15 ms·

Firefox’s Test Pilot Program Returns

283 points by jgrahamc 7y ago

mikro2nd 7y ago
US desktop users only at this stage.
- rbdeveloper 7y ago
  That's really a pity (I am from Europe and would love to participate too!)
- pkilgore 7y ago
  Interesting because mobile is probably from where I connect to the internet the most.
AlphaWeaver 7y ago
Based on this [0] terms page, it looks like this could be some sort of paid offering with ProtonVPN? Not sure how I feel about this. [0]: https://www.mozilla.org/en-US/about/legal/terms/vpn/ https://www.mozilla.org/en-US/about/legal/terms/vpn/
- kristofferR 7y ago
  No, it's a Cloudflare collaboration: https://www.mozilla.org/en-US/privacy/firefox-private-network/ https://www.mozilla.org/en-US/privacy/firefox-private-networ... https://www.cloudflare.com/mozilla/firefox-private-network-privacy-notice/ https://www.cloudflare.com/mozilla/firefox-private-network-p...
- portmanteaufu 7y ago
  That's an unrelated offering: https://premium.firefox.com/vpn/ https://premium.firefox.com/vpn/ The article describes Firefox Private Network[1], which gives you a secure connection to an HTTP/HTTPS proxy server being run by Cloudflare. It's not a general purpose VPN and it is currently free. You can read Cloudflare's privacy notice here[2]. Some highlights: > The intended use of the proxy service is to shield HTTP/HTTPS requests from eavesdropping by edge network providers such as public WiFi hotspots. Avoidance of geographical restrictions on content access is explicitly not a goal. > Cloudflare is a data processor for the Firefox Private Network, which means Cloudflare may only process the data according to Mozilla’s instructions. .... The data Cloudflare processes for the Firefox Private Network is subject to Mozilla’s Privacy Policy and is not covered by the Cloudflare Privacy Policy. > When requests are sent to the Cloudflare proxy, Cloudflare will observe your IP address (known as the source IP address), the IP address for the Internet property you are accessing (known as the destination IP address), source port, destination port, timestamp and a token provided by Mozilla that indicates that you are a Firefox Private Network user (together, “Proxy Data”). All Proxy Data will be deleted within 24 hours. [1] https://private-network.firefox.com/ https://private-network.firefox.com/ [2] https://www.cloudflare.com/mozilla/firefox-private-network-privacy-notice/ https://www.cloudflare.com/mozilla/firefox-private-network-p...
- me_me_me 7y ago
  I am also not sure how I feel about it, but one thing that immediately pops out to me is: You may cancel your subscription to this VPN service at any time by clicking the “Cancel Subscription” link in any email that we send you. If you choose to cancel, your access to the service will stop immediately, and Mozilla will refund you for any unused portion of the service period within your then-current billing cycle. This means Mozilla will prorate your refund based on the remaining full days of the subscription period. That's the quality and user centered experience I expect from Mozilla, I still remember trying to cancel my audible subscription, and I ended up having to google it because it was so obfiscated.
deleted 7y ago
[deleted]
Someone1234 7y ago
> whether it’s through phishing emails or data breaches A VPN won't protect you from those, at all. > The Firefox Private Network proxy server is provided by our partner Cloudflare. Their strong privacy controls limit what data they collect and how long they keep it. [...] The data Cloudflare processes for the Firefox Private Network is subject to Mozilla’s Privacy Policy and is not covered by the Cloudflare Privacy Policy. So where is Mozilla's privacy policy that Cloudflare's policy says applies here? Mozilla has an older VPN service with a privacy policy, but I cannot locate this one. > You may often find yourself taking advantage of the free WiFi at the doctor’s office, airport or a cafe. Which is why DNS over HTTPS ("DoH") should be the default but isn't. Combine that with DNS-Sec/Encrypted SNI DoH bootstrap (or better, don't bootstrap and provide a IP for the DoH endpoint). Then send most traffic via HTTPS and this is a solved problem, without giving an additional third party/parties access to your internet traffic. This is likely the "least objectionable" VPN I've seen. But ultimately Firefox, if correctly configured, is already a secure browser even over unsecured WiFi, they just haven't taken the steps to make it secure by default. And, yes, they could absolutely do both (secure out-of-box experience AND VPN product). I am simply pointing out they could solve this for all of their customers for almost free, Vs. this potentially paid offering.
- tomschlick 7y ago
  DoH is being rolled out as the default: https://blog.mozilla.org/futurereleases/2019/09/06/whats-next-in-making-dns-over-https-the-default/ https://blog.mozilla.org/futurereleases/2019/09/06/whats-nex...
- partialrecall 7y ago
  >> whether it’s through phishing emails or data breaches >A VPN won't protect you from those, at all. There has been a ton of misinformation about VPNs, spread in particular by commercial VPN marketing teams. They've been paying people like prominent youtube content creators to say outlandish shit like "without a VPN, you can't securely check your gmail on wifi." Due to the nature of their advertising with content creators, it's hard to determine if the exaggerations and falsehoods are coming from the companies themselves or if they're coming from over-enthusiastic content creators who earnestly don't understand the matter themselves, but in either case I consider the companies responsible since they approve of the misleading messaging.
PatrolX 7y ago
I just got done testing this, it assigns a U.S. IPv6 address and uses the CloudFlare Warp network. My tests showed a very stable download speed of 150.3 Mbps and upload speed of 13.8 Mbps with a latency of 31ms.
- skybrian 7y ago
  Does the assigned IP address change?
sha666sum 7y ago
So is this just a VPN that's baked into the browser? One of the problems with VPNs is that you're putting a lot of faith in your VPN provider. I trust Mozilla, and would gladly pay them for that service (I would use Freedome, but afaik they don't support Linux). However, it would have to be usable outside of my browser. Tangentually, I wish Mozilla also offered paid email (or email with a premium plan), which is another service that requires a lot of trust. It would help provide alternative sources of income to keep Firefox alive, and Thunderbird could be a stunningly good email client if they had more resources to pour into it. Mozilla's product is trust and control. Although they are non-profit, I see no issue with them offering paid services.
