10 ms·

Privacy not included: Holiday gift list for privacy and security

153 points by tareqak 8y ago

closetohome 8y ago
I don't see the purpose of this page. It's not a guide, it's a poll. Why would I base my decisions about personal privacy on the uninformed opinions of a bunch of random people?
- sazfedjhrgnukc 8y ago
  It's a poll because this way Mozilla wont have to, be held responsible for, not defend any of the opinions presented there. > We created this guide to help you buy safe, secure products this holiday season. Because "we created this poll so you can see what other people think is safe, secure products this holiday season" doesn't sound nearly as good. So they made a guide, that's really a poll. What do you mean you can have your cake and eat it too?
NickBusey 8y ago
I think this page shows some of the disconnect between the people raising the privacy alarm and your average consumer. The page looks to be targeted at consumers, with the 'creepy' meter that changes as you scroll. However the PS4 and Xbox are considered 'A little creepy' and a sous vide cooker is listed as 'Somewhat creepy'. Despite the arguments made on the respective pages for why they are creepy (generally "Shares your information with 3rd parties for unexpected reasons") I don't think any consumer on the planet is going to consider any of those gifts even slightly creepy. In my opinion it weakens the argument for the legitimately creepy products when such innocuous things are included in the list.
- thfuran 8y ago
  Perhaps, but I don't think the solution to the ever-increasing number of devices collecting and distributing ever-increasing amounts of personal data is to shrug and say "well, at least it's not as intrusive as my toaster. Now there's some Orwellian shit". I think it is useful in and of itself to make people aware of the sorts of data that is collected and shared by devices most people don't consider at all related to privacy.
- thisone 8y ago
  take the nest 'has parental controls': can't determine well, it's a blooming thermostat. You can lock the thing out. That's more 'parental control' than any standard thermostat. creepy meter? as a gift for a non-family member? yeah, that's weird.
  - Spivak 8y ago
    Standard anecdata disclaimer but Nests are a pretty universally liked gift in my circle. It passes the bar of being cool, tasteful, useful, and unlikely that the recipient would purchase one for themselves.
- esotericn 8y ago
  We know there's a disconnect. That's exactly the problem. Without discussing these things, the bar for 'normal' will simply continue moving. Consider that in 2018 the term 'spyware' has essentially become meaningless because outside of FOSS products for power users and a few systems for enterprise _everything_ is doing it. I won't buy my family products that spy on them and will recommend them against buying such. They need a moderating influence that understands the issues and doesn't have a vested interest in screwing them over like advertisers do.
- xoa 8y ago
  Agreed. Just for starters, there are two tied bad practices here. One is that the "creepy mater" is based on "user ratings" apparently despite being a curated Mozilla branded list. That immediately opens it up too all the normal random masses using it as a medium for non-relevant opinions, trolling, etc. Further it means that they have a list with nothing at all that isn't "A little creepy" so even if someone thinks "well then what should I buy?" there is no answer, which invites a "well whatever" attitude in and of itself. Further as you point to, a lot of the "creepiness" factor is a function of the delta between expectations and reality, ie. how surprising it is, and the extent to which it's perceived to be avoidable. That can be different then absolute measures of how objectionable something is. To take your example, an internet connected game console these days has some upfront expectation of data collection by virtue of the profile and social features that are right there front and center. Since it's also generally static in a fixed location and used only for a specific purpose, the surprise factor of most of its privacy issues is inherently lower, and the data collection less passive. A cooking tool though might be a lot more subject to surprise at what it's doing. This list definitely feels very shallow and disconnected from any deeper reasoning about specific security practices, business models, whether a net connection is actually required or not, etc. It's a popularity poll at best, and the actionable advice is minimal. It's a bit disappointing coming from Mozilla, at least to the extent that it's a wasted opportunity on something that the public is growing more aware of.
