8 ms·

Firefox updates its iOS web browser to turn Tracking Protection on by default

268 points by cpeterso 9y ago

moz23 9y ago
Took them long enough, glad they're becoming a bit braver (almost like Brave :p). Any plans for desktop though...? After all, desktop seems to be the main platform for Mozilla.
- piracykills 9y ago
  They might just be looking for some way to differentiate themselves on iOS given Apple's policy of not allowing 3rd party rendering engines.
- AtomicOrbital 9y ago
  on android ff is by far the best browser for usability especially tab management ... chrome is a decided non starter on that OS
  - cptskippy 9y ago
    I'm inclined to agree. It runs beautifully on my Nextbit Robin. My wife however has nothing but problems with it on her Google Pixel.
  - megaman22 9y ago
    Switching from default Chrome to Brave on Android has been the best thing I've ever done on my phone. May have to check out how FF compares
    - lukaa 9y ago
      Brave is great but until they include dark mode I'll stick with Chromium from F-droid.
- progval 9y ago
  It looks like they want to turn this on incrementally. First private browsing, now this. It gives web developers time to notice issues with their websites/webapps and fix/report them.
  - StavrosK 9y ago
    I would very much love it if Privacy Badger were included by default in browsers (or at least something with similar functionality).
- callahad 9y ago
  Desktop also has tracking protection by default in private browsing windows. See Preferences -> Privacy -> Tracking Protection to enable it everywhere. Per the roadmap at https://wiki.mozilla.org/Firefox/Roadmap https://wiki.mozilla.org/Firefox/Roadmap, we're explicitly working toward making Firefox more opinionated in 2018. Specifically, "Firefox will take a stand against tracking," will "filter certain types of ads by default," and will "block ad re-targeting."
- deleted 9y ago
  [deleted]
- Sylos 9y ago
  The reason why Brave can be Brave, is because it can hide under Chrome. Webpage owners will build their webpages Chrome-compatible, which makes them Brave-compatible, so whether they make any money off of supporting Brave is unimportant. Mozilla can't do the same with Firefox, because they don't have anything to hide under. They rely on webpage owners making money off of Firefox, otherwise they're not going to build/test against Firefox. Mozilla can be Brave with Firefox for iOS, and with Firefox Focus as well, because there they don't use Gecko as layout engine, they hide underneath someone else's layout engine. (Apple forces other browsers to use WebKit on iOS; Firefox Focus for Android uses Android Webview because it keeps the binary small, which is important as it's sort of meant to be a secondary browser.) So, they're most definitely not doing the same for desktop and Android Firefox. It would kill Firefox/Gecko in no time, if they did that. It wouldn't be brave, it'd be suicide.
  - TazeTSchnitzel 9y ago
    Apple has, well, courage to enable some anti-tracking features by default in desktop Safari. But of course Mobile Safari is so ubiquitous they know sites must continue supporting their engine.
mobydickship 9y ago
about:config - when?
- cpeterso 9y ago
  You can already enable Tracking Protection in Firefox for iOS (and Android and desktop) in the settings UI without digging in about:config. With this iOS release, Mozilla is just changing the default value. https://support.mozilla.org/kb/tracking-protection-ios https://support.mozilla.org/kb/tracking-protection-ios
- bugmen0t 9y ago
  As soon as apple allows to ship an actual browser engine on the ap store. Until then Firefox for iOS - like every other browser on iOS - has to build on top of platform WebKit/WebView APIs
  - zitterbewegung 9y ago
    Yea but why not make the url about:config just go to a configuration page of the browser for the time being?
    - st3fan 9y ago
      What would be the advantage of that? Functionally that is the same as tapping the application menu and then choosing 'settings'. If there is something specific you would like to see exposed in about:config that is currently not available in settings, let us know.
      - zitterbewegung 9y ago
        Sorry, I didn't mean that it would be an actual feature request. The grandparent poster wanted about:config and I proposed that it do that. I don't actually think it has any advantage overall.
- st3fan 9y ago
  Why? What do you want mess with in about:config? We have been talking about an 'advanced settings' section for things that most users don't want to change, but we don't have enough feedback yet to understand what should go in there. Let us know.
