12 ms·

According to F-Droid [1], it contains `com.google.android.gms:play-services-analytics`. [1]: https://gitlab.com/fdroid/rfp/issues/171#note_30410376 https://git

According to F-Droid [1], it contains `com.google.android.gms:play-services-analytics`. [1]: https://gitlab.com/fdroid/rfp/issues/171#note_30410376 https://gitlab.com/fdroid/rfp/issues/171#note_30410376

lol768 9y ago
This is odd because https://f-droid.org/wiki/page/org.mozilla.klar https://f-droid.org/wiki/page/org.mozilla.klar is already part of F-Droid and appears exactly the same .. but with a different name.
- moosingin3space 9y ago
  Looks to me like that app patches out the Gecko webview.
  - lol768 9y ago
    Oh, it uses Webkit? Huh
    - r00fus 9y ago
      Required for iOS or Apple won't allow it on the store.
      - vfclists 9y ago
        Why hasn't the EU charged Apple for abusing the monopoly position? Didn't they do that to Microsoft, or has Apple sweetened them up in some other way?
        moosingin3space 9y ago
        Technically, Apple does not have a monopoly, unless you want to argue they are the monopolist of the market for iOS devices. They don't even have a majority market share of smartphones in most jurisdictions. That being said, I still believe it is an abuse of market position, and I'm not sure how we can fight it.
        kuschku 9y ago
        In most parts of the EU Apple has a marketshare around or below 15%. That’s about the same that Windows Phone 7 had at its peak. So, think about how much of a monopoly position Windows Phone 7 had, and try to imagine Apple had that. You can probably imagine why Apple is not in any shape to abuse their position.
  - opencl 9y ago
    Gecko/Webview is a compile-time switch and both the F-Droid and Play Store builds use Webview. The iOS version is Webview-only or Apple wouldn't allow it on the App store.
    - feikname 9y ago
      I think you meant WebKit for the iOS version?
- piotrkubisa 9y ago
  > " Firefox Klar is a version of Firefox Focus for Germany, Austria and Switzerland with user activity tracking disabled by default." [1] > "For clients that have "send anonymous usage data" enabled Focus sends a "core" ping and an "event" ping to Mozilla's telemetry service. Sending telemetry can be disabled in the app's settings. Builds of "Focus for Android" have telemetry enabled by default ("opt-out") while builds of "Klar for Android" have telemetry disabled by default." [2] [1]: https://f-droid.org/packages/org.mozilla.klar/ https://f-droid.org/packages/org.mozilla.klar/ [2]: https://github.com/mozilla-mobile/focus-android/wiki/Telemetry https://github.com/mozilla-mobile/focus-android/wiki/Telemet...
  - lol768 9y ago
    What's special about Germany, Austria and Switzerland that they don't get the user activity tracking?
    - deleted 9y ago
      [deleted]
    - kuschku 9y ago
      Laws that make this kind of tracking without explicit opt-in a crime. As it should be everywhere.
    - sarnowski 9y ago
      I don't know but assume its a similar issue as with Google Analytics. In Germany, you are not allowed to use default configured Google Analytics. User IPs are PII for our data protection laws (it is possible for someone on earth to know who is probably behind that IP like telcos). As a consequence, we need to disable IP tracking: https://developers.google.com/analytics/devguides/collection/analyticsjs/ip-anonymization https://developers.google.com/analytics/devguides/collection...
    - cosmie 9y ago
      Really strict data privacy laws with a regulatory environment that doesn't play games and heavily leans towards consumer rights. In Germany at least, you're also required to obtain double opt-in and record extensive documentation of the entire opt-in process just for email marketing. If you overstep your bounds and draw the attention of regulators in Germany, it has all the comfort of the Eye of Sauron staring at you[2]. [1] https://blogs.oracle.com/marketingcloud/email-marketing-clarifying-german-opt-requirements https://blogs.oracle.com/marketingcloud/email-marketing-clar... [2] Lord of the Rings reference. Most apt description I can think of for the dread that comes at the mere thought of pissing off German regulators in this area.
jamesmishra 9y ago
I'm relatively uninformed here, but Google often requires Android app developers to bundle Google Play Services for various features like Chromecast[1]. It is possible that the Mozilla folks needed Google Play Services for some feature. [1]: https://developers.google.com/cast/docs/android_sender_setup https://developers.google.com/cast/docs/android_sender_setup
