Studying how Firefox can collect additional data in a privacy-preserving way • Hacker News Board

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#151

Post by hawkice » Tue, Aug 22, 2017, 2:12 PM UTC

wila wrote: post #120

hawkice wrote: post #81

Earlier quoted context omitted.

Precisely. Most people don't have an explicit preference. And collecting data on every possible human would give better results -- useful even if they don't plan on justifying running any specific test. We should probably use our expertise in computer networks to create universal, unjustified surveillance. As long as there is an opt-out option (hopefully we can use a complex tracking method so people don't understand…

When I browse to firefox.com I get [1] which has this text: More privacy Firefox doesn’t sell access to your personal information like other companies. From privacy tools to tracking protection, you’re in charge of who sees what. Here’s how Firefox protects your privacy So yes they still advertise with that as one of the major features. [1] https://www.mozilla.org/en-US/firefox/?utm_medium=referral&u...

Indeed, I didn't find the subpage until later. I also like how, it isn't that you _have privacy_, but _more privacy_, because access isn't being sold like other companies. Someone must have noticed that they should only make promises they'll keep and toned down the language.

For instance, from the same page 8 years ago: "we have experts around the globe working around the clock to keep you (and your personal information) safe."

https://web.archive.org/web/20090827204813/http://www.mozill...

Or this quote from the equivalent site 6 years ago:

"And, as a non-profit organization, protecting your privacy by keeping you in control over your personal information is a key part of our mission."

https://web.archive.org/web/20110902025003/http://www.mozill...

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#152

Post by froydnj » Tue, Aug 22, 2017, 2:12 PM UTC

madez wrote: post #40

zaro wrote: post #37

On one hand Mozilla doing something like that is anti privacy. On the other hand how is Mozilla supposed to impprove FF w/o detailed usage data. In theory can be done, but in practice they are competing with Chrome and their team has waaay more data to use. And th is data gives them an edge at least on the decision which parts are worth improving. So they can either start collecting some data and really piss off thei…

Why would FireFox be on a dead spiral for not tracking it's users? If they want browsing data, then can use their own.

(Disclaimer: I work for Mozilla)

The problem with our own browsing data--by which I'm assuming you mean the browsing habits of our ~1000 employees--is that it's wildly non-representative of the broader population. For instance, people here routinely have browser sessions with 10, 100, or even 1000+ tabs. These numbers also indicate that the browser is an application you start, and then you just leave up for a while, perhaps until you restart your computer or you have to update for whatever reason.

The latest statistics we collected on a broader sample of users indicates that the average number of tabs is...2. The average session length is on the order of minutes, not days. Such knowledge leads to very different choices when deciding what browser features to prioritize.

And it's not just browsing usage, either: most employees probably have a top-of-the line (or close to it) Mac laptop, Windows desktop, or Linux desktop; developers have a machine with four, eight, or even more cores. These machines are hardly representative of the wider Firefox user base: a significant majority of our users (~70%) has a machine with two cores, and users with a single core in their machines outnumber users with 8+ cores. We'll not even cover graphics hardware or screen resolution here; see https://hardware.metrics.mozilla.com/ for more examples.

Using our own browsing habits and our own machine specs for making decisions is not feasible.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#153

Post by falcolas » Tue, Aug 22, 2017, 2:13 PM UTC

icebraining wrote: post #22

clarkevans wrote: post #18

Earlier quoted context omitted.

I think the burden here is backwards? URLs may contain Protected Health and other Identifying Information. If this data leaks SSL and could be sent to a 3rd party, then it makes Firefox an unsuitable client for a great many applications. EDIT: OK. It's boolean flags (like use of flash) plus an eTLD+1 (example.org; not myname.example.org?). Even so, I believe this tracking should be opt-in with a disclosure screen tha…

They're not planning to send full URLs, only domains. Also, the system described is resistant to attacks even if the data is captured (SSL leaks). I don't have enough statistical knowledge to understand how that works, though.

My concern is that it relies on differential privacy, or privacy through deniability. Which seems like a poor fit when it comes down to submitting URLs visited, unless they plan on submitting fake URLs when the "coin flip" comes up as tails twice in a row?

Not to mention, people will tend to visit the same websites repeatedly. The entire premise of DP is that the real data will stand out from the noise, creating a compelling picture of what an individual visits on the web. How will that aggregate data be anonymized, when it is reported with (a minimum of) an IP?

In short, this still requires a lot of trust in Mozilla, even with the DP algorithm, to not do the wrong thing with the dataset. And, in my eyes, making this opt-out and not opt-in already compromises that trust.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#154

Post by sp332 » Tue, Aug 22, 2017, 2:14 PM UTC

acdha wrote: post #137

claudius wrote: post #38

Earlier quoted context omitted.

Any submission of data requires the transmission of an IP address, which is personal data and necessitates appropriate protection. I very much hope that the Debian maintainers (and hopefully also the guys preparing Fennec in F-Droid) will disable such data collection mechanisms, either completely or hidden behind an explicit opt-in instead of the opt-out suggested in the e-mail.

> Any submission of data requires the transmission of an IP address, which is personal data and necessitates appropriate protection. Do you have a citation for that broad assertion? My understanding is that this is highly variable across legal jurisdictions and even in Europe, which typically leads the way in privacy, it's not that simple. See e.g. https://www.whitecase.com/publications/alert/court-confirms-... discu…

It might not be legally protected, but that doesn't change how sensitive it is.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#155

Post by quickben » Tue, Aug 22, 2017, 2:15 PM UTC

kannanvijayan wrote: post #125

syshum wrote: post #95

Earlier quoted context omitted.