- dochtman 7y ago
  Totally agree on email. I've long been saying that they should just acquire/partner with FastMail, seems like a great fit and would allow Mozilla to better align their revenue stream with their users. Also, this constant killing and reviving of the Test Pilot brand looks incredibly short-sighted and stupid to me.
  - sp332 7y ago
    I think it's down to who wants to work on the Test Pilot program. If someone has some ideas to test and the time to work on it, then it's active.
  - ocdtrekkie 7y ago
    I love both Firefox and FastMail, but I'd never want one to acquire the other. Vertical integration introduces lock-in. Even if it's not intentional, it's far too easy for developers to introduce "conveniences" that only work if you're fully adopting their ecosystem.
- portmanteaufu 7y ago
  > So is this just a VPN that's baked into the browser? No, it's a secure connection to an HTTP/HTTPS proxy being run by Cloudflare. It isn't a general-purpose VPN. I would love it if Mozilla offered an email service.
ocdtrekkie 7y ago
While this seems like a generally good thing, I'm irritated by the constant encroachment of the web browser in trying to control the whole network stack, or occasionally, such as here, just use it's own and ignore the OS settings. For one, presumably Firefox-based traffic will go one way whereas network traffic from other apps will go elsewhere, which may provide either unexpected problems or be the cause of unintended data leakage as people believe their whole network experience is protected. I have similar concerns about the rumor Firefox is going to start defaulting to its own choice of DNS provider, which will tamper with both my personal ad blocking strategy (Pi-hole) and my corporate network strategy (internal DNS for internal apps). I would rather web browsers browse websites and components that mess with networking be separate installable components that properly interact with the system's networking APIs.
- arc33 7y ago
  That's because it's very hard to fund development of something as complex as a web browser in 2019 with nothing to fund the development other than donations.
- TheCraiggers 7y ago
  It makes sense though. HTTP has been amazingly flexible, and we as a community have kind of done this to ourselves. Email and chat are already primarily done through a browser now, assuming people even bother with that when they have the likes of facebook. Even games are beginning to migrate there. Things like Chromebooks not only exist, but are wildly popular- and they're basically just web browsers in a box. When everything is moving towards one standard (for better or worse) it makes sense to put your eggs in that basket. Especially when that standard is also your bread & butter as is the case with Mozilla. The people that this will appeal to will like this just fine I bet. That all said, I don't like it much either. But I don't know if that's just resistance to change or actual technical reasons.
  - TeMPOraL 7y ago
    > That all said, I don't like it much either. But I don't know if that's just resistance to change or actual technical reasons. IMO it's technical reasons, all right. Problem being, software engineers are being sidelined as a subclass of users on the Internet, as the vast majority of traffic is now non-technical people accessing commercial services on-line. Under this influence, Internet is turning increasingly into cable TV.
ndidi 7y ago
"Send all your browsing data through cloudflare" is not exactly what I think of when I want privacy
- dralley 7y ago
  You need to consider that the status quo is "send all your browsing data to everyone, in cleartext". (where "browsing data" is defined in both cases by the contents of DNS requests) At minimum I'm more likely to trust that Cloudflare will uphold their contract with Mozilla than that my ISP (Spectrum) isn't happily selling out my browsing data -- and the ISP, unlike Cloudflare, knows my name and address.
- ubercow13 7y ago
  It’s like “send all your data through your ISP”. It’s up to you which is better. Neither is going to be as good as tor or similar.
  - addicted 7y ago
    Does Cloudflare have the same sort of legal restrictions that Comcast or other ISPs, which are regulated by the FCC, have? [PS this isn't a rhetorical question. I'm genuinely curious] I understand that the current FCC is basically intentionally toothless, but that wasn't the case a few years ago, and doesn't necessarily need to be the case a few years from now.
  - Ajedi32 7y ago
    Even Tor isn't great for plaintext HTTP, as it requires you to put an anonymous, unaccountable middleman (the exit node) between you and the internet. The fact that that middleman doesn't know your real IP address is little comfort when they can read and modify all data you send over their connection. Granted, it's not too bad for Tor browser, where all browsing sessions are strictly anonymized and JavaScript access is heavily restricted so MITM attackers are limited in what they can do provided you never transmit anything sensitive or download any files over plaintext, but for general purpose browsing I definitely wouldn't recommend it (even ignoring the performance issues).
- 7y ago
dessant 7y ago
It would be awesome to see the Firefox extension integrate Tor and connect through it to the Firefox Private Network, giving us stronger privacy and finally allowing us to browse the web anonymously, without being subjected to constant discrimination, and without being blocked from accessing basic services.
- AstralStorm 7y ago
  TorButton started that way, but Tor project had to patch the browser with multiple extra toggle and features to strengthen privacy. So it's not the best choice to try it with normal Firefox. This thing is a simpler Cloudflare proxy that will get banned just like Tor from some places. Just give it time.
  - deleted 7y ago
    [deleted]
- partialrecall 7y ago
  Unfortunately even if 100% of firefox users became tor users, I think websites would still decide to block access from known tor endpoints and simply give the finger to any firefox user. It's evident that many have stopped testing their websites in firefox already.
  - dessant 7y ago
    In this case websites would see traffic coming from the Firefox Private Network, which uses Cloudflare.
    - partialrecall 7y ago
      Okay I get it now. Would non-firefox tor users also be able to route their exit traffic through cloudflare?
deleted 7y ago
[deleted]
mcny 7y ago
Congratulations on shipping! Just signed up with a new Firefox account and tried it on Nightly on Windows. Looks very nice. Fast.com reports: Your Internet speed is 420 Mbps Latency Unloaded 10 ms Loaded 71 ms Upload Speed 300 Mbps Client [redacted] Server(s) Open Connect, Netflix
