5 ms·

I think the burden here is backwards? URLs may contain Protected Health and other Identifying Information. If this data leaks SSL and could be sent to a 3rd p

I think the burden here is backwards? URLs may contain Protected Health and other Identifying Information. If this data leaks SSL and could be sent to a 3rd party, then it makes Firefox an unsuitable client for a great many applications. EDIT: OK. It's boolean flags (like use of flash) plus an eTLD+1 (example.org; not myname.example.org?). Even so, I believe this tracking should be opt-in with a disclosure screen that explains exactly what Mozilla is recording. Informed consent is a practice we should be promoting, even if it seems unnecessary.

icebraining 9y ago
They're not planning to send full URLs, only domains. Also, the system described is resistant to attacks even if the data is captured (SSL leaks). I don't have enough statistical knowledge to understand how that works, though.
- kuschku 9y ago
  That’s still personalized data. Mozilla has been violating even the minimal legal standards in the EU for years, and no one cares. It’s insanity that an organization promoting its products with privacy doesn’t even meet the minimal legal standards. We’re seeing Google Analytics tracking in parts of the browser ("Get new Addons" page, for example), without even the legally required cookie warning. EU law is clear on this, as soon as you store any data, do any tracking, connect to any third party, or transmit anything for analytics, you have get opt-in.
- falcolas 9y ago
  My concern is that it relies on differential privacy, or privacy through deniability. Which seems like a poor fit when it comes down to submitting URLs visited, unless they plan on submitting fake URLs when the "coin flip" comes up as tails twice in a row? Not to mention, people will tend to visit the same websites repeatedly. The entire premise of DP is that the real data will stand out from the noise, creating a compelling picture of what an individual visits on the web. How will that aggregate data be anonymized, when it is reported with (a minimum of) an IP? In short, this still requires a lot of trust in Mozilla, even with the DP algorithm, to not do the wrong thing with the dataset. And, in my eyes, making this opt-out and not opt-in already compromises that trust.
keeperofdakeys 9y ago
They don't plan on collecting URLs, just (eTLD+1). The only real issue I can see here are users who have registered their own domain under an eTLD, and have it set to their home page. eTLD: https://en.wikipedia.org/wiki/Public_Suffix_List https://en.wikipedia.org/wiki/Public_Suffix_List
- Ajedi32 9y ago
  > The only real issue I can see here are users who have registered their own domain under an eTLD Doesn't the differential privacy system described above prevent even that from being an issue?
  - keeperofdakeys 9y ago
    I'm not sure if they're planning on collecting every homepage domain here, or just asking something like "Is your homepage domain in the list of top 1000 domains?". In the former case, just having the domain listed could leak information. In the latter case, I can't see any issues.
    - Ajedi32 9y ago
      It's more like: "Is your homepage google.com? Flip a coin, if it's heads tell me the truth, otherwise flip another coin and answer yes if it's heads or no if it's tails." (A bit simplified, but that's the general idea behind differential privacy.)
chimeracoder 9y ago
> URLs may contain Protected Health and other Identifying Information A URL must not contain PHI. If it does, a breach has already occurred. And Firefox is only collecting the domain names, it looks like.
- p49k 9y ago
  What do you mean, a URL must not contain PHI? You can't prevent a non-tech minded person from submitting questions about their health to any text field linked to a form with a GET method. I'd argue that domains are the same- there are tons of domains that clearly indicate what they're about (e.g. stop-drinking.example)
  - mcless 9y ago
    @clarkevans But submitting search input via the GET method (e.g. https://www.google.com/search?q=how+to+stop+drinking https://www.google.com/search?q=how+to+stop+drinking ) are a common practice in leading search engines.
  - deleted 9y ago
    [deleted]
  - chimeracoder 9y ago
    > What do you mean, a URL must not contain PHI? You can't prevent a non-tech minded person from submitting questions about their health to any text field linked to a form with a GET method. You can't, but that can't be part of Mozilla's threat model, and it's not relevant here anyway because Mozilla isn't collecting it. And even if they were, that's not considered PHI legally. You are free to type any information about your own health that you want anywhere; that doesn't make it legally PHI, unless you are providing it to a Covered Entity. > I'd argue that domains are the same- there are tons of domains that clearly indicate what they're about (e.g. stop-drinking.example) This information is not legally considered PHI. As for privacy, SNI means that all domains you visit are already visible in transit, even if you are using SSL. Domain names are not considered private.
    - 9y ago
BearGoesChirp 9y ago
do_I_have_very_bad_medical_condition.com Wouldn't that still leak health information? Less overall, but if any is bad, this still isn't acceptable.
- Yoric 9y ago
  Sure, except that with differential privacy, say 5% of telemetry reports would be marked as visiting do_I_have_very_bad_medical_condition.com anyway – regardless of whether they actually did.
  - im3w1l 9y ago
    What if a person visits 10 domains all indicating the same thing? 5%^10. Very very unlikely. Sounds very similar to "guilty beyond all reasonable doubt".

