9 ms·

Web Browser Telemetry

66 points by freediver 3y ago

_lvbh 3y ago
DDOS Guard is blocking my Safari
- acco102 3y ago
  after DDOS Guard https://sizeof.cat/img/hn.jpg https://sizeof.cat/img/hn.jpg
butz 3y ago
Purple scrollbar on purple background... And this is why website authors should not be allowed to style browser controls.
- UberFly 3y ago
  I had to install Custom Scrollbars for this reason.
- PinkSheep 3y ago
  That's magenta on purple with decent contrast. To my eye that's vastly more usable than those San Francisco Thin fonts.
branon 3y ago
Why's Brave try to talk to ftx.com? Website's defunct anyway.
- cbsmith 3y ago
  I'm guessing it's leftovers from their whole "reimburse websites via crypto" strategy.
- fckgw 3y ago
  The blog post is from 2021
- quincepie 3y ago
  I believe it's from the new page widgets: https://community.brave.com/t/what-is-ftx-and-why-did-it-suddenly-show-up-on-my-browser-window/263542 https://community.brave.com/t/what-is-ftx-and-why-did-it-sud...
altairprime 3y ago
The metric of “hostnames contacted” isn’t a valuable pressure point: each browser can simply replace all hostnames with one, at which point they’ll look better than their competitors without having made any material changes whatsoever in behavior. The correct metric here is “number of requests initiated”, but that’s harder to collect than copy-pasting logs from LittleSnitch and gesturing theatrically at them as this post is doing.
- arccy 3y ago
  you could just tunnel everything over a single long lived request
- ziddoap 3y ago
  >gesturing theatrically Agreed that this post isn't particularly illuminating, but where is the theatrics? It's just a list of connections, and the author even refuses to put a conclusion.
  - altairprime 3y ago
    They claim to refuse to draw any conclusion, but then in contradiction to that statement, state their personal belief that any connection number greater than zero is harmful elsewhere in a later paragraph; and present the appearance of taking the high ground by not making claims, in contrast to journalists that do. This document as presented is only meaningful to two audiences: those who already agree with the author’s viewpoint on connections made by browsers when no user action has occurred, and those who have already formed viewpoints on the concerns around browsers and outbound connections. This is theatrics. The author clearly has opinions, and has crafted it to be attractive and interesting solely to those who have already formed an opinion on these issues — as is evident from the context that leads to such a post existing at all, much less reaching the HN front page. A less theatrical post could have stated why counting these connections matters to anyone, and plainly stated the author’s view that browsers with a count of zero are preferable. Instead, they buried their opinion in a later paragraph, declared it absent when it’s present, and left things vague enough that any supporter of their viewpoint can argue to any detractor of their viewpoint that they never stated an opinion at all. Instead of supporting productive and nuanced conversation, they fan the flames of belief with data structured to promote their view, while attempting (and failing) to claim the neutral high ground. A useful datapoint for evaluating their viewpoint here would have been, “Are all of the browser’s outbound connections first-party to the browser’s author and/or the site navigated?”. For many mobile browsers embedded in mobile apps, is wholly untrue: they monitor and report on your page views to themselves, which is a gross violation of privacy. Another would have been, “Do any connections occur before site navigation?”, to which a simple Yes or No suffices; either it’s Yes, or it’s No, as for tracking purposes it doesn’t matter whether it’s 1, 2, or many — only if it’s zero or non-zero. Those two questions would lead to productive discussion and debate, in a way that lists of hostnames with a statement of neutrality does not.
brk 3y ago
I'm not sure you can derive any useful conclusions from this post. Various browsers invoke various numbers of connections to remote peers upon initial startup. There is no technical reason that a browser (or any software) couldn't open a single connection, and funnel every piece of data it can extract from your machine to a remote host. That remote host could then distribute that data to any number of other hosts/services without your awareness. For the purposes of privacy, all connections numbering more than 0 are functionally identical. At a minimum it might be helpful to include some information on the amount of data transmitted over these connections.
- freediver 3y ago
  > I'm not sure you can derive any useful conclusions from this post. A striking one is that many browsers continue to claim to be privacy respecting, when in reality they are not even though it is easilly verifiable. You are correct in saying that from the standpoint of privacy there is either zero telemetry or everything else. There are other drawbacks from having many unnecessary 'phone home' requests, like performance in slow connection environments. And may I add - telemetry on by default is just not decent, browser is supposed to be my ("user") agent, not somebody else's.