tpush 9y ago
Is there any reason for using Firefox on iOS as opposed to Safari? I'm guessing sync'ing history and stuff with the desktop version; but apart form that?
- syrgian 9y ago
  Firefox on Android has plugins (such as uBlock). I assume it's the same on iOS.
  - Anon1096 9y ago
    It does not; Apple does not allow code execution outside of its app store.
    - vbezhenar 9y ago
      Apple allows limited code execution. You can build cordova application and download new JavaScript code as an update. That's fine from Apple's PoV. They don't allow arbitrary machine code execution, like someone getting into AppStore and then downloading and executing malicious code calling private API. But if your code is run with JavaScript engine, it's fine. Now I don't know about possibility of implementing browser plugins. I guess that it should be possible, but API would be different from other platforms.
  - quadrangle 9y ago
    Firefox on iOS doesn't even exist really, it's a lie. It's a Firefox front-end to Safari designed just to look a certain way and sync settings and bookmarks. Apple won't allow anything more, it's not Mozilla's fault.
    - st3fan 9y ago
      Is the only thing that defines a browser its underlying rendering engine? I hope that there are other things that make a product unique. Like features or defaults or what it looks like.
yuhong 9y ago
Mozilla is one of my main topics of my essay: http://yuhongbao.blogspot.ca/2018/04/google-doubleclick-mozilla-essay-final.html http://yuhongbao.blogspot.ca/2018/04/google-doubleclick-mozi...
guelo 9y ago
Can't tracking just move to the servers if it becomes too hard on the clients?
- fenwick67 9y ago
  The next step in the tracking arms-race might involve more difficult solutions, like integrating the tracking scripts into the host site's client-side javascript and the host site's servers, then forwarding to the third party's sites. But these are way more expensive and involved for hosts than "put this one script tag on each page".
- mcny 9y ago
  (pure speculation follows, I do not work in the ad industry) Lets say I run a website lets say youtube.com or whatever. I want to serve ads. I have to go to a marketplace like double click where advertisers bid for ads. In an ideal world, the client web browser will never talk to double click. When I serve a website, I will also serve the advertising myself from my own web servers using just html and css (no javascript). We can do a lot of flashy things using css animations so it shouldn't be a problem. If I really want my users to go away, maybe I can even serve video ads. I will simply get the ads from the marketplace and tell them I served an ad. However, reality is not that simple. If they let me do that, then I will have strong incentives to just lie. I probably won't do it for a while but after a bit the temptation to lie just becomes too great. Of course, I had twenty trillion page views yesterday. Why not? I am not saying youtube.com lies (and it would be trivial for Google to check if they did because they own YouTube). I am confident Google is probably the most upstanding member of the prominent players in the ad game. However, how can an advertiser trust some random website? I don't think advertisers will trust them. I think we can get rid of a lot of problems in advertising by simply prohibiting any kind of javascript in advertisements. I don't know how though. https://static.doubleclick.net/instream/ad_status.js https://static.doubleclick.net/instream/ad_status.js for example take a look at a more benign website https://i.imgur.com/KS3gjMV.png https://i.imgur.com/KS3gjMV.png and compare it to this website https://news.ycombinator.com https://news.ycombinator.com what if we could get rid of all the calls to third party servers? Thoughts?
  - 9y ago
JumpCrisscross 9y ago
What’s the difference between this and browsing using Safari with “Prevent Cross-Site Tracking” turned on?
- Area12 9y ago
  The default setting, because 95% of the world will never change it. If Safari and Chrome and Android followed suit, the ripple effect would change a lot of things on the web. I'm not sure what the final result would be ... greedy people get to innovate too.
- andrewaylett 9y ago
  As I understand things, Prevent Cross Site Tracking allows all requests, but blocks all third-party cookies. This allows cookies on requests it makes, but blocks requests that match a commonly-used blacklist.
jiveturkey 9y ago
