2 ms·

I'm not really sure what your concern is here. Let's assume for a moment that Firefox's implementation of differential privacy in this scenario is completely co

I'm not really sure what your concern is here. Let's assume for a moment that Firefox's implementation of differential privacy in this scenario is completely correct, and that as a result it's completely impossible (even in an information-theoretic sense) to learn anything about any individual user using this data; only about many users in aggregate. In this scenario, how exactly would Firefox's actions here compromise anyone's privacy?

throwaway2048 9y ago
That is a massively unwarrented assumption, and the burden to show things are otherise is on the party that wishes to push these changes.
- Ajedi32 9y ago
  Fair point. What would you accept as sufficient proof that their implementation is correct? If your answer is "nothing" then I think you're being unreasonable. Firefox risks compromising security/privacy with _every_ new feature they implement, not just this one, and it's clear from [other comments][1] in this thread that this feature is just as important for the overall functionality of Firefox as any other feature would be. [1]: https://news.ycombinator.com/item?id=15072157 https://news.ycombinator.com/item?id=15072157
saiya-jin 9y ago
in 2017, how hard is it to understand that many of us don't trust some sweet talking companies? simple things work. simple NO is simply... NO. there is nothing more to discuss. if they will follow with it, they will lose tons of customers and what is worse, credibility. why bother if there is chrome?
joosters 9y ago
Why are they not letting people decide? If it is not harming anyone's privacy, and they make it clear that it isn't, then what is the problem with letting people opt-in to it? Instead, it's telling that they are choosing to force people to opt-out. They know that their users don't want this, but don't care.
- Ajedi32 9y ago
  Opt-in inevitably results in data being heavily biased in favor of the small minority of users who go out of their way to opt-in. For some stuff that's fine, but for certain types of data you really do need a broad, unbiased sample of users in order for the data to be at all meaningful. (Usually to answer questions like "What percentage of users use x feature?" Or "What level of jank does the average user experience on facebook.com?") They still _are_ planning to let people decide for themselves whether to participate (via opt-out), they're just using a default that's more likely to result in unbiased sample data. Again though, what's your actual concern? Provided this feature doesn't compromise anyone's privacy even _if_ its enabled, what's wrong with having it be opt-out?
  - joosters 9y ago
    I have no way of knowing how this may or may not compromise my privacy without a deep understanding of the techniques being used. I am meant to trust Mozilla and hope that they haven't overlooked some weakness in the algorithms used. The obvious security choice is to not add this feature in. The 'Provided this feature doesn't compromise anyone's privacy' is a fantasy, because no-one can be sure of that.
    - Ajedi32 9y ago
      But that's true of _any_ new feature that gets added to Firefox. Anytime you change code, there's a chance you could be creating a new vulnerability that compromises users' privacy or security in some way. If, as some commenters here [have suggested][1], this telemetry would help improve Firefox by significantly reducing the amount of time it takes Mozilla to fix bugs and performance issues in the browser, what makes you think that's not worth the risk when other features (such as the performance fixes themselves) are? [1]: https://news.ycombinator.com/item?id=15072157 https://news.ycombinator.com/item?id=15072157
      - joosters 9y ago
        It's obviously far, far more likely in code that is designed to send my browsing habits to a 3rd party (in whatever encoding). Do you not see this, or are you just trying to extend out these arguments to some ridiculous extreme for the sake of it?
pishpash 9y ago
Differential privacy does not ensure complete information theoretic security as you say. There is a parameter ε that determines the amount of privacy, and in this case you do not get to set it, somebody else does.
- Ajedi32 9y ago
  Interesting point. Admittedly, my understanding of differential privacy is very rudimentary, but isn't that only a risk under the assumption that you can ask the same user the same question multiple times, and get a new, independently chosen answer every time? If you can only ask each question once and every subsequent time you ask you just get the same answer, is that not secure in the information theoretic sense? Perhaps there's some other factor I'm missing? > in this case you do not get to set it Nothing's been decided yet. If this is something you want to advocate for, maybe consider suggesting that in the thread linked in the OP?
  - pishpash 9y ago
    You are speaking of perhaps Google's RAPPOR protocol specifically, in which answers are sent through a series of BSC-like channels. These channels introduce noise, meaning the input signal is degraded, but by no means is it gone -- otherwise no statistics could be collected. Multiple independent reads would be an obvious attack; actually it's a form of repetition coding; but there are many other coding strategies against noisy channels -- there is an entire field dedicated to that task alone. To contrast, encrypting with a one-time pad is information theoretically secure. Attacks aside, the point is really that in this age of statistical machine learning we should be vigilant against even this sort of data collection. A leak is a leak. Ideally people can opt into providing just enough information for the statistics they want to participate in and no more; realistically, more is always collected.
    - Ajedi32 9y ago
      Ah, fair point. I guess it's incorrect to say it's impossible to learn _anything_ about a user as an individual using data generated using differential privacy. Just that what you do learn is more of a small statistical possibility than a sure thing. (E.g. "The user visited this site." vs "There is a 5% higher than average chance the user visited this site.") And that's even assuming you already know who "the user" is (which certainly isn't a given).
huhtenberg 9y ago
> I'm not really sure what your concern is here. You must be kidding me.

throwaway2048 9y ago

That is a massively unwarrented assumption, and the burden to show things are otherise is on the party that wishes to push these changes.

