Studying how Firefox can collect additional data in a privacy-preserving way • Hacker News Board

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#161

Post by veeti » Tue, Aug 22, 2017, 2:20 PM UTC

yborg wrote: post #157

kannanvijayan wrote: post #85

Earlier quoted context omitted.

There are a couple different reasons crash reports aren't sufficient: 1. Crash reports only report crashes. We need also want to see perf issues like GC and paint jank, etc. 2. Crash reports don't sample the general population, so statistically the information is less useful. If we get a perf issue, it's very important to know whether that issue is suffered by 10% of the users in general pop, or 0.5% of users in gene…

>You only get the people who crash Uh - these are the most important people. The. Most. Important. The people you just pissed off by taking a header in the middle of whatever it was they are doing. Your performance noodling is irrelevant if you aren't addressing those issues. I'm sorry, but you make the team sound incredibly out of touch with statements like this. To offset the other platforms advantages in marketing…

Yes, Firefox developers can only work on addressing crashes or performance issues, but not both.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#162

Post by Ajedi32 » Tue, Aug 22, 2017, 2:20 PM UTC

huhtenberg wrote: post #43

The single largest advantage of Firefox over other browsers is that despite all odds and occasional missteps they managed to respect users' desire for complete privacy. For Firefox we want to better understand how people use our product to improve their experience. Sure thing. But the fact that they are unhappy that some (many?) people are opting-out from the data collection is merely a sign that they don't want to u…

I'm not really sure what your concern is here. Let's assume for a moment that Firefox's implementation of differential privacy in this scenario is completely correct, and that as a result it's completely impossible (even in an information-theoretic sense) to learn anything about any individual user using this data; only about many users in aggregate.

In this scenario, how exactly would Firefox's actions here compromise anyone's privacy?

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#163

Post by Adverblessly » Tue, Aug 22, 2017, 2:21 PM UTC

kannanvijayan wrote: post #85

yuhong wrote: post #74

Earlier quoted context omitted.

Mozilla's crash reporter already has the option of submitting the URL.

There are a couple different reasons crash reports aren't sufficient: 1. Crash reports only report crashes. We need also want to see perf issues like GC and paint jank, etc. 2. Crash reports don't sample the general population, so statistically the information is less useful. If we get a perf issue, it's very important to know whether that issue is suffered by 10% of the users in general pop, or 0.5% of users in gene…

1. Then why not add a "perf reporter" and a "paint jank" reporter?

"Hi! It seems that this page is loading unusually slowly, would you mind submitting more details to help Mozilla diagnose the issue?

Click `More Details` to see exactly what information is being reported."

You even already have a good entry point for one of these - the "unresponsive script" dialog.

Personally, I'm far more likely to send you this data (after having looked over it) than even the opt-out case. If I have to opt-out of all data collection to be sure I don't accidentally report www.really-illegal-pornography.com to Mozilla I'll opt out and you'll never see any information from me at all. If I can avoid sending reports for www.reall-illegal-pornography.com but still report lots-of-annoying-javascript.google.com than you'd get more out of me.

2. If the issue is reported 10x more often on docs.google.com than on obscure.yahoo.com only because docs.google.com is far more common (even though the problem happens only on 0.00001% of visits to docs.google.com but on 10% of visits to obscure.yahoo.com) it does indicate that the issue in docs.google.com is more important. Sure it is rarer per visit, but a user is still 10x more likely to encounter it.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#164

Post by sp332 » Tue, Aug 22, 2017, 2:21 PM UTC

syshum wrote: post #95

kannanvijayan wrote: post #71

I can do a quick summary of what's being proposed and why. I work in the JS team at Mozilla and deal directly with the problems caused by insufficient data. Please note that I'm speaking for myself here, and not on behalf of Mozilla as a whole. Tracking down regressions, crashes, and perf issues without good telemetry about how often it's happening and in what context. Issues that might have otherwise taken a few day…

>>This is a difficult compromise to make, Sorry I do not accept this compromise. Mozilla seems to have lost its way of late. Sad to see a company that was at the fore front of Privacy, and Security abandon that in name of market share and performance. I would rather sacrifice performance for privacy, not the other way around. From EME, to the adoption of Browser Extensions as the only customization option, now this..…

I guess this is offtopic, but what do browser extensions have to do with openness, security, or privacy?

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#165

Post by veeti » Tue, Aug 22, 2017, 2:21 PM UTC

kuschku wrote: post #29

digitalzombie wrote: post #24

Earlier quoted context omitted.

> You can not completely anonymize data with any reliability. Well... there's actually a field for that. I forgot what they call that field because of how niche it is but my friend at google is doing just that. He said there are math theorem to prove that it's sufficiently anonymize. He gave an example of how Netflix competition with the data they gave researchers were able to deanonymize it. And his job was to preve…

Mozilla currently uses Google Analytics for tracking, with "IP Anonymization" enabled. Which, according to Google’s FAQ, https://support.google.com/analytics/answer/2763052?hl=en , just blanks out the last byte of the IP. Which is useless, because it still includes enough personalized data as to be completely and utterly reversible.