NilsIRL 7y ago
The way Mozilla is pushing their Firefox accounts is really scaring me. I don't see what they get from you having an account with them if it isn't targeted advertising. And example of this is Firefox send which requires an account to raise the download limit from 1.
- glandium 7y ago
  I can't talk about Firefox Send, but in this case, AIUI, an account is required to generate a token to use with the VPN (proxy, really) provider. Otherwise, the provider would just be providing an open proxy. Which could then happily be abused by spammers and whatnot. (Come to think of it, it's probably a similar reason for Firefox Send ; you don't want anonymous unlimited hosting)
  - NilsIRL 7y ago
    Yes, but what prevents you from creating fake firefox accounts?
Ajedi32 7y ago
> The intended use of the proxy service is to shield HTTP/HTTPS requests from eavesdropping by edge network providers such as public WiFi hotspots. Avoidance of geographical restrictions on content access is explicitly not a goal. > The Mozilla extension will always make a secure request to the Cloudflare network, regardless if the request is for TLS or plaintext (From Cloudflare's privacy notice: https://www.cloudflare.com/mozilla/firefox-private-network-privacy-notice/ https://www.cloudflare.com/mozilla/firefox-private-network-p...) Now there's an interesting thought. Since the extension is routing requests at the application layer rather than at the network level, would it be possible to only route unencrypted HTTP requests through Cloudflare, while leaving encrypted HTTPS connections unaffected in order to avoid any latency penalty and save resources on Cloudflare's end? I'd love an extension/VPN app that runs silently in the background and automatically routes unencrypted requests through a private connection, while simultaneously leaving encrypted connections untouched. Maybe even have a whitelist of trusted Wi-Fi networks where the system is automatically turned off. Done right, a service like that could potentially allow users to use unencrypted Wi-Fi networks without having to worry about MITM attacks, without imposing any of the downsides that come with leaving a VPN running 24/7.
- kevingadd 7y ago
  The IP mismatch (unencrypted requests going through CF, encrypted through the user's connection directly) seems like it could cause trouble, though maybe in the real world most websites wouldn't care?
  - Ajedi32 7y ago
    In theory it shouldn't be a problem. HTTP is supposed to be stateless, and some users will inevitably change their IP pretty frequently anyway when hopping between mobile and Wi-Fi networks so it's not like that sort of behavior is unheard of. In practice though, I have no idea. It's entirely possible there's some subset of websites making bizarre, incorrect assumptions about the relationship between users and individual IP addresses, and that dividing HTTP and HTTPS requests between different IPs could break them. If it turns out to be a problem, as a mitigation you could set it so that once you make a plaintext HTTP request to a specific domain without the response immediately redirecting to HTTPS, any future requests to that domain happen over the proxied connection for some period of time, regardless of whether those requests are HTTPS or not. That way full HTTPS sites would benefit from not needing to go through the proxy, whereas mixed content sites would not.
Hitton 7y ago
Using a public Wi-Fi as an argument for VPN in a point of history when you can hardly find a site without https is getting ridiculous.
- kibwen 7y ago
  HTTPS still reveals the domain you've requested, which is an important piece of information to keep private. In the absence of encrypted DNS I'll take the VPN knowing my domain history instead.
  - Hitton 7y ago
    I can't see any reasonable threat model which makes an attacker on public wi-fi seeing someone accessing particular domain more dangerous than ISP or VPN provider seeing same.
ignoramous 7y ago
Here's the landing page for the accelerated L7 Proxy aka Firefox Private Network (powered by Cloudflare): https://private-network.firefox.com/ https://private-network.firefox.com/ I quite like the fact that once this goes mainstream, it'd help limit surveillance and bypass censorship on the web in one fell swoop without having to install or trust 3p other than the implicit trust in Mozilla and its partners (in this case, Cloudflare). Knowing Cloudflare, I'm sure this proxy is as much abt speed and latency as privacy and security. For time being, it looks like this is available only in the US and only on desktop versions. I'd like to point out though, that, one could run a Tor proxy (it also has a VPN mode) on their phones [0] today to workaround censorship and surveillance; anonymity is a bit tricky over tor-as-a-proxy. The speeds over Tor are decent and nothing you can't tolerate whilst casual web browsing. It is probably going to be free forever unlike Firefox's private network. Interestingly, Google has bundled WiFi Assitant (VPN) for free on Pixel devices sometime now: https://support.google.com/nexus/answer/6327199 https://support.google.com/nexus/answer/6327199 [0] https://guardianproject.info/apps https://guardianproject.info/apps
switch007 7y ago
I wish that Mozilla begged for donations with more fervour. Surely people understand these days that when it comes to tech, very little is "free". Even my parents understand that cheap devices such as TVs spy on you as a tradeoff (or for greed. I'm not quite sure which it truly is)
deadbunny 7y ago
Ah yes, the Mozilla Private Network Virtual Private Network. Catchy.
- dmix 7y ago
  Don't forget "Beta" on the end. That seems to be Techcrunch doing in that link. The Firefox website keeps the two phrases separate https://private-network.firefox.com/ https://private-network.firefox.com/
- sha666sum 7y ago
  Not once in their announcement did Mozilla mention VPN's.
Scoundreller 7y ago
> It’s worth noting that Opera, too, includes a free built-in VPN service, which includes the ability to set your location to either the Americas, Europe or Asia. I’ve found that Opera’s VPN would never work when I set myself to “Americas”, and always place me in the Netherlands.
- mehhh 7y ago
  Your connections are likely routed to where Opera has available resources to handle servicing you. Bandwidth in Asia and parts of the Americas is very expensive, whereas bandwidth in European datacenters is close to free.
  - Scoundreller 7y ago
    Asia works well, it says I’m in Singapore. “Americas” should be big enough for them to find something cheap to host a rack. S3 certainly charges the least for US bandwidth.
