Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Studying how Firefox can collect additional data in a privacy-preserving way

groups.google.com

Post reply on HN
Print view View original

61–70 of 450 posts

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#61

Post by Ygg2 »

madez wrote: post #42
veeti wrote: post #30

Earlier quoted context omitted.

Start by actually bothering to read the link: > One recurring ask from the Firefox product teams is the ability to collect more sensitive data, like how features perform on specific sites. > [for example]: "Which sites does a user see heavy Jank on?"

Ask for it. Don't just collect the data. Ffs, what has the team behind FireFox become? I need a new browser.

They did and too few people said yes.

On the other hand, everyone complains Firefox is slow.

So,few pay, few opt in, and everyone complains.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#63

Post by Fuxy »

yjftsjthsd-h wrote: post #5
kogepathic wrote: post #2

> What we plan to do now is run an opt-out SHIELD study [6] to validate our implementation of RAPPOR. IMHO, this is a bad idea. Many people I know already use Firefox because they're weary to give Google (Chrome) all their data. Firefox should make this feature opt-in only.

> Firefox should make this feature opt-in only. I agree, but note that they are explicitly trying to get more info than they can from the small, biased sample that is users opting in.

They claim is biased but is it really biased? How do they know? I think this is just making up excuses so they can collect more data.

They get good enough data from the people that have volunteered it. I don't know what makes them think it's biased but I seriously doubt that is true.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#64

Post by tjoff »

eli wrote: post #21

I think it's worth approaching this with an open mind and giving Firefox at least a little bit of the benefit of the doubt. It's pretty plain to see how such aggregate usage data would lead to a better product for everyone. How many people here use website/app analytics to improve products they work on?

It's pretty plain to see how such aggregate usage data would lead to a better product for everyone.

No, it is not. Especially not for something such as a browser which is mostly transparent to the content.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#66

Post by fenwick67 »

Vinnl wrote: post #13

Note: "planning" means "reaching out for feedback about". Also interesting: the method they plan on using for anonymising this: https://en.wikipedia.org/wiki/Differential_privacy#Principle... If that is not sufficiently anonymous, then please submit the reasoning why to Mozilla.

This is like saying "diffie hellman key exchange has no flaws, therefore https implementations are perfectly secure".

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#67

Post by huhtenberg »

Ajedi32 wrote: post #60
spiderfarmer wrote: post #11

Earlier quoted context omitted.

Absolutely. If this is helping users, it should be easy to convince them to turn it on.

That's not how it works. Most users don't care and will simply use whatever the default is; and when it comes to anonymous usage statistics, "most users" is _exactly_ the group of people you want to be collecting them from; otherwise your results will be skewed heavily in favor of a small minority of power users.

> Most users don't care and will simply use whatever the default is

These users will be installing Chrome, not Firefox.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#69

Post by mcless »

p49k wrote: post #52
chimeracoder wrote: post #26

Earlier quoted context omitted.

> URLs may contain Protected Health and other Identifying Information A URL must not contain PHI. If it does, a breach has already occurred. And Firefox is only collecting the domain names, it looks like.

What do you mean, a URL must not contain PHI? You can't prevent a non-tech minded person from submitting questions about their health to any text field linked to a form with a GET method. I'd argue that domains are the same- there are tons of domains that clearly indicate what they're about (e.g. stop-drinking.example)

@clarkevans But submitting search input via the GET method (e.g. https://www.google.com/search?q=how+to+stop+drinking ) are a common practice in leading search engines.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#70

Post by chimeracoder »

p49k wrote: post #52
chimeracoder wrote: post #26

Earlier quoted context omitted.

> URLs may contain Protected Health and other Identifying Information A URL must not contain PHI. If it does, a breach has already occurred. And Firefox is only collecting the domain names, it looks like.

What do you mean, a URL must not contain PHI? You can't prevent a non-tech minded person from submitting questions about their health to any text field linked to a form with a GET method. I'd argue that domains are the same- there are tons of domains that clearly indicate what they're about (e.g. stop-drinking.example)

> What do you mean, a URL must not contain PHI? You can't prevent a non-tech minded person from submitting questions about their health to any text field linked to a form with a GET method.

You can't, but that can't be part of Mozilla's threat model, and it's not relevant here anyway because Mozilla isn't collecting it.

And even if they were, that's not considered PHI legally. You are free to type any information about your own health that you want anywhere; that doesn't make it legally PHI, unless you are providing it to a Covered Entity.

> I'd argue that domains are the same- there are tons of domains that clearly indicate what they're about (e.g. stop-drinking.example)

This information is not legally considered PHI. As for privacy, SNI means that all domains you visit are already visible in transit, even if you are using SSL. Domain names are not considered private.

Post reply on HN