amelius 8y ago
By the way I think this Santa guy himself is high on the creepiness scale when it comes to privacy infringement :)
SilasX 8y ago
Firefox web browser: [X] Can install extensions without my knowledge or consent that do not explain their functionality, and were added based on pressure from the marketing team. https://news.ycombinator.com/item?id=15956325 https://news.ycombinator.com/item?id=15956325 Edit: Am I being unfair here?
- brlewis 8y ago
  I think you're being unfair. "This add-on was installed and set to ‘OFF’ and made no changes in the user experience unless it was explicitly turned on by a user, but it was added. Even when turned on no user data was collected or shared."
  - SilasX 8y ago
    What part of my description does that contradict? Edit: Also, the "no data was shared" is a lie or two inches short of one. It injected http headers on requests to NBC sites once activated. No one was logging that?
    - brlewis 8y ago
      The unfairness is to raise such a minor issue compared to the issues this holiday gift list is intended to address.
      - mediocrejoker 8y ago
        Who gets to decide what is a minor issue? I think Mozilla has had a couple of privacy missteps lately so perhaps they should not be casting stones.
      - sazfedjhrgnukc 8y ago
        Mozilla is not allowed to get away with being a little bit shady because they ultimately have good intention. There is a price to pay to be the "good guy". If Mozilla doesn't want to be good they don't have to be. They don't have to make the mistake Google did.
RcouF1uZ4gsC 8y ago
This is kind of like the boy that cried wolf: Thy are listing the PS4 and XBox as a "a little creepy" They are listing Apple iPad, Apple Watch, Apple TV, Apple Air Pods, Roku, ChromeCast, and Kindle as "somewhat creepy". I am concerned about my privacy and avoid "smart" speakers, appliances, etc, but do not find the devices I listed above "creepy".
- brlewis 8y ago
  Do you trust the xbox one to keep its microphone always off? I own one but do find it a little creepy. I keep the kinect turned around away from the room, and have the setting to make it turn fully off. This means annoying waits sometimes when it insists on a software update when turned on, but I think the setting is worth it.
krferriter 8y ago
I don't really get some of these ratings. They give a thumbs-down to fitbit and other gps watches because they track location and speed, etc. Yes that is the entire purpose of buying those products, so I don't really get the presenting of that as a negative feature. It's like rating an email app poorly because it processes your emails.
- brlewis 8y ago
  Disclaimer: I work for Fitbit but speak only for myself. The guide says of Fitbit Versa, "Shares your information with 3rd parties for unexpected reasons: yes". This is false. The rating may just be by vote, but there's no excuse for getting the facts wrong.
  - lozaning 8y ago
    Zigbee devices don't use the security of your home wifi for encryption either. There are many technical inaccuracies across the ratings.
  - mediocrejoker 8y ago
    Just to play devil's advocate, does Fitbit Versa share your information with third parties for any reason, expected or otherwise?
    - brlewis 8y ago
      https://www.fitbit.com/legal/privacy-policy#how-info-is-shared https://www.fitbit.com/legal/privacy-policy#how-info-is-shar...
      - function_seven 8y ago
        Let me condense that to the relevant bit. All emphasis is mine. > How Information Is Shared > We do not share your personal information except in the limited circumstances described below. > For External Processing > We transfer information to our corporate affiliates, service providers, and other partners (so, basically anybody) who process it for us, based on our instructions, and in compliance with this policy and any other appropriate confidentiality and security measures. These partners provide us with services globally, including for customer support, information technology, payments, sales, marketing, data analysis, research (so we can ad target you), and surveys. If I buy a gadget to track my personal exercise routine, it is definitely unexpected that my whereabouts are being monitored by advertising companies. Does Apple do the same with their fitness data on the watch?