  - dietr1ch 3y ago
    Privacy is not a goal, but just a marketing tool these days.
  - Tagbert 3y ago
    Another striking conclusion is that even browsers that value privacy need to have some level of understanding about what features their users are using and what they are not.
    - freediver 3y ago
      Nothing wrong with that, it just needs to be opt-in or otherwise you can not claim to be a privacy-respecting browser by default.
blueflow 3y ago
"239.255.255.250 on UDP port 1900" is listed for several browsers. This is not telemetry, this is a UPnP discovery broadcast. Not a "connection", either.
- deleted 3y ago
  [deleted]
  - deleted 3y ago
    [deleted]
norenh 3y ago
Thanks! This info is always nice to have when setting up firewalls. Every application should come with a list of connections made, what the purpose is and what the consequences are if you disallow it.
- bee_rider 3y ago
  I guess windows does ask if you want to let a program connect to the internet. Of course that pop-up occurs so often that everyone just hits “go for it,” right?
butz 3y ago
It would be interesting to go over each connection and figure out what it really does. E.g. "contile" from Firefox: "The goal of this service is to pass tiles from partners along to Firefox for display while ensuring customer privacy and choice". "detectnetwork": tests whether the network connection requires you to log in or accept the network's terms before permitting you to use the network.
xg15 3y ago
> ocsp.pki.goog You know your org has too much money and/or power if you don't even bother with domains anymore but just request another custom TLD for your infrastructure hosts.
simlevesque 3y ago
For an overview on Android there's this great website: https://divestos.org/pages/browsers https://divestos.org/pages/browsers I'm using Cromite at the moment.
- iamcalledrob 3y ago
  An issue I've found with Cromite is that it doesn't pass the magic "are you a bot?" tests that various websites perform. For example, I can't log into the Linode console using Cromite, but I can with Chrome. Has anyone encountered anything similar or know how to fix it? I'd much rather not be using Chrome.
  - PinkSheep 3y ago
    Did you complain to Linode to fix it?
timeon 3y ago
Privacy aside, Arc seems to be doing too much work.
m463 3y ago
I couldn't even get their webpage to load until I turned off scripts and unblocked check.ddos-guard.net. That said, it is hard to understand how much stuff is going on in the background unless you have good browser extensions and proxy or outgoing firewall. I use firefox and just block mozilla.[net,com,org] firefox.* etc.
beardog 3y ago
Tor browser connects to the Tor network - which isn't telemetry but the post said not everything listed is telemetry.
- div72 3y ago
  The post is about unsolicited requests at startup, Tor Browser does not connect to Tor unless you click Connect or enable the auto-connect option.
Georgelemental 3y ago
> # Brave > Version: 1.33.106 > […] > - ftx.com on TCP port 443 Hopefully that one is no longer present…
Casteil 3y ago
Seems like every new update, Edge gets more enabled-by-default 'telemetry' options. Here's one of the latest: >Include related matches in Find on page >When enabled, your Find on page search and the webpage contents will be sent to Microsoft to help find better results, including synonyms, alternate spellings, and answers to questions
- wilkystyle 3y ago
  The addition of new options that are default-on is an incredibly user-hostile pattern, and it is depressingly common: - Modern Windows versions introducing new telemetry options (to say nothing of existing disabled options being toggled back on...) - LinkedIn with with new notification types that are turned on by default, with no option to disable all notifications entirely (there are now so many notifications that the notifications settings page has a nested page) - My former University's newsletters mailing list, which keeps adding new types of newsletter that I am default subscribed to, despite previously unsubscribing from every other newsletter (I finally just created a mail rule to block the entire subdomain.domain.edu). And the list goes on...
  - Casteil 3y ago
    Yeah, it's incredibly invasive. US desperately needs privacy laws governing these mass violations of privacy.
freediver 3y ago
From the article, number of requests on start: Mullvad, Orion, Tor, Ungoogled Chromium - 0 (zero telemetry) LibreWolf - 3 Safari - 6 Brave - 7 Chrome - 9 Chromium - 12 Vivaldi - 13 Firefox, Yandex - 15 Edge, Opera - 21 Arc - 44
Unfrozen0688 3y ago
Website blocked due to riskware from Malwarebytes
neonate 3y ago
https://archive.ph/4No7C https://archive.ph/4No7C
korse 3y ago
This is heresy! Lynx isn't listed!
danielspace23 3y ago
I agree with everyone else that the number of hosts reached at startup, by itself, it absolutely useless. There are better articles, personally I like https://digdeeper.neocities.org/articles/browsers https://digdeeper.neocities.org/articles/browsers which goes into greater detail, examining the purpose of the connections, not only at startup. It does tend to label even some requests (such as updates checking) as spyware, but everything is explained so you can still come to your own conclusions.