eh, not compelling enough for me. Is there any evaluation of these kinds of blockers? 1Blocker with Safari seems quite good, and does ad blocking as well.
JackCh 9y ago
Are there any consumer-centric arguments against this being the default, or is this generally considered to be good for users? I've heard the argument against setting the DNT field by default (https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer_10_default_setting_controversy https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer...) so I'm wondering if there are any similar arguments in this case. Presumably Tracking Protection doesn't rely on the honor system, but might being a default spurn the development of countermeasures to circumvent it?
- vbezhenar 9y ago
  One consumer centric argument that I've heard is that some people like targeted ads.
  - robryan 9y ago
    Would be interesting to see how many people would optin to see retaregeted ads though.
- _rpd 9y ago
  > Are there any consumer-centric arguments against this being the default You can use the same arguments that support the census. Corporations need good data to know where to invest. > might being a default spurn the development of countermeasures to circumvent it? Certainly. This is an endless arms race.
- eli 9y ago
  There are websites that break or don't work as expected with an AdBlock plugin. We had to redesign the section of our site that talked about advertising because various AdBlock plugins blocked chunks of the page or disabled the javascript for the contact form. This was very confusing to users even though they presumably made a choice to install an ad blocking plugin. The specifics of how Firefox has implemented this feature are fairly conservative so that's less likely, but I think you need to be really careful about blocking certain lists of domains by default.
awat 9y ago
This is excellent news defaults make a big statement. I’ve been using Firefox Focus on iOS as my daily browser for a few months and its been great.
dzonga 9y ago
I don't get the point of 3rd party browsers on iOS. When Apple doesn't allow vendors to use their own engines. I think Apple should be taken to court over that matter. Safari on iOS is the same as IE on Windows in the early noughts. If Apple could grant Uber privileged API access, i'm sure they can give Mozilla and Google the same permissions to build independent browsers on iOS.
- grub5000 9y ago
  It's so they can do exactly this sort of thing. Firefox has their won chrome wrapper on the engine, you can sign in with their sync account and it has inbuilt Pocket, tracking protection etc.
- nothrabannosir 9y ago
  > I think Apple should be taken to court over that matter. Safari on iOS is the same as IE on Windows in the early noughts. The law you’re referring to is “using a monopoly in one area to gain an advantage in another.” Crucial word being: monopoly. iOS is not a monopoly in the mobile market. Windows had 300 000% of the market, iOS has around… 20% worldwide? Let’s be generous and double it to 40%: still a far cry from a monopoly.
  - bgarbiak 9y ago
    IANAL, but: iOS is not a monopoly, but it has a dominant position, especially in US (over or close to 50% market share). For tablets their market share is even bigger than that. That should be enough to at least consider some actions, on some level, by someone. Google and Mozilla could sue, I guess? On the other hand, Apple making it a security issue could be a solid defense in court, maybe that's why no one bothers.
  - dragonwriter 9y ago
    > iOS is not a monopoly in the mobile market. Whether iOS is a legal monopoly does not depend on market share in a common descriptive market segment, but instead in whether it in fact has market (pricing) power; that is, an antitrust market is in effect defined by where substitution actually occurs with price changes, not on how media/analysts describe markets based on product characteristics.
abalone 9y ago
How does this compare to Safari's intelligent tracking protection that came out last year? That uses ML and sounds like it's considerably more sophisticated, allowing certain forms of desirable cross-site tracking and not relying on a centralized blocklist.[1] [1] https://webkit.org/blog/7675/intelligent-tracking-prevention/ https://webkit.org/blog/7675/intelligent-tracking-prevention...
- LeoPanthera 9y ago
  Firefox simply uses the Disconnect.me tracker list, and prevents connections to anything on it. It's basically a DNSBL. I want to know how it compares to the EasyPrivacy list.
  - deleted 9y ago
    [deleted]