bhauer 8y ago
I see this as nothing more than a fun poke by Mozilla at the overwhelming majority of the technology industry—those who treat privacy as a nuisance at best and as a non-event at worst. Mozilla are giving people like myself the fun of clicking on the Amazon Echo or Google Home and voting "Super creepy," chuckling to ourselves about our virtuousness before closing the tab in Firefox. I doubt they expect this page to be used by many laypeople. Maybe a few techies will toss a link out to their families as a rough crowdsourced assessment of the degree to which some popular devices respect user privacy. The inclusion of several nearly-unknown high-privacy options seems to be a reminder that there are alternatives; probably more difficult to use or less capable, but alternatives to the mainstream data-harvesting devices you see routinely advertised. I think it's lighthearted fun intended to illustrate Mozilla's mission of being advocates for privacy, to a degree that we have become unfamiliar as a society in the age of everything-as-a-service. Yeah, there are probably some inaccuracies. But frankly, unless you're selling a device that allows you to run the services on your own host using open source software (the way Mozilla does [1]), it's fair game to say that it's possible you are not sufficiently respecting user privacy. How can we as users be sure if all we can measure is that, indeed, the device sends data off-network to the "cloud?" If you genuinely respect user privacy, you should allow a user to wholly own the data in the most pure form possible: they never send it to you. [1] https://github.com/mozilla-services https://github.com/mozilla-services
- variable11 8y ago
  I think it's an important list, even if somewhat sloppy. It would be to everyone's advantage if product reviewers like Consumer Reports, various tech columnists, blogs and so on, got the message that privacy matters. They need to start including privacy as a component of their review. Pressure for companies to go green has worked over time; pressure for companies to go "quiet" -- that is pro-privacy -- could have the same effect.
dualboot 8y ago
The most disturbing thing about the state of privacy is the households that purchase a multitude of devices that collect, link, and resell data about you. As an example, Imagine the household that has multiple gmail accounts, multiple android phones, everyone uses google maps, Chrome on every desktop, google for search, they add a Nest thermostat, a few Dropcams, and for good measure they use 8.8.8.8 and 4.4.4.4 for all of their DNS queries. You can live in nearly the same world with Amazon and others. Sigh.
tfmatt 8y ago
How is the Roku on this list? I have a pihole setup to do network level adblocking and telemetry disabling and the Roku is the absolute worst device. Thousands and "phone homes" per day that are not needed for the device to function properly. I can only assume it is feeding data back to the mothership at a very high rate.
quickthrower2 8y ago
About the voting system: 1. Anonymous 2. Hard to game 3. User privacy Pick two!
a_imho 8y ago
Privacy should be a non issue with strictly enforced GDPR, for Europeans at least.
Animats 8y ago
The first time I saw an Elf on the Shelf in boxed form, and how heavy the box was, I assumed it had a surveillance camera in it. Apparently it doesn't, usually.
scarejunba 8y ago
My favourite thing about these lists is that they're dominated by the views of mild paranoiacs. A normal person will open the page, see a frowny face next to an Xbox One, and decide that the list is bullshit. Most privacy advocates are the strongest enemies of their own causes. They only accept purity and it encourages everyone to ignore them.
Monika3344 8y ago
Good list! With the holidays coming up I have already started thinking about choosing gifts for my family and friends. I have already bought a tribal skull carved leather biker wallet (https://www.bikerringshop.com/products/tribal-skull-carved-leather-biker-wallet https://www.bikerringshop.com/products/tribal-skull-carved-l...) for my husband. Now I'm looking for the ideas for other people I want to present. So, thanks for sharing, I'll look through this list one more time and I'm sure I'll find something useful there. Thanks!
deleted 8y ago
[deleted]