Ajedi32 9y ago
Fair point. What would you accept as sufficient proof that their implementation is correct? If your answer is "nothing" then I think you're being unreasonable. Firefox risks compromising security/privacy with _every_ new feature they implement, not just this one, and it's clear from [other comments][1] in this thread that this feature is just as important for the overall functionality of Firefox as any other feature would be. [1]: https://news.ycombinator.com/item?id=15072157 https://news.ycombinator.com/item?id=15072157

saiya-jin 9y ago

in 2017, how hard is it to understand that many of us don't trust some sweet talking companies? simple things work. simple NO is simply... NO. there is nothing more to discuss. if they will follow with it, they will lose tons of customers and what is worse, credibility. why bother if there is chrome?

joosters 9y ago

Why are they not letting people decide? If it is not harming anyone's privacy, and they make it clear that it isn't, then what is the problem with letting people opt-in to it? Instead, it's telling that they are choosing to force people to opt-out. They know that their users don't want this, but don't care.

Ajedi32 9y ago
Opt-in inevitably results in data being heavily biased in favor of the small minority of users who go out of their way to opt-in. For some stuff that's fine, but for certain types of data you really do need a broad, unbiased sample of users in order for the data to be at all meaningful. (Usually to answer questions like "What percentage of users use x feature?" Or "What level of jank does the average user experience on facebook.com?") They still _are_ planning to let people decide for themselves whether to participate (via opt-out), they're just using a default that's more likely to result in unbiased sample data. Again though, what's your actual concern? Provided this feature doesn't compromise anyone's privacy even _if_ its enabled, what's wrong with having it be opt-out?
- joosters 9y ago
  I have no way of knowing how this may or may not compromise my privacy without a deep understanding of the techniques being used. I am meant to trust Mozilla and hope that they haven't overlooked some weakness in the algorithms used. The obvious security choice is to not add this feature in. The 'Provided this feature doesn't compromise anyone's privacy' is a fantasy, because no-one can be sure of that.
  - Ajedi32 9y ago
    But that's true of _any_ new feature that gets added to Firefox. Anytime you change code, there's a chance you could be creating a new vulnerability that compromises users' privacy or security in some way. If, as some commenters here [have suggested][1], this telemetry would help improve Firefox by significantly reducing the amount of time it takes Mozilla to fix bugs and performance issues in the browser, what makes you think that's not worth the risk when other features (such as the performance fixes themselves) are? [1]: https://news.ycombinator.com/item?id=15072157 https://news.ycombinator.com/item?id=15072157
    - joosters 9y ago
      It's obviously far, far more likely in code that is designed to send my browsing habits to a 3rd party (in whatever encoding). Do you not see this, or are you just trying to extend out these arguments to some ridiculous extreme for the sake of it?

pishpash 9y ago

Differential privacy does not ensure complete information theoretic security as you say. There is a parameter ε that determines the amount of privacy, and in this case you do not get to set it, somebody else does.

Ajedi32 9y ago
Interesting point. Admittedly, my understanding of differential privacy is very rudimentary, but isn't that only a risk under the assumption that you can ask the same user the same question multiple times, and get a new, independently chosen answer every time? If you can only ask each question once and every subsequent time you ask you just get the same answer, is that not secure in the information theoretic sense? Perhaps there's some other factor I'm missing? > in this case you do not get to set it Nothing's been decided yet. If this is something you want to advocate for, maybe consider suggesting that in the thread linked in the OP?
- pishpash 9y ago
  You are speaking of perhaps Google's RAPPOR protocol specifically, in which answers are sent through a series of BSC-like channels. These channels introduce noise, meaning the input signal is degraded, but by no means is it gone -- otherwise no statistics could be collected. Multiple independent reads would be an obvious attack; actually it's a form of repetition coding; but there are many other coding strategies against noisy channels -- there is an entire field dedicated to that task alone. To contrast, encrypting with a one-time pad is information theoretically secure. Attacks aside, the point is really that in this age of statistical machine learning we should be vigilant against even this sort of data collection. A leak is a leak. Ideally people can opt into providing just enough information for the statistics they want to participate in and no more; realistically, more is always collected.
  - Ajedi32 9y ago
    Ah, fair point. I guess it's incorrect to say it's impossible to learn _anything_ about a user as an individual using data generated using differential privacy. Just that what you do learn is more of a small statistical possibility than a sure thing. (E.g. "The user visited this site." vs "There is a 5% higher than average chance the user visited this site.") And that's even assuming you already know who "the user" is (which certainly isn't a given).

huhtenberg 9y ago

> I'm not really sure what your concern is here. You must be kidding me.