icebraining 9y ago

They're not planning to send full URLs, only domains. Also, the system described is resistant to attacks even if the data is captured (SSL leaks). I don't have enough statistical knowledge to understand how that works, though.

kuschku 9y ago
That’s still personalized data. Mozilla has been violating even the minimal legal standards in the EU for years, and no one cares. It’s insanity that an organization promoting its products with privacy doesn’t even meet the minimal legal standards. We’re seeing Google Analytics tracking in parts of the browser ("Get new Addons" page, for example), without even the legally required cookie warning. EU law is clear on this, as soon as you store any data, do any tracking, connect to any third party, or transmit anything for analytics, you have get opt-in.
falcolas 9y ago
My concern is that it relies on differential privacy, or privacy through deniability. Which seems like a poor fit when it comes down to submitting URLs visited, unless they plan on submitting fake URLs when the "coin flip" comes up as tails twice in a row? Not to mention, people will tend to visit the same websites repeatedly. The entire premise of DP is that the real data will stand out from the noise, creating a compelling picture of what an individual visits on the web. How will that aggregate data be anonymized, when it is reported with (a minimum of) an IP? In short, this still requires a lot of trust in Mozilla, even with the DP algorithm, to not do the wrong thing with the dataset. And, in my eyes, making this opt-out and not opt-in already compromises that trust.

keeperofdakeys 9y ago

They don't plan on collecting URLs, just (eTLD+1). The only real issue I can see here are users who have registered their own domain under an eTLD, and have it set to their home page. eTLD: https://en.wikipedia.org/wiki/Public_Suffix_List https://en.wikipedia.org/wiki/Public_Suffix_List

Ajedi32 9y ago
> The only real issue I can see here are users who have registered their own domain under an eTLD Doesn't the differential privacy system described above prevent even that from being an issue?
- keeperofdakeys 9y ago
  I'm not sure if they're planning on collecting every homepage domain here, or just asking something like "Is your homepage domain in the list of top 1000 domains?". In the former case, just having the domain listed could leak information. In the latter case, I can't see any issues.
  - Ajedi32 9y ago
    It's more like: "Is your homepage google.com? Flip a coin, if it's heads tell me the truth, otherwise flip another coin and answer yes if it's heads or no if it's tails." (A bit simplified, but that's the general idea behind differential privacy.)

chimeracoder 9y ago

> URLs may contain Protected Health and other Identifying Information A URL must not contain PHI. If it does, a breach has already occurred. And Firefox is only collecting the domain names, it looks like.

p49k 9y ago
What do you mean, a URL must not contain PHI? You can't prevent a non-tech minded person from submitting questions about their health to any text field linked to a form with a GET method. I'd argue that domains are the same- there are tons of domains that clearly indicate what they're about (e.g. stop-drinking.example)
- mcless 9y ago
  @clarkevans But submitting search input via the GET method (e.g. https://www.google.com/search?q=how+to+stop+drinking https://www.google.com/search?q=how+to+stop+drinking ) are a common practice in leading search engines.
- deleted 9y ago
  [deleted]
- chimeracoder 9y ago
  > What do you mean, a URL must not contain PHI? You can't prevent a non-tech minded person from submitting questions about their health to any text field linked to a form with a GET method. You can't, but that can't be part of Mozilla's threat model, and it's not relevant here anyway because Mozilla isn't collecting it. And even if they were, that's not considered PHI legally. You are free to type any information about your own health that you want anywhere; that doesn't make it legally PHI, unless you are providing it to a Covered Entity. > I'd argue that domains are the same- there are tons of domains that clearly indicate what they're about (e.g. stop-drinking.example) This information is not legally considered PHI. As for privacy, SNI means that all domains you visit are already visible in transit, even if you are using SSL. Domain names are not considered private.
  - 9y ago

BearGoesChirp 9y ago

do_I_have_very_bad_medical_condition.com Wouldn't that still leak health information? Less overall, but if any is bad, this still isn't acceptable.

Yoric 9y ago
Sure, except that with differential privacy, say 5% of telemetry reports would be marked as visiting do_I_have_very_bad_medical_condition.com anyway – regardless of whether they actually did.
- im3w1l 9y ago
  What if a person visits 10 domains all indicating the same thing? 5%^10. Very very unlikely. Sounds very similar to "guilty beyond all reasonable doubt".