153 points by tareqak 8y ago

I don't see the purpose of this page. It's not a guide, it's a poll. Why would I base my decisions about personal privacy on the uninformed opinions of a bunch of random people?

sazfedjhrgnukc 8y ago
It's a poll because this way Mozilla wont have to, be held responsible for, not defend any of the opinions presented there. > We created this guide to help you buy safe, secure products this holiday season. Because "we created this poll so you can see what other people think is safe, secure products this holiday season" doesn't sound nearly as good. So they made a guide, that's really a poll. What do you mean you can have your cake and eat it too?

NickBusey 8y ago

I think this page shows some of the disconnect between the people raising the privacy alarm and your average consumer. The page looks to be targeted at consumers, with the 'creepy' meter that changes as you scroll. However the PS4 and Xbox are considered 'A little creepy' and a sous vide cooker is listed as 'Somewhat creepy'. Despite the arguments made on the respective pages for why they are creepy (generally "Shares your information with 3rd parties for unexpected reasons") I don't think any consumer on the planet is going to consider any of those gifts even slightly creepy. In my opinion it weakens the argument for the legitimately creepy products when such innocuous things are included in the list.

thfuran 8y ago
Perhaps, but I don't think the solution to the ever-increasing number of devices collecting and distributing ever-increasing amounts of personal data is to shrug and say "well, at least it's not as intrusive as my toaster. Now there's some Orwellian shit". I think it is useful in and of itself to make people aware of the sorts of data that is collected and shared by devices most people don't consider at all related to privacy.
thisone 8y ago
take the nest 'has parental controls': can't determine well, it's a blooming thermostat. You can lock the thing out. That's more 'parental control' than any standard thermostat. creepy meter? as a gift for a non-family member? yeah, that's weird.
- Spivak 8y ago
  Standard anecdata disclaimer but Nests are a pretty universally liked gift in my circle. It passes the bar of being cool, tasteful, useful, and unlikely that the recipient would purchase one for themselves.
esotericn 8y ago
We know there's a disconnect. That's exactly the problem. Without discussing these things, the bar for 'normal' will simply continue moving. Consider that in 2018 the term 'spyware' has essentially become meaningless because outside of FOSS products for power users and a few systems for enterprise _everything_ is doing it. I won't buy my family products that spy on them and will recommend them against buying such. They need a moderating influence that understands the issues and doesn't have a vested interest in screwing them over like advertisers do.
xoa 8y ago
Agreed. Just for starters, there are two tied bad practices here. One is that the "creepy mater" is based on "user ratings" apparently despite being a curated Mozilla branded list. That immediately opens it up too all the normal random masses using it as a medium for non-relevant opinions, trolling, etc. Further it means that they have a list with nothing at all that isn't "A little creepy" so even if someone thinks "well then what should I buy?" there is no answer, which invites a "well whatever" attitude in and of itself. Further as you point to, a lot of the "creepiness" factor is a function of the delta between expectations and reality, ie. how surprising it is, and the extent to which it's perceived to be avoidable. That can be different then absolute measures of how objectionable something is. To take your example, an internet connected game console these days has some upfront expectation of data collection by virtue of the profile and social features that are right there front and center. Since it's also generally static in a fixed location and used only for a specific purpose, the surprise factor of most of its privacy issues is inherently lower, and the data collection less passive. A cooking tool though might be a lot more subject to surprise at what it's doing. This list definitely feels very shallow and disconnected from any deeper reasoning about specific security practices, business models, whether a net connection is actually required or not, etc. It's a popularity poll at best, and the actionable advice is minimal. It's a bit disappointing coming from Mozilla, at least to the extent that it's a wasted opportunity on something that the public is growing more aware of.

amelius 8y ago

By the way I think this Santa guy himself is high on the creepiness scale when it comes to privacy infringement :)

SilasX 8y ago

Firefox web browser: [X] Can install extensions without my knowledge or consent that do not explain their functionality, and were added based on pressure from the marketing team. https://news.ycombinator.com/item?id=15956325 https://news.ycombinator.com/item?id=15956325 Edit: Am I being unfair here?

brlewis 8y ago
I think you're being unfair. "This add-on was installed and set to ‘OFF’ and made no changes in the user experience unless it was explicitly turned on by a user, but it was added. Even when turned on no user data was collected or shared."
- SilasX 8y ago
  What part of my description does that contradict? Edit: Also, the "no data was shared" is a lie or two inches short of one. It injected http headers on requests to NBC sites once activated. No one was logging that?
  - brlewis 8y ago
    The unfairness is to raise such a minor issue compared to the issues this holiday gift list is intended to address.
    - mediocrejoker 8y ago
      Who gets to decide what is a minor issue? I think Mozilla has had a couple of privacy missteps lately so perhaps they should not be casting stones.
    - sazfedjhrgnukc 8y ago
      Mozilla is not allowed to get away with being a little bit shady because they ultimately have good intention. There is a price to pay to be the "good guy". If Mozilla doesn't want to be good they don't have to be. They don't have to make the mistake Google did.

RcouF1uZ4gsC 8y ago

This is kind of like the boy that cried wolf: Thy are listing the PS4 and XBox as a "a little creepy" They are listing Apple iPad, Apple Watch, Apple TV, Apple Air Pods, Roku, ChromeCast, and Kindle as "somewhat creepy". I am concerned about my privacy and avoid "smart" speakers, appliances, etc, but do not find the devices I listed above "creepy".

brlewis 8y ago
Do you trust the xbox one to keep its microphone always off? I own one but do find it a little creepy. I keep the kinect turned around away from the room, and have the setting to make it turn fully off. This means annoying waits sometimes when it insists on a software update when turned on, but I think the setting is worth it.

krferriter 8y ago

I don't really get some of these ratings. They give a thumbs-down to fitbit and other gps watches because they track location and speed, etc. Yes that is the entire purpose of buying those products, so I don't really get the presenting of that as a negative feature. It's like rating an email app poorly because it processes your emails.

