Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox tracks users with Google Analytics in the add-on settings

github.com

Post reply on HN
Print view View original

101–110 of 179 posts

Re: Firefox tracks users with Google Analytics in the add-on settings

#101

Post by eli »

kuschku wrote: post #81
potch wrote: post #78

Quick breakdown of what's going on here (I work at Mozilla, and have worked on the Add-ons site in the past): The "Get Add-ons" view in Firefox is an iframe to a page hosted by addons.mozilla.org. AMO, as all Mozilla sites, use GA to collect aggregate visitor statistics. We negotiated a special contract with Google [1] to only collect a subset of data and that that data is only used for statistical purposes. Google A…

That’s all fine and nice, but how did Mozilla Legal approve this in the first place? It’s obvious this violates both the so-called "Cookie Law" and the Google Analytics ToS, as both require any page with tracking to specifically tell the user that they will track the user. And the so-called "Cookie Law" goes even further, and requires it to be directly done in a modal. How did Mozilla, a company saying they fight for…

It's not "obvious" that it violates either of those.

The general consensus is that normal GA tracking alone does not meet the standards to trigger either the EU or the stricter Dutch cookie notification requirements since they are using first-party cookies not tied to PII and don't follow you across sites. And that's assuming a standard GA snippet, not the smaller subset of data Mozilla is collecting here.

And the GA ToS require you to have a privacy policy and to make users aware of it. It doesn't require a link on every page. You already agreed to the Mozilla privacy policy as part of the Firefox install process, right?

Re: Firefox tracks users with Google Analytics in the add-on settings

#102

Post by jasonkostempski »

pavement wrote: post #45

As I mentioned in #1107: we will not be removing analytics support entirely. It is extremely useful to us and we have already weighed the cost/benefit of using tracking. https://github.com/mozilla/addons-frontend/issues/1107 Ew. Firefox, I am ashamed to know you.

That bugged me a lot too. The weight of the cost of user privacy should be infinite so, unless they found an infinite benefit, the choice should have been clear.

Re: Firefox tracks users with Google Analytics in the add-on settings

#103

Post by lucideer »

snakeanus wrote: post #50
drdaeman wrote: post #43

Earlier quoted context omitted.

>> broad compatibility with websites > a browser which has privacy as a core principle Sorry, but sad truth is, those two things are mutually exclusive. The modern web is all about running pieces of code. Websites give you a code and expect you to run it (or they'll break). You can throw in some heuristics (e.g. blacklist known offenders and replace them with do-nothing shims) and try to keep up with the ever-changin…

Wouldn't it be possible for a browser to implement js but simply not implement any functions that can be used to track you?

Yes, but by "functions that can be used to track you", you're including user accounts, logins, forms, surveys, &c.

The term "tracking" has become abstracted to a point where many forget that they usually want to be "tracked" (by hitting "reply" here on HN, YCombinator is "tracking" who I am - user account - and what I've written).

If you'd be happy with a browser exclusively to view public, static content, then it could be done.

For selectively disabling tracking, you need uMatrix[0], but a component of the Firefox bug being reported here is that the extensions API used by uMatrix is failing to block GA in this particular case.

[0] https://addons.mozilla.org/en-US/firefox/addon/umatrix/

Re: Firefox tracks users with Google Analytics in the add-on settings

#104

Post by icebraining »

marcosdumay wrote: post #77
drdaeman wrote: post #57

Earlier quoted context omitted.

Like not implementing cookies, LocalStorage, screen resolution info, font enumeration, canvas, WebGL, WebRTC, etc etc? It's probably realistically possible to disable those with the existing browsers. Problem is, that will also break sites that expect you to have all those available. And it's said that there are too many of those (I never saw a proper analysis, though) Just consider: there are sites (one of my favori…

Firefox has an extension called "self destructing cookies" that implements those the way they should be done everywhere. There is absolutely no need for font enumeration. A browser can decide do download fonts it does not have from the site (what will indeed open it to some tracking), or use another cache (with other, different tracking possibilities). But any way it chooses, it just needs to cache the fonts locally…

it just needs to cache the fonts locally to avoid most of the tracking.

Caching is one of the ways of tracking you. If site A says it needs some custom font, the browser will have to download it. If then site B (affiliated with A) asks for the same font, and the browser loads it from cache instead of asking site B, then it knows that you've been to site A.

Re: Firefox tracks users with Google Analytics in the add-on settings

#106

Post by Sir_Cmpwn »

Ugh. If Mozilla needs the data then they need to build their own service for harvesting it. Involving Google for this is not acceptable, opt-out or not.

I would argue for this on the GitHub issue but they would rather silence all opinions than work around the ill informed ones.

Re: Firefox tracks users with Google Analytics in the add-on settings

#108

Post by gcp »

eli wrote: post #101
kuschku wrote: post #81

Earlier quoted context omitted.

That’s all fine and nice, but how did Mozilla Legal approve this in the first place? It’s obvious this violates both the so-called "Cookie Law" and the Google Analytics ToS, as both require any page with tracking to specifically tell the user that they will track the user. And the so-called "Cookie Law" goes even further, and requires it to be directly done in a modal. How did Mozilla, a company saying they fight for…

It's not "obvious" that it violates either of those. The general consensus is that normal GA tracking alone does not meet the standards to trigger either the EU or the stricter Dutch cookie notification requirements since they are using first-party cookies not tied to PII and don't follow you across sites. And that's assuming a standard GA snippet, not the smaller subset of data Mozilla is collecting here. And the GA…

The general consensus is that normal GA tracking alone does not meet the standards to trigger either the EU or the stricter Dutch cookie notification requirements since they are using first-party cookies not tied to PII and don't follow you across sites

Do you have a good reference for this? Especially the "don't follow you across sites" seems weird as Google will end up collecting hits from the same IP/browser/etc combo across sites, which trivially allows following.

Re: Firefox tracks users with Google Analytics in the add-on settings

#109

Post by gcp »

microwavecamera wrote: post #100
gcp wrote: post #54

Earlier quoted context omitted.

The problem here is that GA is quite frankly Telemetry For Websites. Frankly, Mozilla are shooting themselves in the foot by sending any data from any of their products or web properties to their primary competitor. This ship sailed a long time ago. Mozilla negotiated stricter privacy in their contracts with Google, and Mozilla Legal clearly believes Google will uphold those agreements despite it being a competitor.

But it begs the obvious question, why use Google Analytics at all? If it's just about gathering statistics there's several non-invasive ways to acquire that data.

Apparently it's an awesome product. I stopped using it myself because I didn't want to deal with EU cookie notices, which is why I'm surprised to see claims here they are compatible with EU cookie laws.
Post reply on HN