Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Each Firefox download has a unique identifier

ghacks.net

Post reply on HN
Print view View original

61–70 of 480 posts

Re: Each Firefox download has a unique identifier

#61

Post by threatripper »

ordu wrote: post #14

They seem to be trying to gather a lot of telemetry to measure how they can boost popularity of Firefox. I wonder did they tried to measure how the measurement itself influences popularity? Social measurements are like quantum ones, they change reality. There was a funny story of a Hawthorn Experiment[1], which tried to find ways to boost productivity but at the end managed to state just that the very attempt to cond…

Maybe they just kind of forgot how to make good software and now desperately try to recreate that magic using loads of metrics and social experiments leading to loads of competing interpretations and infighting.

Re: Each Firefox download has a unique identifier

#62

Post by car_analogy »

Suppose you want to do something anonymously.

1. Download installer from Mozilla from your home network - Mozilla now has your home IP and installer ID.

2. Transfer it via USB key to a secure, anonymous computer - one not linked to you, on a network not associated with you, such as public WiFi.

3. Install Firefox using that installer on said computer. It transmits the installer ID to Mozilla, which matches the one given to your home IP, thereby deanonymizing you.

4. Mozilla receives a warrant for this information, or it is hacked, or the organization is infiltrated by a single government or corporate spy.

Edit: It gets worse. Suppose a newspaper IT department takes care of providing Firefox and other trusted software installers to their reporters. Now Mozilla can determine who that newspaper helped with IT, such as journalists or sources. Or if you provide trusted software to your friends, Mozilla gets part of your social graph.

Re: Each Firefox download has a unique identifier

#63

Post by noAnswer »

ahmedfromtunis wrote: post #33
klntsky wrote: post #17

> This will allow us to track which installs result from which downloads to determine the answers to questions like, "Why do we see so many installs per day, but not that many downloads per day?" What value does Mozilla see in being able to do that?

I have no idea what the actual answer is, but one can image that they want to understand where are people getting these copies of ff if they do not download them themselves. Why would this be important, again just speculating: to try to leverage whatever channel this might uncover to distribute even more copies of the browser. Is this ID thing the best way to do it, though? Probably.

> but one can image that they want to understand where are people getting these copies of ff if they do not download them themselves.

These people are getting it obviously from their admins! (Like myself. I push Firefox updates to close to 1000 PCs. I thought (amongst other things) I'm doing them a favour by saving them traffic.) They obviously know that! The real reason they are doing this is simply because they started collecting data. Now they are hooked and constantly want more. That is all there is to it. They already identify each individual installation, so someone on the team said: Let's identify each download too.

Re: Each Firefox download has a unique identifier

#65

Post by rurp »

ordu wrote: post #14

They seem to be trying to gather a lot of telemetry to measure how they can boost popularity of Firefox. I wonder did they tried to measure how the measurement itself influences popularity? Social measurements are like quantum ones, they change reality. There was a funny story of a Hawthorn Experiment[1], which tried to find ways to boost productivity but at the end managed to state just that the very attempt to cond…

> They seem to be trying to gather a lot of telemetry to measure how they can boost popularity of Firefox.

This might sound like a crazy idea, but they could always try listening to users! Everytime I get annoyed by something in Firefox and try to find a fix for it, I find a lot of people with the same issue across HN, Reddit, the Mozilla forums, etc. There is rarely any sign that a decision maker from Mozilla cares one bit. But rather than listening to the many vocal complaints, suggestions, and other copious public feedback... they add a unique download identifier. Ok then.

I really, really hope that Mozilla gets new management before it's too late (if it's not already).

Re: Each Firefox download has a unique identifier

#67

Post by Nbox9 »

car_analogy wrote: post #62

Suppose you want to do something anonymously. 1. Download installer from Mozilla from your home network - Mozilla now has your home IP and installer ID. 2. Transfer it via USB key to a secure, anonymous computer - one not linked to you, on a network not associated with you, such as public WiFi. 3. Install Firefox using that installer on said computer. It transmits the installer ID to Mozilla, which matches the one gi…

What’s your point, that someone can attempt to do something anonymously and fail?

Re: Each Firefox download has a unique identifier

#68

Post by aftbit »

Tijdreiziger wrote: post #60
bayindirh wrote: post #38

> A quick check of Chrome installers returned identical hashes each time. OK, however, are we completely sure that Chrome installer doesn't generate this token on launch and talk with the mothership? This sounds like whitewashing Chrome just to increase the impact of the article or push Chrome or both. Like Chrome is not tracking me in and out of the internet and in the kitchen making tea and noting its brand and rep…

Chrome has the X-Client-Data header: https://github.com/bromite/bromite/issues/480

Of which there are (supposedly) only 2^13 possible variants:

>Additionally, a subset of low entropy variations are included in network requests sent to Google. The combined state of these variations is non-identifying, since it is based on a 13-bit low entropy value (see above). These are transmitted using the "X-Client-Data" HTTP header, which contains a list of active variations. On Android, this header may include a limited set of external server-side experiments, which may affect the Chrome installation. This header is used to evaluate the effect on Google servers - for example, a networking change may affect YouTube video load speed or an Omnibox ranking update may result in more helpful Google Search results.

https://www.google.com/chrome/privacy/whitepaper.html#variat...

Re: Each Firefox download has a unique identifier

#69

Post by car_analogy »

Nbox9 wrote: post #67
car_analogy wrote: post #62

Suppose you want to do something anonymously. 1. Download installer from Mozilla from your home network - Mozilla now has your home IP and installer ID. 2. Transfer it via USB key to a secure, anonymous computer - one not linked to you, on a network not associated with you, such as public WiFi. 3. Install Firefox using that installer on said computer. It transmits the installer ID to Mozilla, which matches the one gi…

What’s your point, that someone can attempt to do something anonymously and fail?

My point is that they failed only because they were betrayed by the free software tool they thought they could trust.
Post reply on HN