268 points by cpeterso 9y ago

Took them long enough, glad they're becoming a bit braver (almost like Brave :p). Any plans for desktop though...? After all, desktop seems to be the main platform for Mozilla.

piracykills 9y ago
They might just be looking for some way to differentiate themselves on iOS given Apple's policy of not allowing 3rd party rendering engines.
AtomicOrbital 9y ago
on android ff is by far the best browser for usability especially tab management ... chrome is a decided non starter on that OS
- cptskippy 9y ago
  I'm inclined to agree. It runs beautifully on my Nextbit Robin. My wife however has nothing but problems with it on her Google Pixel.
- megaman22 9y ago
  Switching from default Chrome to Brave on Android has been the best thing I've ever done on my phone. May have to check out how FF compares
  - lukaa 9y ago
    Brave is great but until they include dark mode I'll stick with Chromium from F-droid.
progval 9y ago
It looks like they want to turn this on incrementally. First private browsing, now this. It gives web developers time to notice issues with their websites/webapps and fix/report them.
- StavrosK 9y ago
  I would very much love it if Privacy Badger were included by default in browsers (or at least something with similar functionality).
callahad 9y ago
Desktop also has tracking protection by default in private browsing windows. See Preferences -> Privacy -> Tracking Protection to enable it everywhere. Per the roadmap at https://wiki.mozilla.org/Firefox/Roadmap https://wiki.mozilla.org/Firefox/Roadmap, we're explicitly working toward making Firefox more opinionated in 2018. Specifically, "Firefox will take a stand against tracking," will "filter certain types of ads by default," and will "block ad re-targeting."
deleted 9y ago
[deleted]
Sylos 9y ago
The reason why Brave can be Brave, is because it can hide under Chrome. Webpage owners will build their webpages Chrome-compatible, which makes them Brave-compatible, so whether they make any money off of supporting Brave is unimportant. Mozilla can't do the same with Firefox, because they don't have anything to hide under. They rely on webpage owners making money off of Firefox, otherwise they're not going to build/test against Firefox. Mozilla can be Brave with Firefox for iOS, and with Firefox Focus as well, because there they don't use Gecko as layout engine, they hide underneath someone else's layout engine. (Apple forces other browsers to use WebKit on iOS; Firefox Focus for Android uses Android Webview because it keeps the binary small, which is important as it's sort of meant to be a secondary browser.) So, they're most definitely not doing the same for desktop and Android Firefox. It would kill Firefox/Gecko in no time, if they did that. It wouldn't be brave, it'd be suicide.
- TazeTSchnitzel 9y ago
  Apple has, well, courage to enable some anti-tracking features by default in desktop Safari. But of course Mobile Safari is so ubiquitous they know sites must continue supporting their engine.

mobydickship 9y ago

about:config - when?

cpeterso 9y ago
You can already enable Tracking Protection in Firefox for iOS (and Android and desktop) in the settings UI without digging in about:config. With this iOS release, Mozilla is just changing the default value. https://support.mozilla.org/kb/tracking-protection-ios https://support.mozilla.org/kb/tracking-protection-ios
bugmen0t 9y ago
As soon as apple allows to ship an actual browser engine on the ap store. Until then Firefox for iOS - like every other browser on iOS - has to build on top of platform WebKit/WebView APIs
- zitterbewegung 9y ago
  Yea but why not make the url about:config just go to a configuration page of the browser for the time being?
  - st3fan 9y ago
    What would be the advantage of that? Functionally that is the same as tapping the application menu and then choosing 'settings'. If there is something specific you would like to see exposed in about:config that is currently not available in settings, let us know.
    - zitterbewegung 9y ago
      Sorry, I didn't mean that it would be an actual feature request. The grandparent poster wanted about:config and I proposed that it do that. I don't actually think it has any advantage overall.
st3fan 9y ago
Why? What do you want mess with in about:config? We have been talking about an 'advanced settings' section for things that most users don't want to change, but we don't have enough feedback yet to understand what should go in there. Let us know.