atonse 7y ago
Seems like it's based on CloudFlare. Is this the same as CloudFlare's wireguard-based VPN (Warp)? I'm still 100k+ on the wait-list for that one.
- whycombagator 7y ago
  Apparently it is: https://news.ycombinator.com/item?id=20928350 https://news.ycombinator.com/item?id=20928350
- mehhh 7y ago
  How does Warp deal with IP based ratelimiting (eg: Google) and geographic restrictions (Netflix and Youtube)? Also curious if Cloudflare is using fully audited and libre systems like some VPN providers do, so as o ensure privacy claims are worth the paper they are written on.
  - mirimir 7y ago
    It explicitly doesn't deal with geographic restrictions. Indeed, it guarantees that websites can implement them.
    - goatsi 7y ago
      Only if they use Cloudflare. Nobody else gets the originating IP: https://news.ycombinator.com/item?id=19544845 https://news.ycombinator.com/item?id=19544845
      - mirimir 7y ago
        OK, right. But increasingly, that's a damn small "Nobody else".
- BlueGh0st 7y ago
  The irony that we'll be using CloudFlare to connect to websites where we are blocked by CloudFlare for using an VPN.
jedisct1 7y ago
It's just an ad for Cloudflare.
atonse 7y ago
Can anyone from Mozilla explain why a Firefox Account is required to use this?
- ndidi 7y ago
  Accountability? (Pun may or may not be intended)
- BlueGh0st 7y ago
  Well, it's part of the test program in beta, for one.
- giancarlostoro 7y ago
  (I don't work for Mozilla) The rumor I've heard on HN over the past few months is that Mozilla eventually intends to sell a paid version of Firefox with a VPN included. I'm suspecting this may involve a Firefox Account in the future.
  - rosybox 7y ago
    I would be very happy to pay for a secure browser. I'm really tired of "free" products that we sell our private lives to.
    - giancarlostoro 7y ago
      This is part of why I decided to go outside of the norm and made a fresh Outlook account I dont share with anybody or any websites, and paid for storage. Eventually I want to have my email under my domain hosted by Microsoft just because they're not the same mess of Google, and I get all of the Office suite included.
      - rosybox 7y ago
        I looked into the hosting domain by Microsoft, but for the non business version they require your domain registrar be godaddy and I'm just not into that. It's kind of a stupid thing they have, why can't they do a dns thing like anyone else, why do they require your domain registar be godaddy?
type-2 7y ago
did clouldflare buy mozilla?
- yarrel 7y ago
  There will have been a lunch.
dessant 7y ago
Firefox Private Network uses Cloudflare Warp, which discloses to origin IP address to Cloudflare-enabled websites via a HTTP header [1]. Does Mozilla use a custom version of Warp which keeps the IP address of users private? [1] https://news.ycombinator.com/item?id=19544845 https://news.ycombinator.com/item?id=19544845
- mirimir 7y ago
  Ummm, it's not really a "VPN service" if it shares your IP address with websites. I mean, even high-end proxies don't do that. Edit: It's pretty clear from the following comment that this is not a "VPN service", as most people understand it. So Mozilla is being extremely disingenuous in calling it one. > > The intended use of the proxy service is to shield HTTP/HTTPS requests from eavesdropping by edge network providers such as public WiFi hotspots. Avoidance of geographical restrictions on content access is explicitly not a goal. > > The Mozilla extension will always make a secure request to the Cloudflare network, regardless if the request is for TLS or plaintext > (From Cloudflare's privacy notice: https://www.cloudflare.com/mozilla/firefox-private-network-privacy-notice/ https://www.cloudflare.com/mozilla/firefox-private-network-p...) https://news.ycombinator.com/item?id=20930194 https://news.ycombinator.com/item?id=20930194
  - skybrian 7y ago
    On the other hand, from the Firefox announcement: "Firefox Private Network will mask your IP address providing protection from third party trackers around the web." [1] I'm guessing this means the IP address is partially masked, but there is enough info to determine the region the request comes from? Maybe someone should test this? [1] https://blog.mozilla.org/blog/2019/09/10/firefoxs-test-pilot-program-returns-with-firefox-private-network-beta/ https://blog.mozilla.org/blog/2019/09/10/firefoxs-test-pilot...
    - mirimir 7y ago
      Good idea. But you'd need both a Firefox account, and a website that uses Cloudflare. I have neither. Still, if this remains an open question, perhaps it's interesting enough to setup a website to test. I'd probably need at least an entry-level paid Cloudflare account, though. Meanwhile, it'd be great if someone from Mozilla could clarify this. That is, does Firefox Private Network share users' IP addresses with websites? As Warp clearly does.
rgbrenner 7y ago
So in Mozilla's vision of the web, we would send all our DNS queries to Cloudflare, and then pipe all of our web traffic through Cloudflare too. If Mozilla want's to turn Firefox into a front end for Cloudflare, I will happily delete it right now. Why is it a company with $500m/year in revenue can't run a few servers for this themselves? They have to outsource it to a company 1/5th their size.
- lighthazard 7y ago
  Why would they run something in-house that takes so much logistics, expertise, and cost?
  - mirimir 7y ago
    Security, and privacy etc that derive from it. If it's not under your physical control, it's not really your server.
- OrgNet 7y ago
  I officially lost fate in Firefox (because cloudflare can't be trusted with all the traffic)... but I have no alternative. (I have been a Firefox user since v1 and never switched to chrome) edit: yeah, downvote me, corporate kids, welcome to the hacker prude network... and stay quiet /s
  - OrgNet 7y ago
    sorry not from CA
  - eikenberry 7y ago
    Presumably you disable them. IMO that should be easier to disable, but it is possible at least and should remain so given Mozilla's history.
  - auslander 7y ago
    Safari
- 7y ago
garysahota93 7y ago
If Mozilla offered an email service, VPN, and legit password manager for a bundled price, I'd totally pay it. I trust them more than Google...
userbinator 7y ago
I'd like to draw your attention to this eerily prescient comment I noticed on a related story only 3 days ago (downvoted heavily, presumably due to disbelief?): https://news.ycombinator.com/item?id=20902283 https://news.ycombinator.com/item?id=20902283
auslander 7y ago
Sticking to Safari, I guess.
virusduck 7y ago
Anybody know what address/ports this service uses? Seems to be blocked where I am.
- Snawoot 7y ago
  firefox.factor11.cloudflareclient.com:2486

