Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Studying how Firefox can collect additional data in a privacy-preserving way

groups.google.com

Post reply on HN
Print view View original

391–400 of 450 posts

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#391

Post by pishpash »

kannanvijayan wrote: post #71

I can do a quick summary of what's being proposed and why. I work in the JS team at Mozilla and deal directly with the problems caused by insufficient data. Please note that I'm speaking for myself here, and not on behalf of Mozilla as a whole. Tracking down regressions, crashes, and perf issues without good telemetry about how often it's happening and in what context. Issues that might have otherwise taken a few day…

Many problems here:

1. You're proposing a mechanism for collecting data, and a strategy for extracting more data than you currently do. You have not figured out the type of data that you will finally need, only a set of things that you currently envision. Naturally, the data that you will collect in the future will be more than what you currently envision. There is built-in mission creep that is dangerous.

2. What you currently envision is not fleshed out as especially useful. You only believe it is useful. The pain point of biased data is red herring. Your concern is more about not enough data.

3. You have found a technology which you believe will allow you to collect a lot of data anonymously. But none of you seem to understand the technology very well. It seems like a shiny toy that you are eager to go to town with. I am not sure this is the right attitude.

4. You're proposing to use your users in lieu of proper testers, or to save time. There are many ways to properly test software and to save time. Have they been explored? There used to be a time when beta software was a thing. Prompt the users to become testers for your beta software. If users don't want to be testers then don't collect data from them. How much data do you actually need anyway? Have you fully utilized your existing data?

Over all, I see this as a nice-to-have luxury, not some life-and-death situation, and subverting the goodwill of users is not worth it, IMHO.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#392

Post by a3_nm »

If you do not like the idea that by default Firefox will send data to Mozilla about your Firefox usage (no matter the privacy protection techniques being used), you should probably be aware that Firefox is already sending this kind of data to Mozilla. This is called Firefox Health Report and is pointed out in their privacy policy: https://www.mozilla.org/en-US/privacy/firefox/#health-report

FHR is also opt-out, i.e., enabled by default. If you do not like this, you may want to disable this as well.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#393

Post by Ar-Curunir »

pishpash wrote: post #391
kannanvijayan wrote: post #71

I can do a quick summary of what's being proposed and why. I work in the JS team at Mozilla and deal directly with the problems caused by insufficient data. Please note that I'm speaking for myself here, and not on behalf of Mozilla as a whole. Tracking down regressions, crashes, and perf issues without good telemetry about how often it's happening and in what context. Issues that might have otherwise taken a few day…

Many problems here: 1. You're proposing a mechanism for collecting data, and a strategy for extracting more data than you currently do. You have not figured out the type of data that you will finally need, only a set of things that you currently envision. Naturally, the data that you will collect in the future will be more than what you currently envision. There is built-in mission creep that is dangerous. 2. What yo…

Differential privacy is relatively battle-tested. I wouldn't be too worried about it standing up to scrutiny.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#394

Post by yakult »

sp332 wrote: post #201
yakult wrote: post #34

1. Any data collection at all deanonymizes the user, cf panopticlick. 2. Frankly even opt-out is not acceptable. I can't recommend any software that peridically asks users for data access, since there exist non-technical users who have a nonzero chance of clicking yes to everything. If they are related to me in some way this compromises my privacy also.

1. Any data collection at all deanonymizes the user, cf panopticlick. This isn't true. Panopticlick collects a ton of data about your browser that this proposal will not. There has been a lot of research done in this area and we know how to collect anonymous datasets. https://arxiv.org/abs/1407.6981

Look at it from a security-conscious user's perspective: I would have to verify that:

1. The concept is sound. 2. It is implemented as described. 3. It is implemented with no bugs. 4. Mozilla is trustworthy 5. Any third-parties Mozilla involves in this process are also trustworthy. 6. All of the above will remain true.

Doing this would take a tremendous amount of both time and expertise, if even possible. If every piece of software I use makes me do this every year or so, I would get nothing else done.