tpush 9y ago

Is there any reason for using Firefox on iOS as opposed to Safari? I'm guessing sync'ing history and stuff with the desktop version; but apart form that?

syrgian 9y ago
Firefox on Android has plugins (such as uBlock). I assume it's the same on iOS.
- Anon1096 9y ago
  It does not; Apple does not allow code execution outside of its app store.
  - vbezhenar 9y ago
    Apple allows limited code execution. You can build cordova application and download new JavaScript code as an update. That's fine from Apple's PoV. They don't allow arbitrary machine code execution, like someone getting into AppStore and then downloading and executing malicious code calling private API. But if your code is run with JavaScript engine, it's fine. Now I don't know about possibility of implementing browser plugins. I guess that it should be possible, but API would be different from other platforms.
- quadrangle 9y ago
  Firefox on iOS doesn't even exist really, it's a lie. It's a Firefox front-end to Safari designed just to look a certain way and sync settings and bookmarks. Apple won't allow anything more, it's not Mozilla's fault.
  - st3fan 9y ago
    Is the only thing that defines a browser its underlying rendering engine? I hope that there are other things that make a product unique. Like features or defaults or what it looks like.

yuhong 9y ago

Mozilla is one of my main topics of my essay: http://yuhongbao.blogspot.ca/2018/04/google-doubleclick-mozilla-essay-final.html http://yuhongbao.blogspot.ca/2018/04/google-doubleclick-mozi...

guelo 9y ago

Can't tracking just move to the servers if it becomes too hard on the clients?

fenwick67 9y ago
The next step in the tracking arms-race might involve more difficult solutions, like integrating the tracking scripts into the host site's client-side javascript and the host site's servers, then forwarding to the third party's sites. But these are way more expensive and involved for hosts than "put this one script tag on each page".
mcny 9y ago
(pure speculation follows, I do not work in the ad industry) Lets say I run a website lets say youtube.com or whatever. I want to serve ads. I have to go to a marketplace like double click where advertisers bid for ads. In an ideal world, the client web browser will never talk to double click. When I serve a website, I will also serve the advertising myself from my own web servers using just html and css (no javascript). We can do a lot of flashy things using css animations so it shouldn't be a problem. If I really want my users to go away, maybe I can even serve video ads. I will simply get the ads from the marketplace and tell them I served an ad. However, reality is not that simple. If they let me do that, then I will have strong incentives to just lie. I probably won't do it for a while but after a bit the temptation to lie just becomes too great. Of course, I had twenty trillion page views yesterday. Why not? I am not saying youtube.com lies (and it would be trivial for Google to check if they did because they own YouTube). I am confident Google is probably the most upstanding member of the prominent players in the ad game. However, how can an advertiser trust some random website? I don't think advertisers will trust them. I think we can get rid of a lot of problems in advertising by simply prohibiting any kind of javascript in advertisements. I don't know how though. https://static.doubleclick.net/instream/ad_status.js https://static.doubleclick.net/instream/ad_status.js for example take a look at a more benign website https://i.imgur.com/KS3gjMV.png https://i.imgur.com/KS3gjMV.png and compare it to this website https://news.ycombinator.com https://news.ycombinator.com what if we could get rid of all the calls to third party servers? Thoughts?
- 9y ago

JumpCrisscross 9y ago

What’s the difference between this and browsing using Safari with “Prevent Cross-Site Tracking” turned on?

Area12 9y ago
The default setting, because 95% of the world will never change it. If Safari and Chrome and Android followed suit, the ripple effect would change a lot of things on the web. I'm not sure what the final result would be ... greedy people get to innovate too.
andrewaylett 9y ago
As I understand things, Prevent Cross Site Tracking allows all requests, but blocks all third-party cookies. This allows cookies on requests it makes, but blocks requests that match a commonly-used blacklist.

jiveturkey 9y ago

eh, not compelling enough for me. Is there any evaluation of these kinds of blockers? 1Blocker with Safari seems quite good, and does ad blocking as well.