>>This is a difficult compromise to make, Sorry I do not accept this compromise. Mozilla seems to have lost its way of late. Sad to see a company that was at the fore front of Privacy, and Security abandon that in name of market share and performance. I would rather sacrifice performance for privacy, not the other way around. From EME, to the adoption of Browser Extensions as the only customization option, now this..…

I think the core disagreement here is not ideological per se, but on premises. I agree with the motivation of not collecting any data. That said, I don't feel that we have a choice but to compromise. If we don't build a better browser, then the other browsers will win by default, which means you lose all those privacy and security motivations anyway. This is not some gleeful romp down the yellow brick road of data co…

Nah, we'll just switch. If you are trying to become Chrome, we'll just use Chrome. (Firefox+data collection Edit: I've been with you guys since the beginning, but the line is drawn here.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#156

Post by sp332 » Tue, Aug 22, 2017, 2:16 PM UTC

moosingin3space wrote: post #138

kuschku wrote: post #104

Earlier quoted context omitted.

How would you do that, though? The browser has to open a socket to something to do this, after all. And that already is a violation.

You could transmit the telemetry through Tor.

Tor is blocked in some places and viewed as very suspicious in others. If you're already in a place where you're trying not to draw attention to yourself, using Tor might not a good option.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#157

Post by yborg » Tue, Aug 22, 2017, 2:17 PM UTC

kannanvijayan wrote: post #85

yuhong wrote: post #74

Earlier quoted context omitted.

Mozilla's crash reporter already has the option of submitting the URL.

There are a couple different reasons crash reports aren't sufficient: 1. Crash reports only report crashes. We need also want to see perf issues like GC and paint jank, etc. 2. Crash reports don't sample the general population, so statistically the information is less useful. If we get a perf issue, it's very important to know whether that issue is suffered by 10% of the users in general pop, or 0.5% of users in gene…

>You only get the people who crash

Uh - these are the most important people. The. Most. Important. The people you just pissed off by taking a header in the middle of whatever it was they are doing. Your performance noodling is irrelevant if you aren't addressing those issues.

I'm sorry, but you make the team sound incredibly out of touch with statements like this. To offset the other platforms advantages in marketing visibility, Mozilla has to be better across the board to survive, so unless you guys aren't crashing at all now, I'd say that this should be job #1.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#158

Post by Flammy » Tue, Aug 22, 2017, 2:18 PM UTC

chimeracoder wrote: post #70

p49k wrote: post #52

Earlier quoted context omitted.

What do you mean, a URL must not contain PHI? You can't prevent a non-tech minded person from submitting questions about their health to any text field linked to a form with a GET method. I'd argue that domains are the same- there are tons of domains that clearly indicate what they're about (e.g. stop-drinking.example)

> What do you mean, a URL must not contain PHI? You can't prevent a non-tech minded person from submitting questions about their health to any text field linked to a form with a GET method. You can't, but that can't be part of Mozilla's threat model, and it's not relevant here anyway because Mozilla isn't collecting it . And even if they were, that's not considered PHI legally. You are free to type any information ab…

> This information is not legally considered PHI.

Do you have any sources that go into more detail?

When I've worked on PII in analytics, even TLDs were treated carefully. (obviously not the same from a legal perspective...)

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#159

Post by throwaway2048 » Tue, Aug 22, 2017, 2:18 PM UTC

kannanvijayan wrote: post #125

syshum wrote: post #95

Earlier quoted context omitted.

>>This is a difficult compromise to make, Sorry I do not accept this compromise. Mozilla seems to have lost its way of late. Sad to see a company that was at the fore front of Privacy, and Security abandon that in name of market share and performance. I would rather sacrifice performance for privacy, not the other way around. From EME, to the adoption of Browser Extensions as the only customization option, now this..…

I think the core disagreement here is not ideological per se, but on premises. I agree with the motivation of not collecting any data. That said, I don't feel that we have a choice but to compromise. If we don't build a better browser, then the other browsers will win by default, which means you lose all those privacy and security motivations anyway. This is not some gleeful romp down the yellow brick road of data co…

If you become everything people dislike about the other browser, nobody is going to care what happens to you.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#160

Post by dannysu » Tue, Aug 22, 2017, 2:19 PM UTC

kannanvijayan wrote: post #125

syshum wrote: post #95

Earlier quoted context omitted.

>>This is a difficult compromise to make, Sorry I do not accept this compromise. Mozilla seems to have lost its way of late. Sad to see a company that was at the fore front of Privacy, and Security abandon that in name of market share and performance. I would rather sacrifice performance for privacy, not the other way around. From EME, to the adoption of Browser Extensions as the only customization option, now this..…

I think the core disagreement here is not ideological per se, but on premises. I agree with the motivation of not collecting any data. That said, I don't feel that we have a choice but to compromise. If we don't build a better browser, then the other browsers will win by default, which means you lose all those privacy and security motivations anyway. This is not some gleeful romp down the yellow brick road of data co…

Why is the choice between opt-in vs opt-out of automatic behavior?

If Mozilla wants perf data, collect it and then prompt the user "crash reporting" style.

I would totally opt-in to prompts. Give it a threshold and ask, "This page seems to frequently perform less well on your computer, would you like to send us a report?"