Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Studying how Firefox can collect additional data in a privacy-preserving way

groups.google.com

Post reply on HN
Print view View original

291–300 of 450 posts

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#291

Post by Vinnl »

gvx wrote: post #141
huhtenberg wrote: post #43

The single largest advantage of Firefox over other browsers is that despite all odds and occasional missteps they managed to respect users' desire for complete privacy. For Firefox we want to better understand how people use our product to improve their experience. Sure thing. But the fact that they are unhappy that some (many?) people are opting-out from the data collection is merely a sign that they don't want to u…

> Currently we can collect this data when the user opts in, but we don't have a way to collect unbiased data, without explicit consent (opt-out). That to me suggests the problem isn't that too many people are opting-out, it's that not enough people are opting-in.

It's not even that not enough people are opting in, it's that the people opting in are "people that would opt-in", i.e. they match a certain profile that makes them not representative of the average user, and thus less good sources to draw conclusions from. Because presumably, the users who opt-in are tech-savvy users who actually read dialog windows presented to them, and thus behave very differently from the average user.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#292

Post by pishpash »

Ajedi32 wrote: post #232
pishpash wrote: post #217

Earlier quoted context omitted.

Differential privacy does not ensure complete information theoretic security as you say. There is a parameter ε that determines the amount of privacy, and in this case you do not get to set it, somebody else does.

Interesting point. Admittedly, my understanding of differential privacy is very rudimentary, but isn't that only a risk under the assumption that you can ask the same user the same question multiple times, and get a new, independently chosen answer every time? If you can only ask each question once and every subsequent time you ask you just get the same answer, is that not secure in the information theoretic sense? P…

You are speaking of perhaps Google's RAPPOR protocol specifically, in which answers are sent through a series of BSC-like channels. These channels introduce noise, meaning the input signal is degraded, but by no means is it gone -- otherwise no statistics could be collected. Multiple independent reads would be an obvious attack; actually it's a form of repetition coding; but there are many other coding strategies against noisy channels -- there is an entire field dedicated to that task alone. To contrast, encrypting with a one-time pad is information theoretically secure.

Attacks aside, the point is really that in this age of statistical machine learning we should be vigilant against even this sort of data collection. A leak is a leak. Ideally people can opt into providing just enough information for the statistics they want to participate in and no more; realistically, more is always collected.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#293

Post by syshum »

kannanvijayan wrote: post #259
syshum wrote: post #131

Earlier quoted context omitted.

What are we attempting to "win". Again I go back to my statement of compromising princibles in the name of market share I have used FF since Ver 1.0 for a few reasons the top ones being it is Open Source, it has always been the most privacy and security focused browser, and were strong advocates of Open Standards that where inter-operable on ALL platforms with out vendor lock in FF is still open source.... the rest t…

> What are we attempting to "win". Again I go back to my statement of compromising princibles in the name of market share I don't see it as an either-or, but rather a balance to strike. A perfectly private browser with no marketshare doesn't help users. A completely compromised browser with 100% marketshare doesn't help users either.

It would not be no marketshare. It would be the market share you have today people that respect the princibles FF once stood for

Mozilla is not happy with us current users though, they would much rather trade us for Edge and Chrome Users..

Mozilla has made it clear it does not value the Users that desire Privacy, Customization, and Power in the hands of the user. Mozilla has Dreams of "beating chrome" a pursuit I have no interest in and place no value in.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#294

Post by sp332 »

syshum wrote: post #293
kannanvijayan wrote: post #259

Earlier quoted context omitted.

> What are we attempting to "win". Again I go back to my statement of compromising princibles in the name of market share I don't see it as an either-or, but rather a balance to strike. A perfectly private browser with no marketshare doesn't help users. A completely compromised browser with 100% marketshare doesn't help users either.

It would not be no marketshare. It would be the market share you have today people that respect the princibles FF once stood for Mozilla is not happy with us current users though, they would much rather trade us for Edge and Chrome Users.. Mozilla has made it clear it does not value the Users that desire Privacy, Customization, and Power in the hands of the user. Mozilla has Dreams of "beating chrome" a pursuit I hav…

But the marketshare "today" is tanking. It's at 10% and falling. There's no reason it won't get so small that it can't support development any longer.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#295

Post by Vinnl »

yorwba wrote: post #284
kannanvijayan wrote: post #185

Earlier quoted context omitted.

