript Remoting calls or XMLHttpRequests going on in the background.

Today I noticed it again, and realized that I only had a page on my local web server open. It definitely could not be sending HTTP requests to Google.

Filtering out just the single TCP request revealed this:

GET /safebrowsing/update?client=navclient-auto-ffox&appver=2.0.0.13&version=goog-white-domain:1:30,goog-white-url:1:371,goog-black-url:1:20001,goog-black-enchash:1:48465 HTTP/1.1
Host: sb.google.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.13) Gecko/20080311 Firefox/2.0.0.13
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: SID=<snip>; MPRF=<snip>; NID=9=<snip>; PREF=ID=<snip>:TM=<snip>:LM=<snip>:DV=<snip>:GM=<snip>:IG=<snip>:S=<snip>; rememberme=<snip>
Cache-Control: max-age=0

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Cache-Control: public,max-age=600
Content-Encoding: gzip
Server: TrustRank Frontend
Content-Length: 2766
Date: Thu, 10 Apr 2008 15:19:52 GMT

..........MW...H.]....G.B...R-.$..1.
.Z%&.........%u.X.....q...>...+.....5I.
..........4...}S.
0...Y"sPV..e..."...x...9.n..Xq..v..<.. G..^..)..i.?.=.o. <snip>

What happens is every now and then, Firefox Polls Google with a HTTP Request for updates on phishing sites, which is really nice. Google probably has the largest database on phishing sites, and it is nice that they are "helping" us out by keeping our Firefox browser updated on the latest phishing sites being found in its extensive indexes.

Now if we look at the HTTP request, nothing fancy, just the HTTP request headers, HTTP Response with Gzip encoded body. (If you decode the Gzip encoded body it is easier to see its data on the latest Phishing sites - the GET URI suggest that too.

The fun part is in the Cookies:

Cookie: SID=<snip>; MPRF=<snip>; NID=9=<snip>; PREF=ID=<snip>:TM=<snip>:LM=<snip>:DV=<snip>:GM=<snip>:IG=<snip>:S=<snip>; rememberme=<snip>

I've snipped the actual values of course. The SID we can safely assume is the google Application level session id due to its characteristics including its name, size of the hash etc. among others. What bugs me is that this SID ties this HTTP request to my Information in their database, my name, address, bank account etc. etc. The ID Cookie most likely holds non-authenticated session ID (one of those will). You can think of it as everything you have done on *.google.com, and now even when you're not on google, until you delete the cookies.

Note: the cookies aren't valid only on the host: sb.google.com, they are valid on google.com also as they are sent to .google.com. Which means any of the domains *.google.com will trigger Firefox to send the cookies. The cookies are set similar to below:

PREF=ID=<snip>:TM=<snip>:LM=<snip>:S=<snip>; expires=Sat, 10-Apr-2010 17:22:38 GMT; path=/; domain=.google.com

Notice when the cookies expire, in 2 years from now. So if you never delete your cookies, your activity is tracked for the next 2 years directly with these cookies.

With all of that said, let me stress that I'm not trying to sound any conspiracy theories here. It may very well be some technical limitation or a simple oversight. After all, Google already knows what you search for, what and who you e-mail, who you chat with and what you chat about, who you socialize with, what your social life looks like, what files are stored on your computer, what documents and spreadsheets you work on, what you blog about, what pictures you share, what you shop for, what newsgroups you read, what current events you keep up with, how you run your website, what stocks you monitor, what books you like to read, and, of course, what newsfeeds you read.

A similar find, Is Firefox/Google Spying on Your News Feeds? (Update), notes that at the time of the writing of that article, 2006, the cookies were being kept till 2038, nice...

Now why would google need to know all this just to update Firefox with phishing site information? I tried to think of a possible reasoning for this, but just couldn't. The closest I could think of is if Google could tell in advance using your SID what phishing sites you would most likely visit, only send the needed ones to Firefox. Whooowee.... if they could do that, then they definitely know too much.

There is no valid reason to send your SID, PREF, ID, and other information to Google just to update Firefox with phishing information. The HTTP request is initiated by Firefox, not the user. The update does not have anything to do with the users Google account or the Google Session.

Now in addition to everything else they know about you and me, they have Firefox updating them even when you're not on Google. Letting Google know when you're online. Now I'm a bit of a night owl, I don't want Google to know that... opps too late.

Lets hope this bug gets fixed soon...