Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Each Firefox download has a unique identifier

ghacks.net

Post reply on HN
Print view View original

251–260 of 480 posts

Re: Each Firefox download has a unique identifier

#251

Post by hiccuphippo »

anthropodie wrote: post #197
rackjack wrote: post #186

Earlier quoted context omitted.

What're the alternatives to Firefox? The only ones that come to mind are Opera and Brave, and Brave had some controversy too.

I read about librewolf the other day which is a fork of firefox. Edit: BTW what happens if I download Firefox from site like Softpedia.All the people who downloaded Firefox from this website have same identifier?

Yes, the article mentions Mozilla's http repository[0] and some other third party as ways to download it without a unique identifier.

[0] https://ftp.mozilla.org/pub/firefox/releases/

Re: Each Firefox download has a unique identifier

#252

Post by dane-pgp »

mionhe wrote: post #240
Mathnerd314 wrote: post #184

Earlier quoted context omitted.

Right which is why the Tor FAQ says using a browser besides Tor Browser is dangerous and not recommended: https://support.torproject.org/tbb/tbb-9/ It's like how when you're baking a cake, the easiest way to do it is to buy a cake mix and follow the directions on the back. Yes, maybe you can make a tastier cake by changing the directions or using better ingredients, but you also introduced the possibility of the cake…

...what ingredients are you putting in your cakes?

Flour?

https://daisyflour.com/flour-explosions/

Re: Each Firefox download has a unique identifier

#253

Post by krmboya »

ex_mozilla wrote: post #230

I'm posting anonymously for obvious reasons. I've been working at Mozilla since its inception. And eventually left the company 2 years ago. And I'm so mad. Mozilla is not the Mozilla that was created almost 20 years ago. It's not the same people there. After the Firefox 4 nightmare, they started hiring product managers from big corp. We started seeing some ex-twitter, ex-microsoft, ex-amazon joining the company. Peop…

Thanks for the insider viewpoint. Something felt really wrong about how Brendan Eich was ousted.

I now understand it was the first instance of the cancel culture I witnessed.

Re: Each Firefox download has a unique identifier

#255

Post by jraph »

lmm wrote: post #180
d110af5ccf wrote: post #127

Earlier quoted context omitted.

Use a reputable Linux distro and install from the official repos, problem solved. To date the Debian maintainers have proven more trustworthy than 99.99% of the software vendors out there. They also appear to have better security practices than most commercial shops.

Debian has a deliberate policy of extensively modifying upstream code, including security-critical code, without any dedicated security review. This (predictably) resulted in quite possibly the worst general-purpose software security bug of all time, where SSH and TLS keys generated on Debian machines were effectively blank and supposedly encrypted communications were readable by anyone. Debian has not changed its pr…

How many times did this happen since Debian's inception? How much time did it take to fix it when it happened?

Because "few" and "not much" would be fantastic.

Nothing is perfect.

Re: Each Firefox download has a unique identifier

#256

Post by cookiengineer »

I don't understand why this is news?

Spyware watchdog posted about this years ago. It's been in there at least since 2016, and every time you open Firefox (not start!) it will happily broadcast its geo position information to their geolocation backend. The same goes for the WebRTC related STUN servers, which are always connected to when Firefox starts.

I mean, come on folks. Never trust any software blindly. Use MITM proxy to verify. Use a host firewall like opensnitch.

For the moment the best alternative is ungoogled chromium with ublock origin, even though the CSP headers cannot influence the DNS resolver mechanics in the CEF code.

I am still busy forking webkit into retrokit and it's a shitload of work to remove these tracking features. [1] But a project like this needs more privacy like minded people.

I mean, even the TOR people kind of gave up on this. Just look at their codebase, trying to stub everything anew with upstream changes.

There's no point in trying to race against chrome in "whose browser has the most features", you can't win anyways. I don't care about WebGL or WebGPU, I don't care about WebRTC, I just want privacy back.

[1] https://github.com/tholian-network/retrokit

Re: Each Firefox download has a unique identifier

#257

Post by xtanx »

cf141q5325 wrote: post #21

From the linked bugzilla https://bugzilla.mozilla.org/show_bug.cgi?id=1677497#c0 >One note, in case it's not already clear: The download token will be available in the telemetry environment, but all web session data that it is linked to will NOT ever be included in telemetry, it is being deliberately kept in a separate data set, and we will be limiting access to the ability to join these data sets to a small set of p…

> Approval granted by Privacy. Good to go.

Great job there "Privacy"...

Re: Each Firefox download has a unique identifier

#258

Post by UberFly »

anthropodie wrote: post #210
RedHobbit wrote: post #209

Earlier quoted context omitted.

I've been using Vivaldi ever since reintroduced tab stacking which I loved from the Opera days. Solid browser, no complaints.

It's closed source, right?

The UI stuff on top of Chromium is closed. They don't want it ripped off I guess. Vivaldi an awesome browser for those who like to customize.

Re: Each Firefox download has a unique identifier

#259

Post by sdoering »

woodruffw wrote: post #105
hosteur wrote: post #83

How is this not a blatant violation of EU GDPR? This is involuntary non informed tracking.

My understanding of the GDPR is that it doesn't apply if the analytics are fully anonymized, and only partially applies if the analytics are pseudonymous[1]. It's exceedingly likely that one of these cases applies, since the ID in question is tied to a single Mozilla installation , not individual user or even browser profile. [1]: https://www.ucl.ac.uk/data-protection/guidance-staff-student...

It is PD (Personal Data). The same way an IP or any 'anonymous' identifier from web analytics is.

So from my understanding of the GDPR regulations this is a clear violation.

Re: Each Firefox download has a unique identifier

#260

Post by dane-pgp »

ygjb wrote: post #190
d110af5ccf wrote: post #114

Earlier quoted context omitted.

Even if they don't (currently) feel that they need them, they could be compelled by law enforcement to retain logs and forbidden from revealing this fact publicly. Or their network could get infiltrated.

How do you propose to prevent a user from leaking their home IP address to Mozilla without undermining the ability to: * Download the browser * implement a safe browsing mechanism * support automatic updates (which are a critical security feature)

If the updates are signed, then there is no danger in downloading them from a third party mirror. As for finding a mirror, Mozilla could put locations as TXT records in the DNS.

There would still be the problem that someone would have a log of your IP address downloading a Firefox update, but it wouldn't be Mozilla. Also, with a big enough list of mirrors, across 100 different jurisdictions, the probability of any given mirror being subpoenaed and having data on any given user is very small.

As for how to bootstrap the whole thing by letting the user securely download Firefox in the first place, that is of course difficult, but it should be an infinitesimally rare event compared to checking for browser updates. A user could therefore take special care to use public Wi-Fi when doing the initial download.

Post reply on HN