283 points by jgrahamc 7y ago

mikro2nd 7y ago

US desktop users only at this stage.

rbdeveloper 7y ago
That's really a pity (I am from Europe and would love to participate too!)
pkilgore 7y ago
Interesting because mobile is probably from where I connect to the internet the most.

AlphaWeaver 7y ago

Based on this [0] terms page, it looks like this could be some sort of paid offering with ProtonVPN? Not sure how I feel about this. [0]: https://www.mozilla.org/en-US/about/legal/terms/vpn/ https://www.mozilla.org/en-US/about/legal/terms/vpn/

kristofferR 7y ago
No, it's a Cloudflare collaboration: https://www.mozilla.org/en-US/privacy/firefox-private-network/ https://www.mozilla.org/en-US/privacy/firefox-private-networ... https://www.cloudflare.com/mozilla/firefox-private-network-privacy-notice/ https://www.cloudflare.com/mozilla/firefox-private-network-p...
portmanteaufu 7y ago
That's an unrelated offering: https://premium.firefox.com/vpn/ https://premium.firefox.com/vpn/ The article describes Firefox Private Network[1], which gives you a secure connection to an HTTP/HTTPS proxy server being run by Cloudflare. It's not a general purpose VPN and it is currently free. You can read Cloudflare's privacy notice here[2]. Some highlights: > The intended use of the proxy service is to shield HTTP/HTTPS requests from eavesdropping by edge network providers such as public WiFi hotspots. Avoidance of geographical restrictions on content access is explicitly not a goal. > Cloudflare is a data processor for the Firefox Private Network, which means Cloudflare may only process the data according to Mozilla’s instructions. .... The data Cloudflare processes for the Firefox Private Network is subject to Mozilla’s Privacy Policy and is not covered by the Cloudflare Privacy Policy. > When requests are sent to the Cloudflare proxy, Cloudflare will observe your IP address (known as the source IP address), the IP address for the Internet property you are accessing (known as the destination IP address), source port, destination port, timestamp and a token provided by Mozilla that indicates that you are a Firefox Private Network user (together, “Proxy Data”). All Proxy Data will be deleted within 24 hours. [1] https://private-network.firefox.com/ https://private-network.firefox.com/ [2] https://www.cloudflare.com/mozilla/firefox-private-network-privacy-notice/ https://www.cloudflare.com/mozilla/firefox-private-network-p...
me_me_me 7y ago
I am also not sure how I feel about it, but one thing that immediately pops out to me is: You may cancel your subscription to this VPN service at any time by clicking the “Cancel Subscription” link in any email that we send you. If you choose to cancel, your access to the service will stop immediately, and Mozilla will refund you for any unused portion of the service period within your then-current billing cycle. This means Mozilla will prorate your refund based on the remaining full days of the subscription period. That's the quality and user centered experience I expect from Mozilla, I still remember trying to cancel my audible subscription, and I ended up having to google it because it was so obfiscated.

deleted 7y ago

[deleted]

Someone1234 7y ago

> whether it’s through phishing emails or data breaches A VPN won't protect you from those, at all. > The Firefox Private Network proxy server is provided by our partner Cloudflare. Their strong privacy controls limit what data they collect and how long they keep it. [...] The data Cloudflare processes for the Firefox Private Network is subject to Mozilla’s Privacy Policy and is not covered by the Cloudflare Privacy Policy. So where is Mozilla's privacy policy that Cloudflare's policy says applies here? Mozilla has an older VPN service with a privacy policy, but I cannot locate this one. > You may often find yourself taking advantage of the free WiFi at the doctor’s office, airport or a cafe. Which is why DNS over HTTPS ("DoH") should be the default but isn't. Combine that with DNS-Sec/Encrypted SNI DoH bootstrap (or better, don't bootstrap and provide a IP for the DoH endpoint). Then send most traffic via HTTPS and this is a solved problem, without giving an additional third party/parties access to your internet traffic. This is likely the "least objectionable" VPN I've seen. But ultimately Firefox, if correctly configured, is already a secure browser even over unsecured WiFi, they just haven't taken the steps to make it secure by default. And, yes, they could absolutely do both (secure out-of-box experience AND VPN product). I am simply pointing out they could solve this for all of their customers for almost free, Vs. this potentially paid offering.

tomschlick 7y ago
DoH is being rolled out as the default: https://blog.mozilla.org/futurereleases/2019/09/06/whats-next-in-making-dns-over-https-the-default/ https://blog.mozilla.org/futurereleases/2019/09/06/whats-nex...
partialrecall 7y ago
>> whether it’s through phishing emails or data breaches >A VPN won't protect you from those, at all. There has been a ton of misinformation about VPNs, spread in particular by commercial VPN marketing teams. They've been paying people like prominent youtube content creators to say outlandish shit like "without a VPN, you can't securely check your gmail on wifi." Due to the nature of their advertising with content creators, it's hard to determine if the exaggerations and falsehoods are coming from the companies themselves or if they're coming from over-enthusiastic content creators who earnestly don't understand the matter themselves, but in either case I consider the companies responsible since they approve of the misleading messaging.