Google Analytics has nothing to do with this. As clearly linked in the mailing list, you can read the paper and source code for the client-side differential privacy tech used.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#166

Post by Ajedi32 » Tue, Aug 22, 2017, 2:23 PM UTC

claudius wrote: post #38

Vinnl wrote: post #13

Note: "planning" means "reaching out for feedback about". Also interesting: the method they plan on using for anonymising this: https://en.wikipedia.org/wiki/Differential_privacy#Principle... If that is not sufficiently anonymous, then please submit the reasoning why to Mozilla.

Any submission of data requires the transmission of an IP address, which is personal data and necessitates appropriate protection. I very much hope that the Debian maintainers (and hopefully also the guys preparing Fennec in F-Droid) will disable such data collection mechanisms, either completely or hidden behind an explicit opt-in instead of the opt-out suggested in the e-mail.

> Any submission of data requires the transmission of an IP address

Not true. Tor has demonstrated that it's entirely possible to transmit data over the internet without revealing your IP address to the party you're transmitting to.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#167

Post by falcolas » Tue, Aug 22, 2017, 2:23 PM UTC

Yoric wrote: post #45

embik wrote: post #14

This is ridiculous. I use and recommend Firefox for pure ideological reasons, because frankly, Chrome/Chromium is miles ahead of them. If they start opt-out tracking using the same approach as Google I do not see any reason to use it nor install it for my friends and family. That's some data for you, Mozilla.

As you may have read in the feedback request, Mozilla is proposing to use differential privacy – differential is very different from tracking. For more information, see https://en.wikipedia.org/wiki/Differential_privacy for instance.

So, I read that, and already see two problems. One - DP provides privacy by deniability. How does that apply to URLs (or even just domains)? For a domain to show up, I have to have visited it (unless Firefox will report back random domains).

Two - DP is only really private over a small data set per individual. If DP were enabled for even two days, you could get a very accurate picture of the sites I visit, since a majority of the domains reported would be necessarily be accurate values.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#168

Post by kannanvijayan » Tue, Aug 22, 2017, 2:23 PM UTC

thanksgiving wrote: post #139

kannanvijayan wrote: post #85

Earlier quoted context omitted.

There are a couple different reasons crash reports aren't sufficient: 1. Crash reports only report crashes. We need also want to see perf issues like GC and paint jank, etc. 2. Crash reports don't sample the general population, so statistically the information is less useful. If we get a perf issue, it's very important to know whether that issue is suffered by 10% of the users in general pop, or 0.5% of users in gene…

> Lastly, crash reports are sort of a boolean filter - you only get the people that crash. The things I'd like to know to help in my development are things like "what is the histogram of max GC pause times on docs.google.com". Getting that info requires a good random sampling of the population, not just those who exhibit problems. PLEASE do not go down this road. Look where "optimizing" video card drivers has led the…

This is getting off-topic, but it's interesting. I think I have the exact opposite take on things from you :)

A program written by a developer and used by a user is a relationship between that developer and the user. I just work on the platform that allows that relationship to exist. I feel it's overstepping our boundaries as platform providers to say "we're not going to make this platform faster for you because we think developers are writing bad code using that performance as a crutch".

It feels like I'd be setting myself up as a self-appointed clergy over moral matters in software development. It's not a hat I'm comfortable with.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#169

Post by throwaway2048 » Tue, Aug 22, 2017, 2:23 PM UTC

Ajedi32 wrote: post #162

huhtenberg wrote: post #43

The single largest advantage of Firefox over other browsers is that despite all odds and occasional missteps they managed to respect users' desire for complete privacy. For Firefox we want to better understand how people use our product to improve their experience. Sure thing. But the fact that they are unhappy that some (many?) people are opting-out from the data collection is merely a sign that they don't want to u…

I'm not really sure what your concern is here. Let's assume for a moment that Firefox's implementation of differential privacy in this scenario is completely correct, and that as a result it's completely impossible (even in an information-theoretic sense) to learn anything about any individual user using this data; only about many users in aggregate. In this scenario, how exactly would Firefox's actions here compromi…

That is a massively unwarrented assumption, and the burden to show things are otherise is on the party that wishes to push these changes.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#170

Post by jasonkostempski » Tue, Aug 22, 2017, 2:23 PM UTC

Raphmedia wrote: post #83

> "Which top sites are users visiting?" Could someone explains to me how this information is useful to a browser vendor? It's not as if they are optimizing on a site by site basis.

They want to sell user data, plain and simple. "Improve user experience" is the standard excuse. Basically they're saying we want to collect a bunch of information we already know people don't want us collecting, so we want to make it opt-out and we'll pinky-swear it will be kept anonymous. There's no way for them to send data to their servers truly anonymously; there's no way for them to guarantee everyone who has access to the data before it's anonymized will not do something they're not supposed to. They're asking us to move away from a not having to trust anyone to trusting them by default.

I'm sure you already know all this and I'm sure people are getting sick of hearing rants about it every time it comes up. This is the second time in a week for a Mozilla product. I suspect they're trying to exhaust the ranters so they're just left with the users who don't care, "have nothing to hide", or think it's their duty to help the browser vendor squash bugs. No software or service should be trusted until it's absolutely necessary to get the job the user wants done, not the job the browser vendor wants done. It will never be necessary for a browser to send browsing data back to the browser vendor to get to a website.