Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Each Firefox download has a unique identifier

ghacks.net

Post reply on HN
Print view View original

101–110 of 480 posts

Re: Each Firefox download has a unique identifier

#101

Post by Zircom »

zagrebian wrote: post #93
car_analogy wrote: post #91

Earlier quoted context omitted.

Why would they need installer IDs? The question is if they collect it, not if they need it, and all their other behavior suggests that they do collect it.

The article explains why: to figure out why there are more installs than downloads.

They can probably reach the same conclusions about why there might be more installs than downloads by thinking about it for maybe 5 seconds instead of tracking people.

Easiest explanation off the top of my head, without reading the article, would be IT departments including Firefox in their base image they use on all their standard issue computers, resulting in hundreds and possibly thousands of different installs having the same download ID. That alone by itself would cause an absolutely massive discrepancy between download and install numbers. My company includes Firefox in our base image and it's on at least 200,000 different laptops and desktops, with a handful of different download IDs between them depending on when they got issued the computer.

Re: Each Firefox download has a unique identifier

#102

Post by detaro »

noAnswer wrote: post #63
ahmedfromtunis wrote: post #33

Earlier quoted context omitted.

I have no idea what the actual answer is, but one can image that they want to understand where are people getting these copies of ff if they do not download them themselves. Why would this be important, again just speculating: to try to leverage whatever channel this might uncover to distribute even more copies of the browser. Is this ID thing the best way to do it, though? Probably.

> but one can image that they want to understand where are people getting these copies of ff if they do not download them themselves. These people are getting it obviously from their admins! (Like myself. I push Firefox updates to close to 1000 PCs. I thought (amongst other things) I'm doing them a favour by saving them traffic.) They obviously know that! The real reason they are doing this is simply because they sta…

> These people are getting it obviously from their admins!

That's one possibility. And even if you pretend it's the only one, it's still interesting how that's distributed. Is it X admins of 1000-PC orgs, or X*500 people who also install it on dads PC? Count how often each token is used, and you got a histogram, and if you just record that you've not collected anything remotely sensitive about any user. This question can be answered extremely cleanly.

Re: Each Firefox download has a unique identifier

#103

Post by kreeben »

zagrebian wrote: post #77
moonshinefe wrote: post #70

"Principle 4: Individuals’ security and privacy on the internet are fundamental and must not be treated as optional."[1] https://www.mozilla.org/en-US/about/manifesto/

How was this principle violated in this case?

It gives Mozilla the opportunity to connect my IP address with my browser with my Mozilla account. Mozilla needs to bow down to the US govt and supply them with this information should they have stored it, if the govt feels they need it.

Re: Each Firefox download has a unique identifier

#104

Post by weikju »

systemvoltage wrote: post #76
car_analogy wrote: post #62

Suppose you want to do something anonymously. 1. Download installer from Mozilla from your home network - Mozilla now has your home IP and installer ID. 2. Transfer it via USB key to a secure, anonymous computer - one not linked to you, on a network not associated with you, such as public WiFi. 3. Install Firefox using that installer on said computer. It transmits the installer ID to Mozilla, which matches the one gi…

I can't remember exactly but Apple also does this with apps. "Downloaded from ...".

Except this is an attribute saved on the file locally on your system, added by your browser when you download it, not something that Apple stores on their servers and tracks.

Re: Each Firefox download has a unique identifier

#105

Post by woodruffw »

hosteur wrote: post #83

How is this not a blatant violation of EU GDPR? This is involuntary non informed tracking.

My understanding of the GDPR is that it doesn't apply if the analytics are fully anonymized, and only partially applies if the analytics are pseudonymous[1]. It's exceedingly likely that one of these cases applies, since the ID in question is tied to a single Mozilla installation, not individual user or even browser profile.

[1]: https://www.ucl.ac.uk/data-protection/guidance-staff-student...

Re: Each Firefox download has a unique identifier

#106

Post by detaro »

marginalia_nu wrote: post #39

This wouldn't be so bad if it wasn't that the entire brand identity of Firefox is Privacy. It's like discovering there's ham in a vegetarian sandwich. When you ask them they look puzzled and say their focus group was clear it tastes a lot better that way, besides it's just a little bit and the bread is vegetarian and there's way more meat in a Big Mac.

This also wouldn't be so bad if people were capable of nuance instead of acting as if everything involving data were the same thing. I won't claim Mozilla is in any way perfect, but even as someone who is very much pro-privacy it is a little bit ridiculous how much people loose their shit about tiny things like this and claim there is no difference to what other trackers do.

Re: Each Firefox download has a unique identifier

#107

Post by bobkazamakis »

zagrebian wrote: post #87
idiotsecant wrote: post #84

Earlier quoted context omitted.

They had to serve you the file, for which they needed your IP. If they're willing to assign each downloaded client a unique ID what are the odds they are not storing the IP address associated with that unique ID?

Why would Mozilla need the IP address?

...to respond to requests to their server? you can't establish a tcp connection without both ends.

Re: Each Firefox download has a unique identifier

#108

Post by foerbert »

ahmedfromtunis wrote: post #33
klntsky wrote: post #17

> This will allow us to track which installs result from which downloads to determine the answers to questions like, "Why do we see so many installs per day, but not that many downloads per day?" What value does Mozilla see in being able to do that?

I have no idea what the actual answer is, but one can image that they want to understand where are people getting these copies of ff if they do not download them themselves. Why would this be important, again just speculating: to try to leverage whatever channel this might uncover to distribute even more copies of the browser. Is this ID thing the best way to do it, though? Probably.

Does this even help with that though? Without some further means of identifying users, what use is there in saying download#123 got installed x times? Even if you add the obvious IP information to this, then what? Run GeoIP and say "oh, interesting" when they do or do not correlate?

What could they realistically figure out from this that could help them figure out how people are getting Firefox?

Re: Each Firefox download has a unique identifier

#109

Post by car_analogy »

zagrebian wrote: post #88
car_analogy wrote: post #82

Earlier quoted context omitted.

Any connection to Mozilla's servers reveals your IP to them. Given the amount of telemetry in Firefox, it's foolish to assume they don't log these IPs. And in either case, they could be legally compelled to. But afaik, under US law, they cannot be compelled to subvert their software, e.g. to add such spyware features if they were not already present.

Why would Mozilla need the IP address? It doesn’t seem useful for their telemetry.

What part of Mozilla's behavior makes you assume they don't? It's easy to come up with some dubious internal justification to store IPs (like to determine where to focus internationalization efforts).

Re: Each Firefox download has a unique identifier

#110

Post by jcynix »

Zircom wrote: post #101
zagrebian wrote: post #93

Earlier quoted context omitted.

The article explains why: to figure out why there are more installs than downloads.

They can probably reach the same conclusions about why there might be more installs than downloads by thinking about it for maybe 5 seconds instead of tracking people. Easiest explanation off the top of my head, without reading the article, would be IT departments including Firefox in their base image they use on all their standard issue computers, resulting in hundreds and possibly thousands of different installs ha…

Not just companies. I somtimes do this at home to save bandwidth / download time and then install software from usb stick.
Post reply on HN