3 ms·

> there are multiple ways to lower the privacy incursion that is caused by the data collection The OP actually discusses a very interesting method for doing ex

> there are multiple ways to lower the privacy incursion that is caused by the data collection The OP actually discusses a very interesting method for doing exactly that using differential privacy techniques. I personally think that's a very good compromise for this use-case.

belorn 9y ago
From the OP, one suggestion is to collect "top-level+1 domains". This don't solve the issue of a person going to "starting_a_union_inside_company_x.com", which would be a top-level domain. Niche domains don't have a large number of users and as such the users can be trivial to deanonymized. It is also rather common that domain name servers have a private and public side. Firefox could easily become a vector of leaking from the private side, possible revealing sensitive information such as unannounced products. From the OP we can also see that they don't intend to store IP-addresses, but it will always be possible. By using a anonymity network they can reassure the user and at the same time eliminate the risk that a malicious actor in the future will silently manage to start tracking information about which websites users go to. Additional benefits is that Mozilla also won't become a target for governments, a risk that no organization can ever be safe from if they start gather information about users. It is not enough to strike a reasonable balance between the privacy-for-users and actionable-information-for-developers. You also need to find a balance between risk management and time spent on reducing risks. What I propose primarily is that they spend a bit more time on reducing risks, as that would benefit everyone.
- nsgi 9y ago
  Even Alexa 1k could be quite sensitive, for example there are many porn sites in that list.
  - floatingatoll 9y ago
    As an organization, we are very aware that some of the sites people visit using our browser would humiliate them if someone could draw a link between who they are and where they visited. This isn't restricted to porn, but that's certainly the most widely known category of site that falls under this heading. We consider this carefully every time we do anything with any user data ever, whether a crash report or the TLD+1 proposal described above. EDIT: Don't forget that the DNS resolution for porn sites can be deanonymized and resold by your internet provider - there's nothing we can do to protect you from DNS being a cleartext, sniffable, mitm'able protocol.

belorn 9y ago

From the OP, one suggestion is to collect "top-level+1 domains". This don't solve the issue of a person going to "starting_a_union_inside_company_x.com", which would be a top-level domain. Niche domains don't have a large number of users and as such the users can be trivial to deanonymized. It is also rather common that domain name servers have a private and public side. Firefox could easily become a vector of leaking from the private side, possible revealing sensitive information such as unannounced products. From the OP we can also see that they don't intend to store IP-addresses, but it will always be possible. By using a anonymity network they can reassure the user and at the same time eliminate the risk that a malicious actor in the future will silently manage to start tracking information about which websites users go to. Additional benefits is that Mozilla also won't become a target for governments, a risk that no organization can ever be safe from if they start gather information about users. It is not enough to strike a reasonable balance between the privacy-for-users and actionable-information-for-developers. You also need to find a balance between risk management and time spent on reducing risks. What I propose primarily is that they spend a bit more time on reducing risks, as that would benefit everyone.

nsgi 9y ago
Even Alexa 1k could be quite sensitive, for example there are many porn sites in that list.
- floatingatoll 9y ago
  As an organization, we are very aware that some of the sites people visit using our browser would humiliate them if someone could draw a link between who they are and where they visited. This isn't restricted to porn, but that's certainly the most widely known category of site that falls under this heading. We consider this carefully every time we do anything with any user data ever, whether a crash report or the TLD+1 proposal described above. EDIT: Don't forget that the DNS resolution for porn sites can be deanonymized and resold by your internet provider - there's nothing we can do to protect you from DNS being a cleartext, sniffable, mitm'able protocol.