Dear Maintainer,

This is related to mozilla bug 814169, Where a user using default
settings hover over a link without clicking on it ( which trigger  a link prefetch case). this will leak device
information and provide access to user wallet.

Many services are pay per use, and merely clinking on a link will cause
the provider to sucbsribe to the services. And in cases of pay per-ad this
will cause unwanted charges for the user.

I belive that at least network-prefetch-next and network.http.speculative-parallel-limit should be disabled by default.

https://bugzilla.mozilla.org/show_bug.cgi?id=814169 the workarounds for
that bug is to disable the network-prefetch-next and network.http.speculative-parallel-limit

retitle 795576 iceweasel: Supports prefetching links on hover
severity 795576 wishlist
tags 795576 - security
thanks

(I'll leave it to the maintainer to tag this wontfix.)

Which is closed as wontfix.

No, it won't.  It will fetch a URL.  Nothing more.  That does not
"provide access to user wallet".  And any site that's using prefetching
could just as easily load the page in the background in many other ways.

No site should make it possible to trigger unsafe actions via a GET; if
they do, then that site has a security hole.  Prefetch itself does not
change that site security hole.

Feel free to do so on your own system.  This is not something Debian
should change.  And even for systems like Tails or TorBrowser that takes
extra steps to attempt to provide client anonymity, or other mechanisms
provided by custom browsers/extensions, the prefetched requests go
through the same anonymity mechanism and should remain equally
protected, so turning them off seems unlikely to improve security.

- Josh Triplett

The mentioned prefetch doesn't even do a GET. It does a DNS request and
opens a TCP connection (and I think, in the HTTPS case, does the SSL
handshake).

Mike

Even better, then.  Thanks for the clarification.

- Josh Triplett