Why Is NoSCRIPT Connecting to Third Party IPs upon Startup?
Why Is NoSCRIPT Connecting to Third Party IPs upon Startup?
I was watching my firewall's active connections list and noticed something peculiar. Even though I had a blank tab loaded in Firefox, firefox was still connecting to several IPs. So I started firefox in Safemode and discovered in Safemode it did not connect. So I disabled all the plugins and started enabling them one at a time. It turns out that only two addons were phoning home to various IPs and announcing my online presence and NoScript was the worst offender. Here is an example list of IPs NoScript connects to when simply firefox starts up and the truncated results of WHOIS searches on them.
-178.255.83.1 RIPE Network Coordination Centre (RIPE)
-69.195.158.195 Joe's Datacenter, LLC Kansas City
-173.239.79.210 Unwired Network Operations Center
-23.77.237.50 AKAMAI
What's going on here NoScript? Are you duping us all and it turns out you've been spyware all along? What is Joe's Datacenter?
I've used NoScript for years now and reaped the perceived benefits but has it been spyware all along? Just asking, not accusing. What is going on here? Not pleased.
-178.255.83.1 RIPE Network Coordination Centre (RIPE)
-69.195.158.195 Joe's Datacenter, LLC Kansas City
-173.239.79.210 Unwired Network Operations Center
-23.77.237.50 AKAMAI
What's going on here NoScript? Are you duping us all and it turns out you've been spyware all along? What is Joe's Datacenter?
I've used NoScript for years now and reaped the perceived benefits but has it been spyware all along? Just asking, not accusing. What is going on here? Not pleased.
Last edited by Csky on Wed Nov 04, 2015 6:44 pm, edited 2 times in total.
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0 IceDragon/26.0.0.2
Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start
That's Giorgio's own site and the associated OCSP server, contacted for obtaining your own WAN IP for the NoScript Options > ABE > WAN IP in LOCAL setting and validating the SSL certificate, respectively.
Not "spyware".
Not "spyware".
*Always* check the changelogs BEFORE updating that important software!
-
Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start
Right, that's what "phoning home means" and it is announcing each and every user's online presence as soon as they load up firefox. So what about the other three ips?barbaz wrote:That's Giorgio's own site and the associated OCSP server,Not "spyware".
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start
Does it matter in this case?Guest wrote:Right, that's what "phoning home means" and it is announcing each and every user's online presence as soon as they load up firefox.
http://www.informaction.com/index.php?page=privacy
Well, not sure.Guest wrote:So what about the other three ips?
I forgot that NoScript also contacts your own WAN IP , for fingerprinting so that it can protect it better. So one of them is just your own IP.
Some of them your DNS perhaps?
The OP said that some of the connections on startup are caused by another extension.. can you list the IP's you see, if different? Which of the IP's in the OP (if any) are NOT contacted if NoScript is disabled?
Oh and if this is a bigger deal to you than having your WAN IP protected, what happens if you set about:config > noscript.ABE.wanIpCheckURL to an empty string and disable WAN IP in LOCAL from NoScript Options > Advanced > ABE?
EDIT OK let me make this clearer.
-178.255.83.1 RIPE Network Coordination Centre (RIPE) = Comodo's OCSP server
-69.195.158.195 (I got 69.195.158.198 instead, but according to my DNS, same thing) Joe's Datacenter, LLC Kansas City = Giorgio's site, WAN IP check https://secure.informaction.com/ipecho/
My NoScript only connects to those two plus my WAN IP... so that's three connections, not five.
Again, are you SURE that these connections you mention are ALL NoScript?
EDIT2 Try a reverse DNS lookup on all those IP's. That is sometimes more informative than a WHOIS lookup.
EDIT3 @Csky: You might want to go to NoScript Options > Advanced > ABE, note the WAN IP displayed, and obscure that one in your post. That might make it easier to track down the two "rogue" connections.
*Always* check the changelogs BEFORE updating that important software!
-
Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start
Disable NoScript, restart FF & see what connects.
(There are all kinds of domains that FF connects to, by default, for all kinds of purposes. Update checks, blocklist update, telemetry data...)
(There are all kinds of domains that FF connects to, by default, for all kinds of purposes. Update checks, blocklist update, telemetry data...)