In practical terms, your argument is no better than just saying, 'trust us, we're good for it', regardless of the merits of your tech. And we know Mozilla baked Google Analytics into FF's addon page, so trust is in short supply.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#395

Post by Sir_Substance »

Ar-Curunir wrote: post #393
pishpash wrote: post #391

Earlier quoted context omitted.

Many problems here: 1. You're proposing a mechanism for collecting data, and a strategy for extracting more data than you currently do. You have not figured out the type of data that you will finally need, only a set of things that you currently envision. Naturally, the data that you will collect in the future will be more than what you currently envision. There is built-in mission creep that is dangerous. 2. What yo…

Differential privacy is relatively battle-tested. I wouldn't be too worried about it standing up to scrutiny.

The problem with differential privacy is I have to trust the person aggregating the data to actually do it.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#396

Post by nsgi »

belorn wrote: post #379
Ajedi32 wrote: post #338

Earlier quoted context omitted.

> there are multiple ways to lower the privacy incursion that is caused by the data collection The OP actually discusses a very interesting method for doing exactly that using differential privacy techniques. I personally think that's a very good compromise for this use-case.

From the OP, one suggestion is to collect "top-level+1 domains". This don't solve the issue of a person going to "starting_a_union_inside_company_x.com", which would be a top-level domain. Niche domains don't have a large number of users and as such the users can be trivial to deanonymized. It is also rather common that domain name servers have a private and public side. Firefox could easily become a vector of leakin…

Even Alexa 1k could be quite sensitive, for example there are many porn sites in that list.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#397

Post by comex »

pishpash wrote: post #391
kannanvijayan wrote: post #71

I can do a quick summary of what's being proposed and why. I work in the JS team at Mozilla and deal directly with the problems caused by insufficient data. Please note that I'm speaking for myself here, and not on behalf of Mozilla as a whole. Tracking down regressions, crashes, and perf issues without good telemetry about how often it's happening and in what context. Issues that might have otherwise taken a few day…

Many problems here: 1. You're proposing a mechanism for collecting data, and a strategy for extracting more data than you currently do. You have not figured out the type of data that you will finally need, only a set of things that you currently envision. Naturally, the data that you will collect in the future will be more than what you currently envision. There is built-in mission creep that is dangerous. 2. What yo…

> There used to be a time when beta software was a thing. Prompt the users to become testers for your beta software.

Firefox already has opt-in telemetry, and Firefox already has a beta channel. It's unclear to me how it would help to tie telemetry to the beta channel; that would just make the existing problems (not enough data, and biased data) even worse, since there are probably far more users willing to share telemetry data than to use beta software.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#398

Post by [deleted] »

Ar-Curunir wrote: post #393
pishpash wrote: post #391

Earlier quoted context omitted.

Many problems here: 1. You're proposing a mechanism for collecting data, and a strategy for extracting more data than you currently do. You have not figured out the type of data that you will finally need, only a set of things that you currently envision. Naturally, the data that you will collect in the future will be more than what you currently envision. There is built-in mission creep that is dangerous. 2. What yo…

Differential privacy is relatively battle-tested. I wouldn't be too worried about it standing up to scrutiny.

[deleted]

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#399

Post by cgio »

Sir_Substance wrote: post #395
Ar-Curunir wrote: post #393

Earlier quoted context omitted.

Differential privacy is relatively battle-tested. I wouldn't be too worried about it standing up to scrutiny.

The problem with differential privacy is I have to trust the person aggregating the data to actually do it.

Do you? Excuse my ignorance, but I thought there was a way to locally mangle the data before submitting. Is that not what apple is doing?

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#400

Post by comex »

Sir_Substance wrote: post #395
Ar-Curunir wrote: post #393

Earlier quoted context omitted.

Differential privacy is relatively battle-tested. I wouldn't be too worried about it standing up to scrutiny.

The problem with differential privacy is I have to trust the person aggregating the data to actually do it.

This is incorrect, at least in theory. RAPPOR is designed to protect the user's data even if an attacker can see all of their individual responses over time. Of course, there could be implementation issues...
Post reply on HN