JackCh 9y ago

Are there any consumer-centric arguments against this being the default, or is this generally considered to be good for users? I've heard the argument against setting the DNT field by default (https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer_10_default_setting_controversy https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer...) so I'm wondering if there are any similar arguments in this case. Presumably Tracking Protection doesn't rely on the honor system, but might being a default spurn the development of countermeasures to circumvent it?

vbezhenar 9y ago
One consumer centric argument that I've heard is that some people like targeted ads.
- robryan 9y ago
  Would be interesting to see how many people would optin to see retaregeted ads though.
_rpd 9y ago
> Are there any consumer-centric arguments against this being the default You can use the same arguments that support the census. Corporations need good data to know where to invest. > might being a default spurn the development of countermeasures to circumvent it? Certainly. This is an endless arms race.
eli 9y ago
There are websites that break or don't work as expected with an AdBlock plugin. We had to redesign the section of our site that talked about advertising because various AdBlock plugins blocked chunks of the page or disabled the javascript for the contact form. This was very confusing to users even though they presumably made a choice to install an ad blocking plugin. The specifics of how Firefox has implemented this feature are fairly conservative so that's less likely, but I think you need to be really careful about blocking certain lists of domains by default.

awat 9y ago

This is excellent news defaults make a big statement. I’ve been using Firefox Focus on iOS as my daily browser for a few months and its been great.

dzonga 9y ago

I don't get the point of 3rd party browsers on iOS. When Apple doesn't allow vendors to use their own engines. I think Apple should be taken to court over that matter. Safari on iOS is the same as IE on Windows in the early noughts. If Apple could grant Uber privileged API access, i'm sure they can give Mozilla and Google the same permissions to build independent browsers on iOS.

grub5000 9y ago
It's so they can do exactly this sort of thing. Firefox has their won chrome wrapper on the engine, you can sign in with their sync account and it has inbuilt Pocket, tracking protection etc.
nothrabannosir 9y ago
> I think Apple should be taken to court over that matter. Safari on iOS is the same as IE on Windows in the early noughts. The law you’re referring to is “using a monopoly in one area to gain an advantage in another.” Crucial word being: monopoly. iOS is not a monopoly in the mobile market. Windows had 300 000% of the market, iOS has around… 20% worldwide? Let’s be generous and double it to 40%: still a far cry from a monopoly.
- bgarbiak 9y ago
  IANAL, but: iOS is not a monopoly, but it has a dominant position, especially in US (over or close to 50% market share). For tablets their market share is even bigger than that. That should be enough to at least consider some actions, on some level, by someone. Google and Mozilla could sue, I guess? On the other hand, Apple making it a security issue could be a solid defense in court, maybe that's why no one bothers.
- dragonwriter 9y ago
  > iOS is not a monopoly in the mobile market. Whether iOS is a legal monopoly does not depend on market share in a common descriptive market segment, but instead in whether it in fact has market (pricing) power; that is, an antitrust market is in effect defined by where substitution actually occurs with price changes, not on how media/analysts describe markets based on product characteristics.

abalone 9y ago

How does this compare to Safari's intelligent tracking protection that came out last year? That uses ML and sounds like it's considerably more sophisticated, allowing certain forms of desirable cross-site tracking and not relying on a centralized blocklist.[1] [1] https://webkit.org/blog/7675/intelligent-tracking-prevention/ https://webkit.org/blog/7675/intelligent-tracking-prevention...

LeoPanthera 9y ago
Firefox simply uses the Disconnect.me tracker list, and prevents connections to anything on it. It's basically a DNSBL. I want to know how it compares to the EasyPrivacy list.
- deleted 9y ago
  [deleted]