PatrolX 7y ago

I just got done testing this, it assigns a U.S. IPv6 address and uses the CloudFlare Warp network. My tests showed a very stable download speed of 150.3 Mbps and upload speed of 13.8 Mbps with a latency of 31ms.

skybrian 7y ago
Does the assigned IP address change?

sha666sum 7y ago

So is this just a VPN that's baked into the browser? One of the problems with VPNs is that you're putting a lot of faith in your VPN provider. I trust Mozilla, and would gladly pay them for that service (I would use Freedome, but afaik they don't support Linux). However, it would have to be usable outside of my browser. Tangentually, I wish Mozilla also offered paid email (or email with a premium plan), which is another service that requires a lot of trust. It would help provide alternative sources of income to keep Firefox alive, and Thunderbird could be a stunningly good email client if they had more resources to pour into it. Mozilla's product is trust and control. Although they are non-profit, I see no issue with them offering paid services.

dochtman 7y ago
Totally agree on email. I've long been saying that they should just acquire/partner with FastMail, seems like a great fit and would allow Mozilla to better align their revenue stream with their users. Also, this constant killing and reviving of the Test Pilot brand looks incredibly short-sighted and stupid to me.
- sp332 7y ago
  I think it's down to who wants to work on the Test Pilot program. If someone has some ideas to test and the time to work on it, then it's active.
- ocdtrekkie 7y ago
  I love both Firefox and FastMail, but I'd never want one to acquire the other. Vertical integration introduces lock-in. Even if it's not intentional, it's far too easy for developers to introduce "conveniences" that only work if you're fully adopting their ecosystem.
portmanteaufu 7y ago
> So is this just a VPN that's baked into the browser? No, it's a secure connection to an HTTP/HTTPS proxy being run by Cloudflare. It isn't a general-purpose VPN. I would love it if Mozilla offered an email service.

ocdtrekkie 7y ago

While this seems like a generally good thing, I'm irritated by the constant encroachment of the web browser in trying to control the whole network stack, or occasionally, such as here, just use it's own and ignore the OS settings. For one, presumably Firefox-based traffic will go one way whereas network traffic from other apps will go elsewhere, which may provide either unexpected problems or be the cause of unintended data leakage as people believe their whole network experience is protected. I have similar concerns about the rumor Firefox is going to start defaulting to its own choice of DNS provider, which will tamper with both my personal ad blocking strategy (Pi-hole) and my corporate network strategy (internal DNS for internal apps). I would rather web browsers browse websites and components that mess with networking be separate installable components that properly interact with the system's networking APIs.

arc33 7y ago
That's because it's very hard to fund development of something as complex as a web browser in 2019 with nothing to fund the development other than donations.
TheCraiggers 7y ago
It makes sense though. HTTP has been amazingly flexible, and we as a community have kind of done this to ourselves. Email and chat are already primarily done through a browser now, assuming people even bother with that when they have the likes of facebook. Even games are beginning to migrate there. Things like Chromebooks not only exist, but are wildly popular- and they're basically just web browsers in a box. When everything is moving towards one standard (for better or worse) it makes sense to put your eggs in that basket. Especially when that standard is also your bread & butter as is the case with Mozilla. The people that this will appeal to will like this just fine I bet. That all said, I don't like it much either. But I don't know if that's just resistance to change or actual technical reasons.
- TeMPOraL 7y ago
  > That all said, I don't like it much either. But I don't know if that's just resistance to change or actual technical reasons. IMO it's technical reasons, all right. Problem being, software engineers are being sidelined as a subclass of users on the Internet, as the vast majority of traffic is now non-technical people accessing commercial services on-line. Under this influence, Internet is turning increasingly into cable TV.

ndidi 7y ago

"Send all your browsing data through cloudflare" is not exactly what I think of when I want privacy

dralley 7y ago
You need to consider that the status quo is "send all your browsing data to everyone, in cleartext". (where "browsing data" is defined in both cases by the contents of DNS requests) At minimum I'm more likely to trust that Cloudflare will uphold their contract with Mozilla than that my ISP (Spectrum) isn't happily selling out my browsing data -- and the ISP, unlike Cloudflare, knows my name and address.
ubercow13 7y ago
It’s like “send all your data through your ISP”. It’s up to you which is better. Neither is going to be as good as tor or similar.
- addicted 7y ago
  Does Cloudflare have the same sort of legal restrictions that Comcast or other ISPs, which are regulated by the FCC, have? [PS this isn't a rhetorical question. I'm genuinely curious] I understand that the current FCC is basically intentionally toothless, but that wasn't the case a few years ago, and doesn't necessarily need to be the case a few years from now.
- Ajedi32 7y ago
  Even Tor isn't great for plaintext HTTP, as it requires you to put an anonymous, unaccountable middleman (the exit node) between you and the internet. The fact that that middleman doesn't know your real IP address is little comfort when they can read and modify all data you send over their connection. Granted, it's not too bad for Tor browser, where all browsing sessions are strictly anonymized and JavaScript access is heavily restricted so MITM attackers are limited in what they can do provided you never transmit anything sensitive or download any files over plaintext, but for general purpose browsing I definitely wouldn't recommend it (even ignoring the performance issues).
7y ago

dessant 7y ago

It would be awesome to see the Firefox extension integrate Tor and connect through it to the Firefox Private Network, giving us stronger privacy and finally allowing us to browse the web anonymously, without being subjected to constant discrimination, and without being blocked from accessing basic services.

AstralStorm 7y ago
TorButton started that way, but Tor project had to patch the browser with multiple extra toggle and features to strengthen privacy. So it's not the best choice to try it with normal Firefox. This thing is a simpler Cloudflare proxy that will get banned just like Tor from some places. Just give it time.
- deleted 7y ago
  [deleted]
partialrecall 7y ago
Unfortunately even if 100% of firefox users became tor users, I think websites would still decide to block access from known tor endpoints and simply give the finger to any firefox user. It's evident that many have stopped testing their websites in firefox already.
- dessant 7y ago
  In this case websites would see traffic coming from the Firefox Private Network, which uses Cloudflare.
  - partialrecall 7y ago
    Okay I get it now. Would non-firefox tor users also be able to route their exit traffic through cloudflare?

deleted 7y ago

[deleted]

mcny 7y ago

Congratulations on shipping! Just signed up with a new Firefox account and tried it on Nightly on Windows. Looks very nice. Fast.com reports: Your Internet speed is 420 Mbps Latency Unloaded 10 ms Loaded 71 ms Upload Speed 300 Mbps Client [redacted] Server(s) Open Connect, Netflix

NilsIRL 7y ago

The way Mozilla is pushing their Firefox accounts is really scaring me. I don't see what they get from you having an account with them if it isn't targeted advertising. And example of this is Firefox send which requires an account to raise the download limit from 1.

glandium 7y ago
I can't talk about Firefox Send, but in this case, AIUI, an account is required to generate a token to use with the VPN (proxy, really) provider. Otherwise, the provider would just be providing an open proxy. Which could then happily be abused by spammers and whatnot. (Come to think of it, it's probably a similar reason for Firefox Send ; you don't want anonymous unlimited hosting)
- NilsIRL 7y ago
  Yes, but what prevents you from creating fake firefox accounts?