66 points by freediver 3y ago

_lvbh 3y ago

DDOS Guard is blocking my Safari

acco102 3y ago
after DDOS Guard https://sizeof.cat/img/hn.jpg https://sizeof.cat/img/hn.jpg

butz 3y ago

Purple scrollbar on purple background... And this is why website authors should not be allowed to style browser controls.

UberFly 3y ago
I had to install Custom Scrollbars for this reason.
PinkSheep 3y ago
That's magenta on purple with decent contrast. To my eye that's vastly more usable than those San Francisco Thin fonts.

branon 3y ago

Why's Brave try to talk to ftx.com? Website's defunct anyway.

cbsmith 3y ago
I'm guessing it's leftovers from their whole "reimburse websites via crypto" strategy.
fckgw 3y ago
The blog post is from 2021
quincepie 3y ago
I believe it's from the new page widgets: https://community.brave.com/t/what-is-ftx-and-why-did-it-suddenly-show-up-on-my-browser-window/263542 https://community.brave.com/t/what-is-ftx-and-why-did-it-sud...

altairprime 3y ago

The metric of “hostnames contacted” isn’t a valuable pressure point: each browser can simply replace all hostnames with one, at which point they’ll look better than their competitors without having made any material changes whatsoever in behavior. The correct metric here is “number of requests initiated”, but that’s harder to collect than copy-pasting logs from LittleSnitch and gesturing theatrically at them as this post is doing.

arccy 3y ago
you could just tunnel everything over a single long lived request
ziddoap 3y ago
>gesturing theatrically Agreed that this post isn't particularly illuminating, but where is the theatrics? It's just a list of connections, and the author even refuses to put a conclusion.
- altairprime 3y ago
  They claim to refuse to draw any conclusion, but then in contradiction to that statement, state their personal belief that any connection number greater than zero is harmful elsewhere in a later paragraph; and present the appearance of taking the high ground by not making claims, in contrast to journalists that do. This document as presented is only meaningful to two audiences: those who already agree with the author’s viewpoint on connections made by browsers when no user action has occurred, and those who have already formed viewpoints on the concerns around browsers and outbound connections. This is theatrics. The author clearly has opinions, and has crafted it to be attractive and interesting solely to those who have already formed an opinion on these issues — as is evident from the context that leads to such a post existing at all, much less reaching the HN front page. A less theatrical post could have stated why counting these connections matters to anyone, and plainly stated the author’s view that browsers with a count of zero are preferable. Instead, they buried their opinion in a later paragraph, declared it absent when it’s present, and left things vague enough that any supporter of their viewpoint can argue to any detractor of their viewpoint that they never stated an opinion at all. Instead of supporting productive and nuanced conversation, they fan the flames of belief with data structured to promote their view, while attempting (and failing) to claim the neutral high ground. A useful datapoint for evaluating their viewpoint here would have been, “Are all of the browser’s outbound connections first-party to the browser’s author and/or the site navigated?”. For many mobile browsers embedded in mobile apps, is wholly untrue: they monitor and report on your page views to themselves, which is a gross violation of privacy. Another would have been, “Do any connections occur before site navigation?”, to which a simple Yes or No suffices; either it’s Yes, or it’s No, as for tracking purposes it doesn’t matter whether it’s 1, 2, or many — only if it’s zero or non-zero. Those two questions would lead to productive discussion and debate, in a way that lists of hostnames with a statement of neutrality does not.

brk 3y ago

I'm not sure you can derive any useful conclusions from this post. Various browsers invoke various numbers of connections to remote peers upon initial startup. There is no technical reason that a browser (or any software) couldn't open a single connection, and funnel every piece of data it can extract from your machine to a remote host. That remote host could then distribute that data to any number of other hosts/services without your awareness. For the purposes of privacy, all connections numbering more than 0 are functionally identical. At a minimum it might be helpful to include some information on the amount of data transmitted over these connections.

freediver 3y ago
> I'm not sure you can derive any useful conclusions from this post. A striking one is that many browsers continue to claim to be privacy respecting, when in reality they are not even though it is easilly verifiable. You are correct in saying that from the standpoint of privacy there is either zero telemetry or everything else. There are other drawbacks from having many unnecessary 'phone home' requests, like performance in slow connection environments. And may I add - telemetry on by default is just not decent, browser is supposed to be my ("user") agent, not somebody else's.
- dietr1ch 3y ago
  Privacy is not a goal, but just a marketing tool these days.
- Tagbert 3y ago
  Another striking conclusion is that even browsers that value privacy need to have some level of understanding about what features their users are using and what they are not.
  - freediver 3y ago
    Nothing wrong with that, it just needs to be opt-in or otherwise you can not claim to be a privacy-respecting browser by default.