- kuschku 9y ago
  I'm a developer, and I've worked with this before, but the library included here has only the purpose of analytics, and is not required for anything else.
  - lucideer 9y ago
    Google has recently been moving GCM over to FCM, since the Firebase acquisition, and FCM has a hard dependency on the analytics library for some reason (even if you're not availing of the service - perhaps as a veiled upsell attempt). It seems very likely that Firefox would be making use of GCM/FCM - I think most major apps do - so this could be it. Incidentally, this same topics is one of the main controversies around the development of the Signal chat client - it uses GCM, which a good few prospective users object to on similar grounds. Unfortunately, unless you've rooted your phone, GCM/FCM is the only battery-efficient way to provide push to Android phones.
    - st3fan 9y ago
      Focus and Klar do not use GCM.
    - kuschku 9y ago
      > Unfortunately, unless you've rooted your phone, GCM/FCM is the only battery-efficient way to provide push to Android phones. But, and this is the interesting part, the userspace library of FCM can be easily reversed and cloned (the information required for that is here https://gist.github.com/justjanne/153bd4886f92be0ee57fb408427c8d8b https://gist.github.com/justjanne/153bd4886f92be0ee57fb40842...), and the system-side part of FCM has been cloned in an open way (see the µG project).
justinzollars 9y ago
not sure this is related but I notice by default analytics are sent to firefox in the options. On IOS it says "send anonymous usage data to firefox"
- enigmango 9y ago
  Same option on Android - I'm curious if this is related as well, or if there are separate Google analytics being sent.
Froyoh 9y ago
How bad is that?
- bigbugbag 9y ago
  Depends on your views about privacy, tracking, google and mozilla. Also your degree of tolerance. To me privacy is of vital importance, tracking is to be avoided at all cost, so this is as bad as it can be. But I'm now used to mozilla engaging in tracking, giving away my privacy to google for money and firefox developers punishing users and distros who disabled their included spying tool.
  - joaomacp 9y ago
    We found Stallman, here he is
  - piyush_soni 9y ago
    How are they punishing users who disabled their included spying (if any) tool ?
clumsysmurf 9y ago
Historically, even though GA was part of GMS, it did not require GMS to operate. You might be OK without GMS ... but things may have changed since the addition of firebase.
clumsysmurf 9y ago
Historically, even though GA was part of GMS, it did not require GMS to operate. You might be OK without GMS. I'm not sure now that there has been transitioning over to firebase.
chairmanwow 9y ago
I think I'm only surprised to see this comment and not that Firefox bundled analytics into their app. What's controversial about anonymized usage statistics in 2017?
- aw3c2 9y ago
  Just because everyone is doing it does not mean it is ethical and ok. There is nothing anonymized about sending info about my browsing behaviour to one of the world's biggest corporations that monitors vast amounts of the internet. Mozilla should be doing the good thing, not feed a data kraken.
- drdaeman 9y ago
  Well, about the very same moment you see "Browse like no one's watching / Automatically block online tracking while you browse" app starts to silently send some data to app.adjust.com and incoming.telemetry.mozilla.org. If that's not controversial, that's at least ironic. (Just to clarify: this particular behavior was observed on a version from a Play Store, not FDroid. And this was about 1.5 months ago or so. But I doubt things had fundamentally changed since then.)
  - ams6110 9y ago
    Honestly, if you're browsing through your ISP or carrier's data service, you're not anonymous and people are watching. That point of view is the only way to operate.
  - chairmanwow 9y ago
    Ah. I see your point. I failed to consider the context of this application in particular.
  - jopsen 9y ago
    Checkout the histograms: https://telemetry.mozilla.org/ https://telemetry.mozilla.org/ Do other vendors let you see their metric dashboards? And if you feel statistics of time to FIRST_PAINT invades your privacy you can disable telemetry reporting. You can also see what your browser collects in about:telemetry, but don't equate performance measurements with surveillance -- that's FUD.
eli 9y ago
