Sending data by itself isn't commonly seen as an attack vector with things like TLS in place and working, as far as we know. At least, Google has been sending b

Sending data by itself isn't commonly seen as an attack vector with things like TLS in place and working, as far as we know. At least, Google has been sending browsing history with no additional encryption as part of Chrome Sync since its inception and there we don't know of data leaks during send so far either. And at the server where it's sent to, it gets disconnected from the IP address and intermixed with other people's browsing history. So, it's not stored in personally identifiable form and therefore not vulnerable there either. Mozilla has also made an official statement that neither they nor Cliqz store personally identifiable information as part of this, so doing it anyways would be misleading of consumers, i.e. breaking the law. Not to mention that it would violate German privacy laws (which is where it's currently being tested), if they collected personally identifiable information without clearly notifying the user and at least some checkbox that the user has to tick. It's easy to spin this, so that it sounds like Mozilla is doing pure evil here, but it's just not the case.