Ajedi32 7y ago

> The intended use of the proxy service is to shield HTTP/HTTPS requests from eavesdropping by edge network providers such as public WiFi hotspots. Avoidance of geographical restrictions on content access is explicitly not a goal. > The Mozilla extension will always make a secure request to the Cloudflare network, regardless if the request is for TLS or plaintext (From Cloudflare's privacy notice: https://www.cloudflare.com/mozilla/firefox-private-network-privacy-notice/ https://www.cloudflare.com/mozilla/firefox-private-network-p...) Now there's an interesting thought. Since the extension is routing requests at the application layer rather than at the network level, would it be possible to only route unencrypted HTTP requests through Cloudflare, while leaving encrypted HTTPS connections unaffected in order to avoid any latency penalty and save resources on Cloudflare's end? I'd love an extension/VPN app that runs silently in the background and automatically routes unencrypted requests through a private connection, while simultaneously leaving encrypted connections untouched. Maybe even have a whitelist of trusted Wi-Fi networks where the system is automatically turned off. Done right, a service like that could potentially allow users to use unencrypted Wi-Fi networks without having to worry about MITM attacks, without imposing any of the downsides that come with leaving a VPN running 24/7.

kevingadd 7y ago
The IP mismatch (unencrypted requests going through CF, encrypted through the user's connection directly) seems like it could cause trouble, though maybe in the real world most websites wouldn't care?
- Ajedi32 7y ago
  In theory it shouldn't be a problem. HTTP is supposed to be stateless, and some users will inevitably change their IP pretty frequently anyway when hopping between mobile and Wi-Fi networks so it's not like that sort of behavior is unheard of. In practice though, I have no idea. It's entirely possible there's some subset of websites making bizarre, incorrect assumptions about the relationship between users and individual IP addresses, and that dividing HTTP and HTTPS requests between different IPs could break them. If it turns out to be a problem, as a mitigation you could set it so that once you make a plaintext HTTP request to a specific domain without the response immediately redirecting to HTTPS, any future requests to that domain happen over the proxied connection for some period of time, regardless of whether those requests are HTTPS or not. That way full HTTPS sites would benefit from not needing to go through the proxy, whereas mixed content sites would not.

Hitton 7y ago

Using a public Wi-Fi as an argument for VPN in a point of history when you can hardly find a site without https is getting ridiculous.

kibwen 7y ago
HTTPS still reveals the domain you've requested, which is an important piece of information to keep private. In the absence of encrypted DNS I'll take the VPN knowing my domain history instead.
- Hitton 7y ago
  I can't see any reasonable threat model which makes an attacker on public wi-fi seeing someone accessing particular domain more dangerous than ISP or VPN provider seeing same.

ignoramous 7y ago

Here's the landing page for the accelerated L7 Proxy aka Firefox Private Network (powered by Cloudflare): https://private-network.firefox.com/ https://private-network.firefox.com/ I quite like the fact that once this goes mainstream, it'd help limit surveillance and bypass censorship on the web in one fell swoop without having to install or trust 3p other than the implicit trust in Mozilla and its partners (in this case, Cloudflare). Knowing Cloudflare, I'm sure this proxy is as much abt speed and latency as privacy and security. For time being, it looks like this is available only in the US and only on desktop versions. I'd like to point out though, that, one could run a Tor proxy (it also has a VPN mode) on their phones [0] today to workaround censorship and surveillance; anonymity is a bit tricky over tor-as-a-proxy. The speeds over Tor are decent and nothing you can't tolerate whilst casual web browsing. It is probably going to be free forever unlike Firefox's private network. Interestingly, Google has bundled WiFi Assitant (VPN) for free on Pixel devices sometime now: https://support.google.com/nexus/answer/6327199 https://support.google.com/nexus/answer/6327199 [0] https://guardianproject.info/apps https://guardianproject.info/apps

switch007 7y ago

I wish that Mozilla begged for donations with more fervour. Surely people understand these days that when it comes to tech, very little is "free". Even my parents understand that cheap devices such as TVs spy on you as a tradeoff (or for greed. I'm not quite sure which it truly is)

deadbunny 7y ago

Ah yes, the Mozilla Private Network Virtual Private Network. Catchy.

dmix 7y ago
Don't forget "Beta" on the end. That seems to be Techcrunch doing in that link. The Firefox website keeps the two phrases separate https://private-network.firefox.com/ https://private-network.firefox.com/
sha666sum 7y ago
Not once in their announcement did Mozilla mention VPN's.

Scoundreller 7y ago

> It’s worth noting that Opera, too, includes a free built-in VPN service, which includes the ability to set your location to either the Americas, Europe or Asia. I’ve found that Opera’s VPN would never work when I set myself to “Americas”, and always place me in the Netherlands.

mehhh 7y ago
Your connections are likely routed to where Opera has available resources to handle servicing you. Bandwidth in Asia and parts of the Americas is very expensive, whereas bandwidth in European datacenters is close to free.
- Scoundreller 7y ago
  Asia works well, it says I’m in Singapore. “Americas” should be big enough for them to find something cheap to host a rack. S3 certainly charges the least for US bandwidth.

atonse 7y ago

Seems like it's based on CloudFlare. Is this the same as CloudFlare's wireguard-based VPN (Warp)? I'm still 100k+ on the wait-list for that one.

