This store had a site that provide selling points near your location.

Since I work with a payed & respected VPN I thought they would send me a map with selling points in the country far from me where my VPN represents me.

Firefox asked me if they could send 'my location' to the store server, I said YES thinking they would fail estimating my real place. I have never to my knowledge said to Firefox where I live.
Bam, I get selling points around my perfect real location
They got my location like the location-pin exact at my doorstep!
How on earth could firefox knew where I live? My IP address is covered up nicely.

Excerpt from
https://www.mozilla.org/...US/firefox/geolocation/


Whats worth my VPN with this going on, they just have to probe my firefox only to get my location?

Firefox allows to continuous disable Location Aware Browsing permanently, but that's just an ON OFF switch while the intell is still in there?

If firefox can gather the location intel, why not anyone else?

Puzzled...
any advice welcome.

Never trust anything stated by any entity over the internet, ever.

If there is a system, there will always be a way into that system; if there is a barrier, there will be an infinite number of ways to get around it. VPNs, tor, firewalls, etc. are facades; they make it hell for the common-man to DOX you, but don't do diddly squat to keep the real computer geeks out of your life. Anything with a good, solid education in hacking servers knows that the concept of privacy is a gross delusion meant only to sedate one's own uncomfortability in a reality where anything can be accessed by anyone at anytime. My friends, ex-NSA agents turned Emergency Medicine residents, were able to hack into my computer (protected via a vpn, firewall and some other malicious traps), print-out a complete directory of my hard drive & browser history (even the stuff I had thought been deleted) from the past two years, and hand it to me, all within the span of 15 minutes. Long schtick cut short, privacy is a delusion and illusion; to think its real is tantamount to believing that Big Foot didn't die at Wounded Knee an is still at large in the black mining hills of Dakota; never believe anyone or anything which claims to grant you said illusion of privacy; whomever dares to make such maliciious statements only wants your money and another back door to your virtual life. There is no such thing as privacy in all of spacetime.

Wake up,
-God

YOU ARE DELUSIONAL

(as am I).

I've never felt safe from hacking TBH.
But a simple selling store is not a hacker by any means nor is it their aim to hack.

You can say clicking that YES button was like handing over my keys and it's all my own fault, but my consent is worth nothing more than a smokescreen that pretends my authority I'm afraid.

I do know that xxx sites have my place wrong as they hint me in weird languages, I was there just to check that out, really

I'm not sure if you would be interested in any of this, but when talking about security and firefox this often come up:

*A zero day is an unfixable, undisclosed loophole or vulnerability in a system.*







-eg

A zero day is just a brand new exploit. So new it is '0 days old', so to speak.

Remember: people with a lock picker (e.g. the CIA) can lock pick your lock. People with explosives can open your gold vaults. Sometimes it's much smarter to hide your stuff in plain sight and be a little fish in the big swarm.

Yep saw that how-to-disable thingy too. But I wonder:

* what difference does it make with not giving consent to a geo-location request from a site server? It's the first time I got such request, and therefore I was keen to check it out. It's not that I have to decline on a regular base so that it start to bother me, in that case a general OFF would be welcome.

* why do they hide the geolocation on-off preset out & far away from general browser preferences? As if they are obliged but not wanting for people to find it.

* as I've hinted before: what's really worth my request-consent or on-off setting? I suspect that has more to do with guidelines and let the customer believe he's in charge, like all about the paint on the front door to make it look nice.
I do believe that the regular seller's site who works with the system will not get your location if you say no, but that site is not interested in your location for the sake of that, they just want to sell a product, they're not after you at all.
But for purposes who are after someone, this gadget might be a back door with a tiny fisher price lock? I dunno, just wondering.

* what I've put in bolt, and you in purple, I've never thought of that. They don't have to have 'your' location but scanning surroundings to get near you, how bloody perfect clever and this little brad is housed in everyone's firefox. What other software does alike? Can't imagine firefox is only the lonely.

That's too much for me to ask. But I doubt it's a conspiracy, the FF code is OSS and I doubt it's infiltrated by the NSA.

-eg

Haven't read the thread but you probably have WebRTC leakage. Unless specifically dealt with by the user, it pretty much effects everyone using VPNs. I wrote about this in my internet security tutorial located in my thread in this "Security" section of the forum and here is a direct link: https://docs.zoho.com/wr...2fc48bdb76e20f6234765bb

"WebRTC is a technology that allows for browser-to-browser interactions not previously possible with other standards.
A serious privacy issue has been found in WebRTC. This issue allows for websites see the local IP address of a user. This is a major concern as it allows for unique identification of users behind NATs, VPN, and Proxy."

Test if your leaking your IP address via WebRTC here:
https://diafygi.github.io/webrtc-ips/

Your local IP address should not appear.



How I remedy the issue:
I already use an extension for adblocking called "uBlock Origin", (available for FireFox and Chromium/Chrome) I consider it the best, at least the last time I checked. It blocks everything while being lightweight.

In the extensions settings, check "Prevent WebRTC from leaking local IP addresses".



You can also simply disable WebRTC in Firefox:
Enter "about:config" in the URL bar
Find the key of "media.peerconnection.enabled"
Set the value to "false"
But it may reset after each update. Which is why you may want to install Disable WebRTC



And there's extensions for FireFox and Chromium/Chrome specifically, to prevent this:

Extension for Chromium: https://chrome.google.co...kejlgdbkbdfeijglgfdalml

Extension for Firefox: https://addons.mozilla.o...-disable-webrtc/?src=ss


Hope this helps people.

I did infosec for many years, I actually partnered with beyondtrust for a while. There are a lot of ways to jack your information.

First and foremost, let's talk about passwords. Passwords are nothing but a lock on a door. No matter how strong that lock is, how big and strong that door is, I can still break a window if I need to.

Next, let's talk about what you post online. I don't need your passwords to your website accounts when the answer to all of your recovery questions are publicly announced on your facebook profile. At least half of the time, they are.

Everyone talks about IP addresses, so let's talk about them. Content such as internet forums, emails, and sms texts can include rapid offsite logging scripts that record user data. This could be valuable data needed to authenticate you to this website, or your IP address. But why would I care about your IP address when I can just post some random link to some hacked site, which you click on and give me access to your account, on this site. You dig? IP addresses aren't even that important. It's not enough to tie you to anything. It's not going to hilight your name, or even prove you were on any said computer or device. You can relax a bit here.

Next, don't trust public wifi. I've authoured a great deal of scripts that can do things such as monitoring and editing everything from images, videos, and even paypal transactions. Ettercap and nmap work very well in tandom for this.

The list goes on almost infinitely. What matters is that you need to control what you say/do, where you say/do it, and how you say/do it. Nobody is going to come looking for you unless you invite them to do so.

Time to go back to that site and see if it changed anything, uBlock on, webRTC disabled:
https://www.planet-knox.com/find-stockists/
Hitting the "Share my location" resulted in straight at my doorstep, again. I believe it is not webRTC related but meanwhile I'm feeling fine to have webRTC in control now, thank you again.
I think firefox just knows where I live by transactions I made, like entering an Address/City/Country fields on several occasions, that simple.

Ah, there's your mistake.. You see, if they tried this on me, it would never work. There's not a printer on the planet that can make a hard copy of my browser history or drive in 15 minutes. The technology just doesn't exist.

*that's what they would want you to think...

By technology, do you mean the actual technological agents which would be able to collect this info in a matter of minutes, or the amount of paper it would take to print-out your entire hard drive directory onto?

By this time usually you'll have so much money owed to the US gov't so as to pay for the paper to print the sheets.