Yes it collects anonymous analytics by default but you can disable it in the settings. It's not a conspiracy. https://support.mozilla.org/en-US/kb/send-anonymous-usage-data-firefox-mobile-devices https://support.mozilla.org/en-US/kb/send-anonymous-usage-da...
- jasonkostempski 9y ago
  You can't advertise as a "private browser" an get away with that PR bullshit. "Anonymous" usage data is anything but when the server receiving it can easily tell who it's coming from. Mozilla is not the user, it breaks the entire idea of privacy.
  - yeukhon 9y ago
    As people below have already added their comments, I just want to give my two cents. This is not PR bullshit, but the Focus team can consider asking users on first run. This private browser, having been using it since beta on iOS, is nothing more than just a private browsing window like the one offered in Desktop version (I am not here to debate the technical implementation since I do not know). Telemetry does not break privacy. Privacy is a contract between the user and the product creator. In this case, Mozilla offers opt-out and does its best effort to document. User has the right to opt out or even choose not to use the software. To me, this is a positive user feedback, but not some PR bullshit (frustration I get it). When someone says your session is private under TLS, well, your IP and user-agent are almost guaranteed captured in server logs, but you can choose to believe/not believe the service provider promises in the respective ToS.
    - dheera 9y ago
      Part of the problem is when Mozilla gives data to Google, there is no way of knowing what Google does with it. If you want to trust Mozilla AND Google AND trust that no gag orders have been issued to the above companies by the NSA, CIA, FBI et al, fine. That's the way 99% of apps work. They all have privacy policies, and people generally trust them. The whole point of explicitly "private" or "anonymous" software is that there are a bunch of users that do NOT trust the above. Calling your software "private browsing software" and then having Google-anything embedded in it is like serving vegetables cooked in chicken broth and calling your dish "vegetarian". Although 90% of the population will gladly eat your chicken broth, it's disingenuous to sell it to actual vegetarians.
mozoldie 9y ago
Focus (for Android) doesn't use Google analytics directly, but it's an indirect dependency - see below. Focus does have: - Mozilla telemetry: enabled by default in Focus, disabled by default in Klar. This only sends data to Mozilla servers, and only concerns what features people use (i.e. do people use share, do people use custom tabs, do people clear using the bin button or the notification). This stuff is used for deciding what features to prioritise (or remove), and doesn't involve Google servers. - Adjust SDK: an install attribution tool (aka install referrer tracking). This is only used to determine whether the app was installed as the result of a specific (google-hosted) ad campaign. Adjust depends on play-services-analytics. ( https://www.adjust.com/glossary/install-referrer/ https://www.adjust.com/glossary/install-referrer/ ). This only comes into play if you install the app from the play store (which funnily enough Google own). This is the only time play-services-analytics shuld be used, i.e. on first install. This is also disabled in Klar. (The more interesting question is: could Focus receive the INSTALL_REFERRER itself for ads attribution instead of using Adjust? That data might be meaningless without asking google to tell you where it came from, and they provided it in the first place anyway...)
- chippy 9y ago
  What is Klar? edits- from anothe comment: "Firefox Klar is a version of Firefox Focus for Germany, Austria and Switzerland with user activity tracking disabled by default."
- TekMol 9y ago
  This stuff is used for deciding what features to prioritise This is exactly what every company tells you why they collect data. "To serve you better ...". The hypocrisy to advertise "tracking protection" as a key feature and then send tracking data to your own servers is hillarious.
  - nsomaru 9y ago
    I'm okay with telemetry, if it makes Firefox better. It's a way of 'paying' for Firefox. Your trust has to go somewhere eventually, and Mozilla doesn't seem like a bad option. Anonymised data would make me happier though :)
cyphar 9y ago
You can disable it in the settings, and you can install Firefox Klar (the exact same code, but made for more privacy-consious countries) from FDroid[1] which has everything disabled by default. [1]: https://f-droid.org/packages/org.mozilla.klar/ https://f-droid.org/packages/org.mozilla.klar/