whycombagator 7y ago
Apparently it is: https://news.ycombinator.com/item?id=20928350 https://news.ycombinator.com/item?id=20928350
mehhh 7y ago
How does Warp deal with IP based ratelimiting (eg: Google) and geographic restrictions (Netflix and Youtube)? Also curious if Cloudflare is using fully audited and libre systems like some VPN providers do, so as o ensure privacy claims are worth the paper they are written on.
- mirimir 7y ago
  It explicitly doesn't deal with geographic restrictions. Indeed, it guarantees that websites can implement them.
  - goatsi 7y ago
    Only if they use Cloudflare. Nobody else gets the originating IP: https://news.ycombinator.com/item?id=19544845 https://news.ycombinator.com/item?id=19544845
    - mirimir 7y ago
      OK, right. But increasingly, that's a damn small "Nobody else".
BlueGh0st 7y ago
The irony that we'll be using CloudFlare to connect to websites where we are blocked by CloudFlare for using an VPN.

jedisct1 7y ago

It's just an ad for Cloudflare.

atonse 7y ago

Can anyone from Mozilla explain why a Firefox Account is required to use this?

ndidi 7y ago
Accountability? (Pun may or may not be intended)
BlueGh0st 7y ago
Well, it's part of the test program in beta, for one.
giancarlostoro 7y ago
(I don't work for Mozilla) The rumor I've heard on HN over the past few months is that Mozilla eventually intends to sell a paid version of Firefox with a VPN included. I'm suspecting this may involve a Firefox Account in the future.
- rosybox 7y ago
  I would be very happy to pay for a secure browser. I'm really tired of "free" products that we sell our private lives to.
  - giancarlostoro 7y ago
    This is part of why I decided to go outside of the norm and made a fresh Outlook account I dont share with anybody or any websites, and paid for storage. Eventually I want to have my email under my domain hosted by Microsoft just because they're not the same mess of Google, and I get all of the Office suite included.
    - rosybox 7y ago
      I looked into the hosting domain by Microsoft, but for the non business version they require your domain registrar be godaddy and I'm just not into that. It's kind of a stupid thing they have, why can't they do a dns thing like anyone else, why do they require your domain registar be godaddy?

type-2 7y ago

did clouldflare buy mozilla?

yarrel 7y ago
There will have been a lunch.

dessant 7y ago

Firefox Private Network uses Cloudflare Warp, which discloses to origin IP address to Cloudflare-enabled websites via a HTTP header [1]. Does Mozilla use a custom version of Warp which keeps the IP address of users private? [1] https://news.ycombinator.com/item?id=19544845 https://news.ycombinator.com/item?id=19544845

mirimir 7y ago
Ummm, it's not really a "VPN service" if it shares your IP address with websites. I mean, even high-end proxies don't do that. Edit: It's pretty clear from the following comment that this is not a "VPN service", as most people understand it. So Mozilla is being extremely disingenuous in calling it one. > > The intended use of the proxy service is to shield HTTP/HTTPS requests from eavesdropping by edge network providers such as public WiFi hotspots. Avoidance of geographical restrictions on content access is explicitly not a goal. > > The Mozilla extension will always make a secure request to the Cloudflare network, regardless if the request is for TLS or plaintext > (From Cloudflare's privacy notice: https://www.cloudflare.com/mozilla/firefox-private-network-privacy-notice/ https://www.cloudflare.com/mozilla/firefox-private-network-p...) https://news.ycombinator.com/item?id=20930194 https://news.ycombinator.com/item?id=20930194
- skybrian 7y ago
  On the other hand, from the Firefox announcement: "Firefox Private Network will mask your IP address providing protection from third party trackers around the web." [1] I'm guessing this means the IP address is partially masked, but there is enough info to determine the region the request comes from? Maybe someone should test this? [1] https://blog.mozilla.org/blog/2019/09/10/firefoxs-test-pilot-program-returns-with-firefox-private-network-beta/ https://blog.mozilla.org/blog/2019/09/10/firefoxs-test-pilot...
  - mirimir 7y ago
    Good idea. But you'd need both a Firefox account, and a website that uses Cloudflare. I have neither. Still, if this remains an open question, perhaps it's interesting enough to setup a website to test. I'd probably need at least an entry-level paid Cloudflare account, though. Meanwhile, it'd be great if someone from Mozilla could clarify this. That is, does Firefox Private Network share users' IP addresses with websites? As Warp clearly does.

rgbrenner 7y ago

So in Mozilla's vision of the web, we would send all our DNS queries to Cloudflare, and then pipe all of our web traffic through Cloudflare too. If Mozilla want's to turn Firefox into a front end for Cloudflare, I will happily delete it right now. Why is it a company with $500m/year in revenue can't run a few servers for this themselves? They have to outsource it to a company 1/5th their size.

lighthazard 7y ago
Why would they run something in-house that takes so much logistics, expertise, and cost?
- mirimir 7y ago
  Security, and privacy etc that derive from it. If it's not under your physical control, it's not really your server.
OrgNet 7y ago
I officially lost fate in Firefox (because cloudflare can't be trusted with all the traffic)... but I have no alternative. (I have been a Firefox user since v1 and never switched to chrome) edit: yeah, downvote me, corporate kids, welcome to the hacker prude network... and stay quiet /s
- OrgNet 7y ago
  sorry not from CA
- eikenberry 7y ago
  Presumably you disable them. IMO that should be easier to disable, but it is possible at least and should remain so given Mozilla's history.
- auslander 7y ago
  Safari
7y ago

garysahota93 7y ago

If Mozilla offered an email service, VPN, and legit password manager for a bundled price, I'd totally pay it. I trust them more than Google...

userbinator 7y ago

I'd like to draw your attention to this eerily prescient comment I noticed on a related story only 3 days ago (downvoted heavily, presumably due to disbelief?): https://news.ycombinator.com/item?id=20902283 https://news.ycombinator.com/item?id=20902283

auslander 7y ago

Sticking to Safari, I guess.

virusduck 7y ago

Anybody know what address/ports this service uses? Seems to be blocked where I am.

Snawoot 7y ago
firefox.factor11.cloudflareclient.com:2486