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball NoScript FlashGot AdblockPlus
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 SeaMonkey/2.33.1
Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start
@Csky: Looked it up - "AT&T Internet Services (SIS-80)" is apparently your own IP, you posted from that one. Feel free to obscure that IP in your post if you want, I'm deliberately going to avoid reposting it so that you can just do that when you want on your own.
173.239.79.210 = observatory6.eff.org
Got HTTPS Everywhere?
I've no idea the Akamai one. Possibly another OCSP server, hosted by Akamai?
173.239.79.210 = observatory6.eff.org
Got HTTPS Everywhere?
I've no idea the Akamai one. Possibly another OCSP server, hosted by Akamai?
*Always* check the changelogs BEFORE updating that important software!
-
Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start
Yes there was another addon that was connecting and I disabled it and eventually uninstalled it and did not list the IPS it was connecting to, just the ones NS was. It was a download manager to make firefox's new dm look like the old "Toolkit" one.barbaz wrote: I've no idea the Akamai one. Possibly another OCSP server, hosted by Akamai?
Akamai seems to be everywhere. To my understanding it a webhosting service that is analogous to a radio repeater intended to speed up internet traffic. I do not like it though. Often NS catches it, sometimes in-order to load a page I have to allow it. But I was surprised when I discovered NS using it.
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start
NoScript does not use Akamai as far as I know and as noted in my above post.
*Always* check the changelogs BEFORE updating that important software!
-
Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start
You said you had no idea which implies that it may or may not. Also getting a google connection now. No connections on startup now but now I am troubleshooting the ones while browsing that have nothing to do with where I am browsing. Also why is my browser version displaying below and how do I prevent that? I'm not a heavy user of forum boards.barbaz wrote:NoScript does not use Akamai as far as I know and as noted in my above post.
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start
I said I had no idea what it was. It doesn't imply that I think it could be NoScript related.Csky wrote:You said you had no idea
When I've seen that it's related to the browser's google safebrowsing featureCsky wrote:Also getting a google connection now.
It displays below as a diagnostic tool for us and there is no way to prevent display it. (Any site can see that info.)Csky wrote:Also why is my browser version displaying below and how do I prevent that?
Sometimes knowing a poster's browser/OS can make it a lot easier to help them.
*Always* check the changelogs BEFORE updating that important software!
-
Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start
Disable NoScript, restart FF & see what connects.
(There are all kinds of domains that FF connects to, by default, for all kinds of purposes. Update checks, blocklist update, telemetry data...)
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball NoScript FlashGot AdblockPlus
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 SeaMonkey/2.33.1
Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start
Thanks rube I already saw that. Please read the original post. It's how I discovered some of these connections were being made from NS and it does not answer my specific inquiry.therube wrote: Disable NoScript, restart FF & see what connects.
(There are all kinds of domains that FF connects to, by default, for all kinds of purposes. Update checks, blocklist update, telemetry data...)
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start
Well if you don't know then it could be. I'm just saying that is what is understood when you say you have no idea, that you do not know. In other words, you're now saying you do have an idea that it is at least not NS related. Ok I'm not here to give lessons in semantics, that's enough.barbaz wrote: I said I had no idea what it was. It doesn't imply that I think it could be NoScript related.
Do you know which one? Block reported attack sites or block forgeries? Probably both?When I've seen that it's related to the browser's google safebrowsing feature
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start
It's both of those (they're two separate databases).Csky wrote:Do you know which one? Block reported attack sites or block forgeries?
*Always* check the changelogs BEFORE updating that important software!
-
Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start
If I saw the browser making a connection to some random domain like cksks.soie.net, then I would have no idea what it was, but I would be pretty sure it was nothing to do with NoScript.Csky wrote:Well if you don't know then it could be.barbaz wrote: I said I had no idea what it was. It doesn't imply that I think it could be NoScript related.
Last edited by barbaz on Fri May 29, 2015 1:28 am, edited 1 time in total.
Reason: fix quote tags
Reason: fix quote tags
======
Thrawn
------------
Religion is not the opium of the masses. Daily life is the opium of the masses.
True religion, which dares to acknowledge death and challenge the way we live, is an attempt to wake up.
Thrawn
------------
Religion is not the opium of the masses. Daily life is the opium of the masses.
True religion, which dares to acknowledge death and challenge the way we live, is an attempt to wake up.
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0