Firefox hole *maybe* ?

Greeting's

I am not sure if its a bug but I don't understand why such a *feature* is there (okay it might help improve performance but can also serve as a security weakness). I read two threads on firefox about its prefetch feature. I have *disabled* prefetch in firefox on my system (Although i don't think it hold's much relevance here)

Anyway I found out that before we click "SAVE", firefox already starts to download the file in background (so even before I have clicked save the file will be placed in temp directory). Now if this can be disabled or is a feature (i don't know why it should be a feature) then please tell me.

I have conformed this by trying a simple experiment.

I went to sourceforge.net. There I went to BO2K project (http://sourceforge.net/projects/bo2k/)
I clicked on download then I selected the latest file (http://sourceforge.net/project/showf...?group_id=4487)
and then I selected the server closest to me (I also tried with two different random servers but again this information is irrelevant).
Then the opening (and the file name here) dialog box appears in firefox. ** At this point of time I have NOT clicked save ** but the file is already being downloaded while window is in background. I had a look into my firewall and say that even before clicking "save" the file is being downloaded (because the bytes received counter is going up) just to double check I let the download continue after about 1.3 MB being downloaded my anti virus starts showing automatic clean up and warning message's.

Once again if this is a feature then please tell me, I didnt know of such a feature.

Also I have firefox 1.5

I believe it is a feature..

And I personally like it :)

I also don't see how this is a security hole.. perhaps someone can enlighten me..
It's a bandwidth hog, but that's all I can think of..

IIRC IE has the same "feature".

I'm not sure it is the browser or the background intelligent transfer service in Windows. If you have the service turned on, the browser will make use of it to download files in the background. If you turn it off, I bet you don't get the file until you hit "save."

It does seem that they are crossing the line of trust
just to give you the impression of a performance gain.
You like to think of that last dialog as the place where you
can safely bail out. What if the file was something potentially
embarassing or illegal. You were tempted to inquire about it,
but wisely (you think), decided not to download it. Forensics can
now prove that you are lying, and you have a copy of the offending file
on your computer.
:cool:

Greeting's

I'm not sure about BITS being used by other applications except windows update but then I have yet to search. Although I know that prior to SP2 it was set on automatic in both XP home and Pro but after SP2 it has changed to manual in XP pro but home by default is still set on automatic.

Anyway I'm not sure of how to explain this but the scenario is almost same as what rcgreen said. I had an experience once at friends place with an older version of firefox with javascript on and the site offered a file to download (we never clicked a download link) but just a link to an pop up information, but after few seconds trendmicro started displaying warnings about a trojan file. I'm not sure of what exactly happened but this was the scenario.

Well, it's NOT BITS. I thought it was running on the laptop. Nope. Still get the download without specifically asking for the save. Same behavior in IE as in FireFox. Downloads are very fast, though.

'Course, I don't get tempted to download things I shouldn't. So, I have nothing to fear ...

Right?

i've noticed that before, actually i like it, as often i click to download something, go out the room for an hour or so then realise i have forgot to click ok, but maybe it is a little glitch?

Ok it is a security hole. Some sites out there(I use linux and surf with firefox so pretty much safe to everything) when you enter them, try to d/l a wmf file onto your comp. In FF the would you like to d/l dialog comes up. so if FF is prefetching... then even if you say no, windows users are going to get hammered by the WMF backdoor, at least thats the way it seems to me. How thorough is FF in cleaning up its pre-fetches that are not okayed by the user?

Greeting's

I think what locked has mentioned is what i wanted to say, there are many site's which offer a file to download automatically which they know will be rejected by advanced user but by the time you decide to click "no" the file if is small enough and you have a fast Internet connection may be downloaded.

But I have to accept that site's that carry out such activity are not legit at all. Also what rapier57 said is true

"Course, I don't get tempted to download things I shouldn't. So, I have nothing to fear ..."

but then what about site's which offer a file to download on their own when you click link to something else. I still find this as a weakness if not an exploit because although prefetch means file being downloaded in background without you clicking save .. but then how much gain can there be. I mean how much time before you say save to a file..

Where abouts does it put these files?..................... :)