lol768 9y ago

This is odd because https://f-droid.org/wiki/page/org.mozilla.klar https://f-droid.org/wiki/page/org.mozilla.klar is already part of F-Droid and appears exactly the same .. but with a different name.

moosingin3space 9y ago
Looks to me like that app patches out the Gecko webview.
- lol768 9y ago
  Oh, it uses Webkit? Huh
  - r00fus 9y ago
    Required for iOS or Apple won't allow it on the store.
    - vfclists 9y ago
      Why hasn't the EU charged Apple for abusing the monopoly position? Didn't they do that to Microsoft, or has Apple sweetened them up in some other way?
      - moosingin3space 9y ago
        Technically, Apple does not have a monopoly, unless you want to argue they are the monopolist of the market for iOS devices. They don't even have a majority market share of smartphones in most jurisdictions. That being said, I still believe it is an abuse of market position, and I'm not sure how we can fight it.
      - kuschku 9y ago
        In most parts of the EU Apple has a marketshare around or below 15%. That’s about the same that Windows Phone 7 had at its peak. So, think about how much of a monopoly position Windows Phone 7 had, and try to imagine Apple had that. You can probably imagine why Apple is not in any shape to abuse their position.
- opencl 9y ago
  Gecko/Webview is a compile-time switch and both the F-Droid and Play Store builds use Webview. The iOS version is Webview-only or Apple wouldn't allow it on the App store.
  - feikname 9y ago
    I think you meant WebKit for the iOS version?
piotrkubisa 9y ago
> " Firefox Klar is a version of Firefox Focus for Germany, Austria and Switzerland with user activity tracking disabled by default." [1] > "For clients that have "send anonymous usage data" enabled Focus sends a "core" ping and an "event" ping to Mozilla's telemetry service. Sending telemetry can be disabled in the app's settings. Builds of "Focus for Android" have telemetry enabled by default ("opt-out") while builds of "Klar for Android" have telemetry disabled by default." [2] [1]: https://f-droid.org/packages/org.mozilla.klar/ https://f-droid.org/packages/org.mozilla.klar/ [2]: https://github.com/mozilla-mobile/focus-android/wiki/Telemetry https://github.com/mozilla-mobile/focus-android/wiki/Telemet...
- lol768 9y ago
  What's special about Germany, Austria and Switzerland that they don't get the user activity tracking?
  - deleted 9y ago
    [deleted]
  - kuschku 9y ago
    Laws that make this kind of tracking without explicit opt-in a crime. As it should be everywhere.
  - sarnowski 9y ago
    I don't know but assume its a similar issue as with Google Analytics. In Germany, you are not allowed to use default configured Google Analytics. User IPs are PII for our data protection laws (it is possible for someone on earth to know who is probably behind that IP like telcos). As a consequence, we need to disable IP tracking: https://developers.google.com/analytics/devguides/collection/analyticsjs/ip-anonymization https://developers.google.com/analytics/devguides/collection...
  - cosmie 9y ago
    Really strict data privacy laws with a regulatory environment that doesn't play games and heavily leans towards consumer rights. In Germany at least, you're also required to obtain double opt-in and record extensive documentation of the entire opt-in process just for email marketing. If you overstep your bounds and draw the attention of regulators in Germany, it has all the comfort of the Eye of Sauron staring at you[2]. [1] https://blogs.oracle.com/marketingcloud/email-marketing-clarifying-german-opt-requirements https://blogs.oracle.com/marketingcloud/email-marketing-clar... [2] Lord of the Rings reference. Most apt description I can think of for the dread that comes at the mere thought of pissing off German regulators in this area.

