I have good connectivity and no snoops (that I know of) watching my browsing. (And if I did, then I might want prefetching as a form of plausible deniability.) I love prefetching. I wouldn’t want Google to turn it off for me and deny me the option of having prefetching. But I wouldn’t mind having Firefox turn it off, since that’s a default that I could override by opting-in with a preference.

Google just enabled their service to use a new proprietary Firefox feature, outlined on Mozilla.org here.

I agree with both of you that the browser is the primary culprit here, but Google is taking it one dangerous step further by allowing a completely random page to be prefetched. At least with the default implementation I have to first click on a page before its links get fetched.

Despite my preference for speed-demon surfing, I’ve disabled prefetching for now.

There are lots of ways a site can cause your browser to load a page from another site without your knowledge: JavaScript tricks, hidden frames, etc. For legitimate uses, prefetching is preferable to these other methods, since the browser can be smart about only prefetching during idle periods. Disabling the prefetch feature will preclude these benefits without actually preventing malicious sites from loading remote pages.

On the other hand, well intentioned sites like Google need to be careful about what prefetching they cause for precisely the reasons Ed cites. Google’s users trust it not to place embarrassing content in their caches or to connect their browsers to disreputable sites. Google says only certain sites are prefetched, and I’ll bet these concerns enter into their selection algorithm.

Prefetching is also unlikely to exacerbate a vulnerability that “allows code to be executed automatically from a page that triggers a buffer overflow or exploits an unpatched scripting exploit.” The prefetched page is not rendered and any scripts it contains are not interpreted until the user actually follows a link to it. Only the HTTP and caching code is exposed to the prefetched data, and these relatively simple modules are less likely to contain exploitable holes.

Try blocking third-party cookies to see if that reduces the number of “mystery” cookies.

Google has announced advanced searching with Firefox, But Ed Bott (via Ed Felton) shows how pre-loading (and caching) content on my machine can be dangerous