1411347 - prefetch top sites loading in the background cannot be disabled or is undocumented

Status: RESOLVED WONTFIX

(Firefox :: New Tab Page, defect)

Description

[Robert]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.9) Gecko/20100101 Goanna/3.2 Firefox/45.9 PaleMoon/27.4.2
Build ID: 20170822051534

Steps to reproduce:

1. disable 'top sites' in a new tab of firefox (v55) that has a non-empty history
   a. newer major versions are likely effected too, but have not been tested
2. restart firefox
3. wait



Actual results:

AFAICT...
1. firefox attempts to load the top-sites/newtab panel in the background even though it has been disabled.
    a. this can probably be seen in the logging, network analyzer, or in our case...
2. whereas several 'top sites' require a username & password, the login credentials are then requested from the saved password system
3. since (in our case) access to these credentials is not freely accessible, the user is directly asked to grant access for the saved logins/passwords
4. This is repeated ... again, and again, and again... (i.e. for each top site)
5. and the users become quite nervous (authorizing a bunch of credentials to be released without any visible site requesting them)

Looking for a way to disable "top sites" or 'unwanted connections' until this can be otherwise addressed, I ran across this documentation which seemed relevant:
* https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections

However, it does not mention any way to disable the background loading of the topsites/newtab panels.



Expected results:

Ideally, firefox should not request credentials that it does not need (i.e. only anticipated), neither should it take action that would cause the user to believe that it is attempting to log into a site on his/her behalf (or worse, is compromised and leaking credentials).

Secondarily, disabling top-sites (at least across a restart) should actually inhibit top-site prefetching/rendering, etc.

Whereas I assume there must be an existing config item to disable this behavior (that I could not find), this is at least a documentation bug against the 'unwanted connections' page linked above.

It might also help to know if this issue has already been addressed in a newer version (as fedora is just now wading through v55).

Comment 1

[Robert]

Related to:
* bug 793115
* bug 1190168
* bug 1367259 (possible dupe? references several configs)

And lesser, to:
* bug 743613

Comment 3

[Darkspirit]

(In reply to Robert from comment #0)
> 1. disable 'top sites' in a new tab of firefox (v55) that has a non-empty history

IIUC:
1. Robert hides "Top Sites", so they don't get displayed anymore on about:newtab.
2. He restarts Firefox and sees connections to hosts, that would be shown under "Top Sites" if it was enabled.
3. He suggests that no connection to a Top Site should be made if "Top Sites" is hidden. No prefetch or whatever.

My bug 1367259 is about:
I used a feature on the old about:newtab which became "Top Sites" today.
I had uBlock Origin (and disabled speculative connections, prefetching etc. through it), which should lead to a behavior where a connection (and a thumbnail) is only made if I click on something. But I saw connections (to sites on about:newtab) that were not caused by a click from me.

Robert probably hasn't disabled prefetching etc., but he suggests that such connections to top sites should be only made if "Top Sites" is enabled.

Something that could be going on, but I don't know:
* He has a password manager webextension that thinks he wanted to visit hidden Top Sites.
* about:newtab tries to make newer thumbnails for hidden Top Sites that request HTTP Basic Auth.

Comment 4

[Darkspirit]

@ttaubert:

Connections (probably) happen on about:newtab
a) (this bug) to "Top Sites" (Activity Stream) even if they are disabled/hidden, and
b) (bug 1367259) to websites on the old about:newtab even if prefetching etc. was disabled.

Your old bug 793115 might be related to this.

(Tim Taubert [:ttaubert] from bug 1190168 comment 5)
> > Turning these pings/requests off would require changes to Firefox.
> Let's make those changes here.

(Tim Taubert [:ttaubert] from bug 1190168 comment 12)
> OTOH, when I turn the toggle off I expect that nothing about my newtab page is sent to Mozilla. That's the case that we in the past cared more about, respecting choice and privacy being the default. We have checkboxes in the Preferences' Privacy section to turn off Telemetry and FHR, but I can't do anything about newtab page pings? That seems very wrong to me.

Your comments from bug 1190168 look to me as you could understand what's going on and what should happen.
Could you please take a short look? Thank you.

Comment 5

[Tim Taubert [:ttaubert] (inactive)]

Sorry, haven't worked on this feature or looked at it for years. Not sure who maintains it these days...

Comment 6

[Andrei Oprea [:andreio]]

Hi Robert. Right now Firefox (version 57 and newer) has a brand new experience on the newtab and about home pages and the issue should have been fixed. Do you mind checking again? Thanks.

Comment 7

[Robert]

(In reply to Andrei Oprea [:andreio] from comment #6)
> Do you mind checking again? Thanks.

I am not able to reproduce this issue in v59, so I recommend closing this as a WONTFIX.