jamesmishra 9y ago

I'm relatively uninformed here, but Google often requires Android app developers to bundle Google Play Services for various features like Chromecast[1]. It is possible that the Mozilla folks needed Google Play Services for some feature. [1]: https://developers.google.com/cast/docs/android_sender_setup https://developers.google.com/cast/docs/android_sender_setup

kuschku 9y ago
I'm a developer, and I've worked with this before, but the library included here has only the purpose of analytics, and is not required for anything else.
- lucideer 9y ago
  Google has recently been moving GCM over to FCM, since the Firebase acquisition, and FCM has a hard dependency on the analytics library for some reason (even if you're not availing of the service - perhaps as a veiled upsell attempt). It seems very likely that Firefox would be making use of GCM/FCM - I think most major apps do - so this could be it. Incidentally, this same topics is one of the main controversies around the development of the Signal chat client - it uses GCM, which a good few prospective users object to on similar grounds. Unfortunately, unless you've rooted your phone, GCM/FCM is the only battery-efficient way to provide push to Android phones.
  - st3fan 9y ago
    Focus and Klar do not use GCM.
  - kuschku 9y ago
    > Unfortunately, unless you've rooted your phone, GCM/FCM is the only battery-efficient way to provide push to Android phones. But, and this is the interesting part, the userspace library of FCM can be easily reversed and cloned (the information required for that is here https://gist.github.com/justjanne/153bd4886f92be0ee57fb408427c8d8b https://gist.github.com/justjanne/153bd4886f92be0ee57fb40842...), and the system-side part of FCM has been cloned in an open way (see the µG project).

justinzollars 9y ago

not sure this is related but I notice by default analytics are sent to firefox in the options. On IOS it says "send anonymous usage data to firefox"

enigmango 9y ago
Same option on Android - I'm curious if this is related as well, or if there are separate Google analytics being sent.

Froyoh 9y ago

How bad is that?

bigbugbag 9y ago
Depends on your views about privacy, tracking, google and mozilla. Also your degree of tolerance. To me privacy is of vital importance, tracking is to be avoided at all cost, so this is as bad as it can be. But I'm now used to mozilla engaging in tracking, giving away my privacy to google for money and firefox developers punishing users and distros who disabled their included spying tool.
- joaomacp 9y ago
  We found Stallman, here he is
- piyush_soni 9y ago
  How are they punishing users who disabled their included spying (if any) tool ?

clumsysmurf 9y ago

Historically, even though GA was part of GMS, it did not require GMS to operate. You might be OK without GMS ... but things may have changed since the addition of firebase.

clumsysmurf 9y ago

Historically, even though GA was part of GMS, it did not require GMS to operate. You might be OK without GMS. I'm not sure now that there has been transitioning over to firebase.

chairmanwow 9y ago

I think I'm only surprised to see this comment and not that Firefox bundled analytics into their app. What's controversial about anonymized usage statistics in 2017?

aw3c2 9y ago
Just because everyone is doing it does not mean it is ethical and ok. There is nothing anonymized about sending info about my browsing behaviour to one of the world's biggest corporations that monitors vast amounts of the internet. Mozilla should be doing the good thing, not feed a data kraken.
drdaeman 9y ago
Well, about the very same moment you see "Browse like no one's watching / Automatically block online tracking while you browse" app starts to silently send some data to app.adjust.com and incoming.telemetry.mozilla.org. If that's not controversial, that's at least ironic. (Just to clarify: this particular behavior was observed on a version from a Play Store, not FDroid. And this was about 1.5 months ago or so. But I doubt things had fundamentally changed since then.)
- ams6110 9y ago
  Honestly, if you're browsing through your ISP or carrier's data service, you're not anonymous and people are watching. That point of view is the only way to operate.
- chairmanwow 9y ago
  Ah. I see your point. I failed to consider the context of this application in particular.
- jopsen 9y ago
  Checkout the histograms: https://telemetry.mozilla.org/ https://telemetry.mozilla.org/ Do other vendors let you see their metric dashboards? And if you feel statistics of time to FIRST_PAINT invades your privacy you can disable telemetry reporting. You can also see what your browser collects in about:telemetry, but don't equate performance measurements with surveillance -- that's FUD.

