4 ms·

Mozilla's pretty careful about what goes into the default telemetry, too. Most of it is info that isn't very identifying (stuff like "how many cores do you have

Mozilla's pretty careful about what goes into the default telemetry, too. Most of it is info that isn't very identifying (stuff like "how many cores do you have" or "how many times did this specific kind of jank occur for you") FWIW in Firefox nightly (maybe also beta?) if you flip the privacy.firstparty.isolate then the fact that websites can talk to each other is severely reduced; basically third party iframes get their own set of cookies for each domain they're embedded in, so tracking iframes know about each other less. Flipping this pref will log you out of everything though (only the one time), and some sites don't work with it (nothing major so far, and you can file a bug. In many cases it's the site relying on iframes in a weird way).

blub 9y ago
Any comments on the cliqz experiment? Sending visited URLs doesn't sound very careful.
- Manishearth 9y ago
  I don't know much about that. I'm talking about Firefox in particular. Edit: Ah, this is a part of Firefox. It looks like they're using some crypto/privacy features such that "aggregation is not technically feasible". Strongly blinding stuff that way isn't new; e.g. the safe browsing stuff uses differential privacy.
- tormeh 9y ago
  Cliqz isn't (pure) telemetry, it's more like the suggestions at the top of the page on Google. It reads what you're typing in the address bar and tries to give you clever info based on what it thinks you're looking for.
- Sylos 9y ago
  Sending data by itself isn't commonly seen as an attack vector with things like TLS in place and working, as far as we know. At least, Google has been sending browsing history with no additional encryption as part of Chrome Sync since its inception and there we don't know of data leaks during send so far either. And at the server where it's sent to, it gets disconnected from the IP address and intermixed with other people's browsing history. So, it's not stored in personally identifiable form and therefore not vulnerable there either. Mozilla has also made an official statement that neither they nor Cliqz store personally identifiable information as part of this, so doing it anyways would be misleading of consumers, i.e. breaking the law. Not to mention that it would violate German privacy laws (which is where it's currently being tested), if they collected personally identifiable information without clearly notifying the user and at least some checkbox that the user has to tick. It's easy to spin this, so that it sounds like Mozilla is doing pure evil here, but it's just not the case.

blub 9y ago

Any comments on the cliqz experiment? Sending visited URLs doesn't sound very careful.

Manishearth 9y ago
I don't know much about that. I'm talking about Firefox in particular. Edit: Ah, this is a part of Firefox. It looks like they're using some crypto/privacy features such that "aggregation is not technically feasible". Strongly blinding stuff that way isn't new; e.g. the safe browsing stuff uses differential privacy.
tormeh 9y ago
Cliqz isn't (pure) telemetry, it's more like the suggestions at the top of the page on Google. It reads what you're typing in the address bar and tries to give you clever info based on what it thinks you're looking for.
Sylos 9y ago
Sending data by itself isn't commonly seen as an attack vector with things like TLS in place and working, as far as we know. At least, Google has been sending browsing history with no additional encryption as part of Chrome Sync since its inception and there we don't know of data leaks during send so far either. And at the server where it's sent to, it gets disconnected from the IP address and intermixed with other people's browsing history. So, it's not stored in personally identifiable form and therefore not vulnerable there either. Mozilla has also made an official statement that neither they nor Cliqz store personally identifiable information as part of this, so doing it anyways would be misleading of consumers, i.e. breaking the law. Not to mention that it would violate German privacy laws (which is where it's currently being tested), if they collected personally identifiable information without clearly notifying the user and at least some checkbox that the user has to tick. It's easy to spin this, so that it sounds like Mozilla is doing pure evil here, but it's just not the case.