4 ms·

Telemetry is reported centrally to Mozilla, so we could theoretically observe individual responses as they came in, even if we only wanted to analyze the data i

Telemetry is reported centrally to Mozilla, so we could theoretically observe individual responses as they came in, even if we only wanted to analyze the data in aggregate. Prio uses cryptography to ensure that no one, not even the receiving servers, can see individual responses; the only way to view the data is in aggregate. We need telemetry to make competitive products, but we also want to ensure that we don't see any of your personal data that you don't explicitly opt-in to us seeing. Similarly, we store all Firefox Sync data in a way that makes it impossible for us to decrypt: your data is your data. In contrast, Chrome defaults to allowing Google to read your synced browsing data, which Google explicitly uses to profile you for targeted advertisements. Edit: If you're interested, you can find Mozilla's Data Collection policies and procedures at https://wiki.mozilla.org/Firefox/Data_Collection https://wiki.mozilla.org/Firefox/Data_Collection

a_imho 8y ago
even if we only wanted to analyze the data in aggregate. Does moz://a do this? Analyze data in aggregate exclusively? Otherwise I understand Prio is inferior in granularity to Telemetry? How should one interpret data aggregation of Category 4 “Highly sensitive data”? Put it in another way, is it possible to trace back data to individuals from aggregations or any other way? We need telemetry to make competitive products Personally I disagree with this. I consider privacy and the lack of bundled (spy|mal|ad|telemetry)ware a competitive edge.
- callahad 8y ago
  Not exclusively, but quoting the article, "for most purposes we don’t need to collect individual data, but rather only aggregates. [...] Once we’ve validated that [Prio]’s working as expected and provides the privacy guarantees we require, we can move forward in applying it where it is needed most." So we'll be able to apply Prio where it makes sense, but stick with the current Telemetry pipeline where it doesn't. I'm not a cryptographer, but from skimming the paper and slides at https://www.henrycg.com/pubs/nsdi17prio/ https://www.henrycg.com/pubs/nsdi17prio/, my naive understanding is that it would be practically impossible to trace back individual data from those aggregations as long as TLS works and at least one of the receiving servers is operating honestly.
- betterunix2 8y ago
  "is it possible to trace back data to individuals from aggregations or any other way?" It depends on what the aggregation function is and how many user inputs you collected before computing the aggregate. Strictly speaking you are asking a differential privacy question, but a typical use of something like Prio would be to compute an average, which is a very lossy function. If I tell you that among 10000 users it takes an average of 500ms to load a web page, you are not learning much about individuals (especially since I said nothing about the variance). What Prio does is to ensure that nobody will see raw user data, while still allowing aggregate information to be computed and allowing the inputs to be validated. In other words, the fact that you are focusing on what the output will reveal is a sign that on some level you trust Prio to do exactly what it is designed to do as a mechanism for protecting user data.

a_imho 8y ago

even if we only wanted to analyze the data in aggregate. Does moz://a do this? Analyze data in aggregate exclusively? Otherwise I understand Prio is inferior in granularity to Telemetry? How should one interpret data aggregation of Category 4 “Highly sensitive data”? Put it in another way, is it possible to trace back data to individuals from aggregations or any other way? We need telemetry to make competitive products Personally I disagree with this. I consider privacy and the lack of bundled (spy|mal|ad|telemetry)ware a competitive edge.

callahad 8y ago
Not exclusively, but quoting the article, "for most purposes we don’t need to collect individual data, but rather only aggregates. [...] Once we’ve validated that [Prio]’s working as expected and provides the privacy guarantees we require, we can move forward in applying it where it is needed most." So we'll be able to apply Prio where it makes sense, but stick with the current Telemetry pipeline where it doesn't. I'm not a cryptographer, but from skimming the paper and slides at https://www.henrycg.com/pubs/nsdi17prio/ https://www.henrycg.com/pubs/nsdi17prio/, my naive understanding is that it would be practically impossible to trace back individual data from those aggregations as long as TLS works and at least one of the receiving servers is operating honestly.
betterunix2 8y ago
"is it possible to trace back data to individuals from aggregations or any other way?" It depends on what the aggregation function is and how many user inputs you collected before computing the aggregate. Strictly speaking you are asking a differential privacy question, but a typical use of something like Prio would be to compute an average, which is a very lossy function. If I tell you that among 10000 users it takes an average of 500ms to load a web page, you are not learning much about individuals (especially since I said nothing about the variance). What Prio does is to ensure that nobody will see raw user data, while still allowing aggregate information to be computed and allowing the inputs to be validated. In other words, the fact that you are focusing on what the output will reveal is a sign that on some level you trust Prio to do exactly what it is designed to do as a mechanism for protecting user data.