eli 9y ago

Yes it collects anonymous analytics by default but you can disable it in the settings. It's not a conspiracy. https://support.mozilla.org/en-US/kb/send-anonymous-usage-data-firefox-mobile-devices https://support.mozilla.org/en-US/kb/send-anonymous-usage-da...

jasonkostempski 9y ago
You can't advertise as a "private browser" an get away with that PR bullshit. "Anonymous" usage data is anything but when the server receiving it can easily tell who it's coming from. Mozilla is not the user, it breaks the entire idea of privacy.
- yeukhon 9y ago
  As people below have already added their comments, I just want to give my two cents. This is not PR bullshit, but the Focus team can consider asking users on first run. This private browser, having been using it since beta on iOS, is nothing more than just a private browsing window like the one offered in Desktop version (I am not here to debate the technical implementation since I do not know). Telemetry does not break privacy. Privacy is a contract between the user and the product creator. In this case, Mozilla offers opt-out and does its best effort to document. User has the right to opt out or even choose not to use the software. To me, this is a positive user feedback, but not some PR bullshit (frustration I get it). When someone says your session is private under TLS, well, your IP and user-agent are almost guaranteed captured in server logs, but you can choose to believe/not believe the service provider promises in the respective ToS.
  - dheera 9y ago
    Part of the problem is when Mozilla gives data to Google, there is no way of knowing what Google does with it. If you want to trust Mozilla AND Google AND trust that no gag orders have been issued to the above companies by the NSA, CIA, FBI et al, fine. That's the way 99% of apps work. They all have privacy policies, and people generally trust them. The whole point of explicitly "private" or "anonymous" software is that there are a bunch of users that do NOT trust the above. Calling your software "private browsing software" and then having Google-anything embedded in it is like serving vegetables cooked in chicken broth and calling your dish "vegetarian". Although 90% of the population will gladly eat your chicken broth, it's disingenuous to sell it to actual vegetarians.

mozoldie 9y ago

Focus (for Android) doesn't use Google analytics directly, but it's an indirect dependency - see below. Focus does have: - Mozilla telemetry: enabled by default in Focus, disabled by default in Klar. This only sends data to Mozilla servers, and only concerns what features people use (i.e. do people use share, do people use custom tabs, do people clear using the bin button or the notification). This stuff is used for deciding what features to prioritise (or remove), and doesn't involve Google servers. - Adjust SDK: an install attribution tool (aka install referrer tracking). This is only used to determine whether the app was installed as the result of a specific (google-hosted) ad campaign. Adjust depends on play-services-analytics. ( https://www.adjust.com/glossary/install-referrer/ https://www.adjust.com/glossary/install-referrer/ ). This only comes into play if you install the app from the play store (which funnily enough Google own). This is the only time play-services-analytics shuld be used, i.e. on first install. This is also disabled in Klar. (The more interesting question is: could Focus receive the INSTALL_REFERRER itself for ads attribution instead of using Adjust? That data might be meaningless without asking google to tell you where it came from, and they provided it in the first place anyway...)

chippy 9y ago
What is Klar? edits- from anothe comment: "Firefox Klar is a version of Firefox Focus for Germany, Austria and Switzerland with user activity tracking disabled by default."
TekMol 9y ago
This stuff is used for deciding what features to prioritise This is exactly what every company tells you why they collect data. "To serve you better ...". The hypocrisy to advertise "tracking protection" as a key feature and then send tracking data to your own servers is hillarious.
- nsomaru 9y ago
  I'm okay with telemetry, if it makes Firefox better. It's a way of 'paying' for Firefox. Your trust has to go somewhere eventually, and Mozilla doesn't seem like a bad option. Anonymised data would make me happier though :)

cyphar 9y ago

You can disable it in the settings, and you can install Firefox Klar (the exact same code, but made for more privacy-consious countries) from FDroid[1] which has everything disabled by default. [1]: https://f-droid.org/packages/org.mozilla.klar/ https://f-droid.org/packages/org.mozilla.klar/