blueflow 3y ago

"239.255.255.250 on UDP port 1900" is listed for several browsers. This is not telemetry, this is a UPnP discovery broadcast. Not a "connection", either.

deleted 3y ago
[deleted]
- deleted 3y ago
  [deleted]

norenh 3y ago

Thanks! This info is always nice to have when setting up firewalls. Every application should come with a list of connections made, what the purpose is and what the consequences are if you disallow it.

bee_rider 3y ago
I guess windows does ask if you want to let a program connect to the internet. Of course that pop-up occurs so often that everyone just hits “go for it,” right?

butz 3y ago

It would be interesting to go over each connection and figure out what it really does. E.g. "contile" from Firefox: "The goal of this service is to pass tiles from partners along to Firefox for display while ensuring customer privacy and choice". "detectnetwork": tests whether the network connection requires you to log in or accept the network's terms before permitting you to use the network.

xg15 3y ago

> ocsp.pki.goog You know your org has too much money and/or power if you don't even bother with domains anymore but just request another custom TLD for your infrastructure hosts.

simlevesque 3y ago

For an overview on Android there's this great website: https://divestos.org/pages/browsers https://divestos.org/pages/browsers I'm using Cromite at the moment.

iamcalledrob 3y ago
An issue I've found with Cromite is that it doesn't pass the magic "are you a bot?" tests that various websites perform. For example, I can't log into the Linode console using Cromite, but I can with Chrome. Has anyone encountered anything similar or know how to fix it? I'd much rather not be using Chrome.
- PinkSheep 3y ago
  Did you complain to Linode to fix it?

timeon 3y ago

Privacy aside, Arc seems to be doing too much work.

m463 3y ago

I couldn't even get their webpage to load until I turned off scripts and unblocked check.ddos-guard.net. That said, it is hard to understand how much stuff is going on in the background unless you have good browser extensions and proxy or outgoing firewall. I use firefox and just block mozilla.[net,com,org] firefox.* etc.

beardog 3y ago

Tor browser connects to the Tor network - which isn't telemetry but the post said not everything listed is telemetry.

div72 3y ago
The post is about unsolicited requests at startup, Tor Browser does not connect to Tor unless you click Connect or enable the auto-connect option.

Georgelemental 3y ago

> # Brave > Version: 1.33.106 > […] > - ftx.com on TCP port 443 Hopefully that one is no longer present…

Casteil 3y ago

Seems like every new update, Edge gets more enabled-by-default 'telemetry' options. Here's one of the latest: >Include related matches in Find on page >When enabled, your Find on page search and the webpage contents will be sent to Microsoft to help find better results, including synonyms, alternate spellings, and answers to questions

wilkystyle 3y ago
The addition of new options that are default-on is an incredibly user-hostile pattern, and it is depressingly common: - Modern Windows versions introducing new telemetry options (to say nothing of existing disabled options being toggled back on...) - LinkedIn with with new notification types that are turned on by default, with no option to disable all notifications entirely (there are now so many notifications that the notifications settings page has a nested page) - My former University's newsletters mailing list, which keeps adding new types of newsletter that I am default subscribed to, despite previously unsubscribing from every other newsletter (I finally just created a mail rule to block the entire subdomain.domain.edu). And the list goes on...
- Casteil 3y ago
  Yeah, it's incredibly invasive. US desperately needs privacy laws governing these mass violations of privacy.

freediver 3y ago

From the article, number of requests on start: Mullvad, Orion, Tor, Ungoogled Chromium - 0 (zero telemetry) LibreWolf - 3 Safari - 6 Brave - 7 Chrome - 9 Chromium - 12 Vivaldi - 13 Firefox, Yandex - 15 Edge, Opera - 21 Arc - 44

Unfrozen0688 3y ago

Website blocked due to riskware from Malwarebytes

neonate 3y ago

https://archive.ph/4No7C https://archive.ph/4No7C

korse 3y ago

This is heresy! Lynx isn't listed!

danielspace23 3y ago

I agree with everyone else that the number of hosts reached at startup, by itself, it absolutely useless. There are better articles, personally I like https://digdeeper.neocities.org/articles/browsers https://digdeeper.neocities.org/articles/browsers which goes into greater detail, examining the purpose of the connections, not only at startup. It does tend to label even some requests (such as updates checking) as spyware, but everything is explained so you can still come to your own conclusions.