Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox tracks users with Google Analytics in the add-on settings

github.com

Post reply on HN
Print view View original

121–130 of 179 posts

Re: Firefox tracks users with Google Analytics in the add-on settings

#121

Post by rnhmjoj »

hellbanner wrote: post #118
prajjwal wrote: post #115

Users who care about privacy are, quite literally, the only demographic that cares about Firefox at this point. The numbers clearly say that. I'm not even remotely versed in how to run a business, but in what twisted universe does it make sense to alienate us? I put up with Firefox's single threaded nonsense for years, with their outright refusal to properly implement hardware acceleration for Linux, and with their c…

What's your preferred alternative browser? Serious, I haven't found one I like yet.

A fork like IceCat or Pale Moon?

Re: Firefox tracks users with Google Analytics in the add-on settings

#122

Post by nucleardog »

bsilvereagle wrote: post #7
kuschku wrote: post #3

Earlier quoted context omitted.

Yet, they don’t even ask the user if the data should be sent to Google Analytics. Not even a cookie notice.

I'm not sure why you're being downvoted (unless Mozilla does indeed provide this information). All sites using Google Analytics are supposed to inform the user according to Section 7 of the GA ToS: https://www.google.com/analytics/terms/us.html Just because "no one else does it" and Google turning a blind eye towards violators doesn't mean they're not violating the ToS.

If they negotiated a special contract regarding what data is collected, and where and how it's stored and used by Google... What exactly makes you think that ToS has any relevance to the relationship between Mozilla and Google?

Re: Firefox tracks users with Google Analytics in the add-on settings

#123

Post by stinkytaco »

TekMol wrote: post #112
potch wrote: post #78

Quick breakdown of what's going on here (I work at Mozilla, and have worked on the Add-ons site in the past): The "Get Add-ons" view in Firefox is an iframe to a page hosted by addons.mozilla.org. AMO, as all Mozilla sites, use GA to collect aggregate visitor statistics. We negotiated a special contract with Google [1] to only collect a subset of data and that that data is only used for statistical purposes. Google A…

The "Get Add-ons" view in Firefox is an iframe Please don't hide behind technical details. If click something in the browser and it causes Google to be notified, then you have send data about me to Google. Without my consent. privacy policy is linked from the Get Add-ons view Nobody reads those and you know it. The reason people use Firefox is to not get tracked by Google. Honestly, you hugely fucked up with this one…

> Nobody reads those and you know it. The reason people use Firefox is to not get tracked by Google.

If you care about privacy, blind trust is never something you should have.

This has all the trappings of a mistake to me. A group of developers responsible for developing one area (the add-ons page), was not considering the impact it might have on another (the browser developers). Perhaps they should find a different solution, but it rings hollow to argue that a privacy conscious user shouldn't be expected to have read the privacy policy.

Re: Firefox tracks users with Google Analytics in the add-on settings

#124

Post by lucideer »

eli wrote: post #101
kuschku wrote: post #81

Earlier quoted context omitted.

That’s all fine and nice, but how did Mozilla Legal approve this in the first place? It’s obvious this violates both the so-called "Cookie Law" and the Google Analytics ToS, as both require any page with tracking to specifically tell the user that they will track the user. And the so-called "Cookie Law" goes even further, and requires it to be directly done in a modal. How did Mozilla, a company saying they fight for…

It's not "obvious" that it violates either of those. The general consensus is that normal GA tracking alone does not meet the standards to trigger either the EU or the stricter Dutch cookie notification requirements since they are using first-party cookies not tied to PII and don't follow you across sites. And that's assuming a standard GA snippet, not the smaller subset of data Mozilla is collecting here. And the GA…

> The general consensus is that normal GA tracking alone does not meet the standards to trigger either the EU or the stricter Dutch cookie notification requirements since they are using first-party cookies not tied to PII and don't follow you across sites

I don't know about following you across sites, but "PII" is a US legal term, so I highly doubt it's a determiner in applying EU law. GA may not collect PII under US law, but it does fall into EU data protection compliance.