brlewis 8y ago
Disclaimer: I work for Fitbit but speak only for myself. The guide says of Fitbit Versa, "Shares your information with 3rd parties for unexpected reasons: yes". This is false. The rating may just be by vote, but there's no excuse for getting the facts wrong.
- lozaning 8y ago
  Zigbee devices don't use the security of your home wifi for encryption either. There are many technical inaccuracies across the ratings.
- mediocrejoker 8y ago
  Just to play devil's advocate, does Fitbit Versa share your information with third parties for any reason, expected or otherwise?
  - brlewis 8y ago
    https://www.fitbit.com/legal/privacy-policy#how-info-is-shared https://www.fitbit.com/legal/privacy-policy#how-info-is-shar...
    - function_seven 8y ago
      Let me condense that to the relevant bit. All emphasis is mine. > How Information Is Shared > We do not share your personal information except in the limited circumstances described below. > For External Processing > We transfer information to our corporate affiliates, service providers, and other partners (so, basically anybody) who process it for us, based on our instructions, and in compliance with this policy and any other appropriate confidentiality and security measures. These partners provide us with services globally, including for customer support, information technology, payments, sales, marketing, data analysis, research (so we can ad target you), and surveys. If I buy a gadget to track my personal exercise routine, it is definitely unexpected that my whereabouts are being monitored by advertising companies. Does Apple do the same with their fitness data on the watch?

bhauer 8y ago

I see this as nothing more than a fun poke by Mozilla at the overwhelming majority of the technology industry—those who treat privacy as a nuisance at best and as a non-event at worst. Mozilla are giving people like myself the fun of clicking on the Amazon Echo or Google Home and voting "Super creepy," chuckling to ourselves about our virtuousness before closing the tab in Firefox. I doubt they expect this page to be used by many laypeople. Maybe a few techies will toss a link out to their families as a rough crowdsourced assessment of the degree to which some popular devices respect user privacy. The inclusion of several nearly-unknown high-privacy options seems to be a reminder that there are alternatives; probably more difficult to use or less capable, but alternatives to the mainstream data-harvesting devices you see routinely advertised. I think it's lighthearted fun intended to illustrate Mozilla's mission of being advocates for privacy, to a degree that we have become unfamiliar as a society in the age of everything-as-a-service. Yeah, there are probably some inaccuracies. But frankly, unless you're selling a device that allows you to run the services on your own host using open source software (the way Mozilla does [1]), it's fair game to say that it's possible you are not sufficiently respecting user privacy. How can we as users be sure if all we can measure is that, indeed, the device sends data off-network to the "cloud?" If you genuinely respect user privacy, you should allow a user to wholly own the data in the most pure form possible: they never send it to you. [1] https://github.com/mozilla-services https://github.com/mozilla-services

variable11 8y ago
I think it's an important list, even if somewhat sloppy. It would be to everyone's advantage if product reviewers like Consumer Reports, various tech columnists, blogs and so on, got the message that privacy matters. They need to start including privacy as a component of their review. Pressure for companies to go green has worked over time; pressure for companies to go "quiet" -- that is pro-privacy -- could have the same effect.

dualboot 8y ago

The most disturbing thing about the state of privacy is the households that purchase a multitude of devices that collect, link, and resell data about you. As an example, Imagine the household that has multiple gmail accounts, multiple android phones, everyone uses google maps, Chrome on every desktop, google for search, they add a Nest thermostat, a few Dropcams, and for good measure they use 8.8.8.8 and 4.4.4.4 for all of their DNS queries. You can live in nearly the same world with Amazon and others. Sigh.

tfmatt 8y ago

How is the Roku on this list? I have a pihole setup to do network level adblocking and telemetry disabling and the Roku is the absolute worst device. Thousands and "phone homes" per day that are not needed for the device to function properly. I can only assume it is feeding data back to the mothership at a very high rate.

quickthrower2 8y ago

About the voting system: 1. Anonymous 2. Hard to game 3. User privacy Pick two!

a_imho 8y ago

Privacy should be a non issue with strictly enforced GDPR, for Europeans at least.

Animats 8y ago

The first time I saw an Elf on the Shelf in boxed form, and how heavy the box was, I assumed it had a surveillance camera in it. Apparently it doesn't, usually.

scarejunba 8y ago

My favourite thing about these lists is that they're dominated by the views of mild paranoiacs. A normal person will open the page, see a frowny face next to an Xbox One, and decide that the list is bullshit. Most privacy advocates are the strongest enemies of their own causes. They only accept purity and it encourages everyone to ignore them.

Monika3344 8y ago

Good list! With the holidays coming up I have already started thinking about choosing gifts for my family and friends. I have already bought a tribal skull carved leather biker wallet (https://www.bikerringshop.com/products/tribal-skull-carved-leather-biker-wallet https://www.bikerringshop.com/products/tribal-skull-carved-l...) for my husband. Now I'm looking for the ideas for other people I want to present. So, thanks for sharing, I'll look through this list one more time and I'm sure I'll find something useful there. Thanks!

deleted 8y ago

[deleted]