Random sampling, basically. The value of random sampling is hard to overstate - it gives you a real picture of what's going on. A non-random sampling gives you a picture, but you have no way of confirming that the picture is a reflection of reality. Random sampling and privacy run into conflicts not just in the browser space, but everywhere else. For example, recently the Canadian government went through a period whe…

Under the "collect and prompt" scheme, you are still sampling randomly. A random sample of users experiences perf issues, a random sample of users opts-in to the collection, you get a random-sample of data. (If you suggest they opt-in to continued collection, you might even get a continuous stream of samples from the same user.) Yes, that data won't cover the people who don't have issues, but do you need to optimize…

The thing is, I think, that the users that opt-in to the collection aren't "a random sample", but rather "a sample of users biased towards certain profiles".

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#296

Post by Vinnl »

kannanvijayan wrote: post #248
CanadianChester wrote: post #234

Earlier quoted context omitted.

I've used Netscape then switched to Firefox when Netscape became way too bloated, then enjoyed years and years of Firefox getting better, supporting new JS and HTML5 features all WITHOUT telemetry and with the Crash Reporting window where I can see the data that is being submitted and submit it if I want to submit it. What have changed so much in last 5 years or so that now you have to get all this data? What is wron…

> What have changed so much in last 5 years or so that now you have to get all this data? To be honest, a lot. Once again, this is my personal take on the matter, not Mozilla's view. First off, browsers were a LOT simpler back then. The sophistication and complexity in a browser has grown significantly in the last decade or so. Secondly, browsers have matured. Remember that this software category has only been around…

I think it's good to annotate this with your other comment as to why Firefox has to join this competition, rather than just do it's think and disregard its marketshare:

> A perfectly private browser with no marketshare doesn't help users. A completely compromised browser with 100% marketshare doesn't help users either.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#297

Post by SubiculumCode »

gbuk2013 wrote: post #242
SubiculumCode wrote: post #236

Earlier quoted context omitted.

So freedom is not having the choice to use DRM?

I don't buy that argument, sorry. Because it requires something as anti-freedom as DRM to exist in the first place.

You would outlaw locks for the front doors of houses too?

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#298

Post by Ajedi32 »

0134340 wrote: post #287
Ajedi32 wrote: post #263

Earlier quoted context omitted.

Why? No, seriously; why? I don't get this mentality at all. Let's ignore the exact implementation here for a moment, and assume that Firefox is somehow magically doing this data collection in such a way that it is guaranteed the data collected cannot be traced back to you as an individual. (E.g. "sufficiently anonymous".) What problem do you have with that, specifically? How does this harm you in any way?

If it's through "secure" code, you can't always guarantee it in the future nor what Mozilla does with this data in the future. Also it doesn't set a good precedent to proceed in this direction of opt-out behavior in Firefox.

In this case, it's not through secure code though, it's through the nature of the data being sent itself. Differential privacy is meant to ensure you _can't_ use the data to make any sort of inferences about individual users; only about users as a whole.

That's kinda beside the point here though, as the GP seemed to be against collecting this data _regardless_ of whether or not it's anonymized or not. I'm interested in hearing why.

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#299

Post by Vinnl »

stewbrew wrote: post #235
kannanvijayan wrote: post #71

I can do a quick summary of what's being proposed and why. I work in the JS team at Mozilla and deal directly with the problems caused by insufficient data. Please note that I'm speaking for myself here, and not on behalf of Mozilla as a whole. Tracking down regressions, crashes, and perf issues without good telemetry about how often it's happening and in what context. Issues that might have otherwise taken a few day…

> Tracking down regressions, crashes, and perf issues without good telemetry about how often it's happening and in what context. If that's what you're aiming at. Collect the data but keep it local. Install some sort of responsiveness/"problem" monitoring. Ask the user to send data relevant to the problem if a problem occurs. IMHO there is no need to systematically collect user data for that. Or get the data from a ra…

> Or get the data from a random sample of users. You don't need data from everyone.

To my amateur ear, that actually sounds like a good compromise to lessen the blow somewhat more. You should suggest it to Mozilla :)

Re: Studying how Firefox can collect additional data in a privacy-preserving way

#300

Post by yorwba »

Vinnl wrote: post #295
yorwba wrote: post #284

Earlier quoted context omitted.

Under the "collect and prompt" scheme, you are still sampling randomly. A random sample of users experiences perf issues, a random sample of users opts-in to the collection, you get a random-sample of data. (If you suggest they opt-in to continued collection, you might even get a continuous stream of samples from the same user.) Yes, that data won't cover the people who don't have issues, but do you need to optimize…

The thing is, I think, that the users that opt-in to the collection aren't "a random sample", but rather "a sample of users biased towards certain profiles".

And how did they find that out?
Post reply on HN