The problem in the EU is the system of enforcement. EU directives require member states to legislate individually, and to enforce their own legislation individually. If that enforcement is deficient, the case can be taken to the ECJ on an individual basis (at possibly significant cost). This doesn't work. Which has motivated the creation of GDPR[0], but unfortunately this doesn't come into play until 2018

[0] https://en.wikipedia.org/wiki/GDPR

Re: Firefox tracks users with Google Analytics in the add-on settings

#125

Post by lucideer »

kuschku wrote: post #81
potch wrote: post #78

Quick breakdown of what's going on here (I work at Mozilla, and have worked on the Add-ons site in the past): The "Get Add-ons" view in Firefox is an iframe to a page hosted by addons.mozilla.org. AMO, as all Mozilla sites, use GA to collect aggregate visitor statistics. We negotiated a special contract with Google [1] to only collect a subset of data and that that data is only used for statistical purposes. Google A…

That’s all fine and nice, but how did Mozilla Legal approve this in the first place? It’s obvious this violates both the so-called "Cookie Law" and the Google Analytics ToS, as both require any page with tracking to specifically tell the user that they will track the user. And the so-called "Cookie Law" goes even further, and requires it to be directly done in a modal. How did Mozilla, a company saying they fight for…

I'm not sure what the "Mozilla Legal" process is, but this thread[0] from 2012 seems to be a recurring source of authority on decision-making around this, from my reading of Bugzilla.

This is what tofumatt was referring to when closing this Github thread.

[0] https://groups.google.com/forum/#!msg/mozilla.governance/9IQ...

Re: Firefox tracks users with Google Analytics in the add-on settings

#126

Post by kuschku »

gcp wrote: post #120
kuschku wrote: post #117

The worst part of this is, this also applies to the Tor Browser, and might potentially help Google to de-anonymize Tor users: http://i.imgur.com/vdlFWYR.png

Why would this allow de-anonymization? Does the request not go through the Tor network?

I changed the wording of my post, but generally, the Tor Browser uses NoScript to block Google Analytics anywhere to improve security, and this page circumvents that, allowing Google Analytics to be loaded. This provides significantly more tracking information than if no GA script was ever loaded.

Additionally, that page has special access to allow installing addons, or removing them, and the Google Analytics script might be able to abuse that to install an addon that leaks your data.

Re: Firefox tracks users with Google Analytics in the add-on settings

#127

Post by michaelt »

gcp wrote: post #111
ssivark wrote: post #91

Earlier quoted context omitted.

They are both issues. My principal point is that they're all part of the same problem in the bigger picture, which is: Mozilla is breaking its privacy promises to its users . 1. Mozilla casts aspersions on Google/Chrome for not respecting users' privacy. (eg: recent billboard advertizements) 2. Mozilla doesn't respect users privacy because it uses tracking, that too third-party, that too from Google . Pot -> kettle -…

Siloing the GA data that is obtained from Mozilla (required by the contract Mozilla has with Google) would stop the privacy-breaking aspects (which exist due to aggregating over sites). But this may be a case where even though Mozilla is technically doing the right thing, perceptions will tend the opposite way. Without that statement in that old bug, most people would never know the Mozilla GA data is siloed.

Siloing, schmiloing. If the user has installed an extension that blocks Google Analytics, and you disable that extension, you're clearly ignoring the user's privacy choices.

Re: Firefox tracks users with Google Analytics in the add-on settings

#128

Post by MaxLeiter »

kuschku wrote: post #30
ianbicking wrote: post #29

Earlier quoted context omitted.

The general policy at Mozilla – which I'm pretty sure addons.mozilla.org follows (given https://github.com/mozilla/addons-frontend/blob/28410742c206... ) is that we don't use Google Analytics on websites if you have Do Not Track on. It's a little less clear here because we're embedding a website into an interface that appears to be part of the browser, which is why there was a suggestion by a maintainer in the first…

The discovery.addons.mozilla.org page does not respect Do Not Track, but as a result of the thread, someone just made a PR to implement that feature: https://github.com/mozilla/addons-frontend/pull/2787 Currently, no matter what privacy settings you set, you are being tracked, without being informed about it, without opt-out. This is likely even illegal in the EU.

The pull request was closed without merging

https://github.com/mozilla/addons-frontend/pull/2787#issueco...

Re: Firefox tracks users with Google Analytics in the add-on settings

#130

Post by kuschku »

MaxLeiter wrote: post #128
kuschku wrote: post #30

Earlier quoted context omitted.

The discovery.addons.mozilla.org page does not respect Do Not Track, but as a result of the thread, someone just made a PR to implement that feature: https://github.com/mozilla/addons-frontend/pull/2787 Currently, no matter what privacy settings you set, you are being tracked, without being informed about it, without opt-out. This is likely even illegal in the EU.

The pull request was closed without merging https://github.com/mozilla/addons-frontend/pull/2787#issueco...

That facepalm hurt. Honestly, what the fuck are they even trying to do? This has to be the most mis-managed situation I’ve seen yet.
Post reply on HN