4 ms·
> For the purposes of privacy, all connections numbering more than 0 are functionally identical. Even a browser that launches zero connections upon first start
by kibwen 3y ago
> For the purposes of privacy, all connections numbering more than 0 are functionally identical.
Even a browser that launches zero connections upon first startup could start doing so after a random delay and/or while you're connecting to a legitimate website. And if you visit any website from any entity that produces the browser, it can smuggle out data without opening any new connections, e.g. Chrome could backchannel data up to the mothership when you access any Google-owned website. And on desktop, who's to say that the installer itself didn't already send up data, or otherwise install a separate binary that will? And on mobile, Google and Apple already have half the world's data, because they own the OS!
So in effect, this benchmark shows nothing at all. It's a web browser, at some point you're going to access the web with it or else you wouldn't have installed it, so demonstrating that it has network connectivity is not particularly interesting.
- freediver 3y agoNetwork connection because the user expects it, is fine. If a browser is privacy-protecting it may even proactively block connections related to ads/trackers. However if a browser claims to be privacy respecting than it has to be zero telemetry by default, otherwise it isn't. If you do not care about it being privacy-respecting, than sure, why not relay information to browser vendor and/or 3rd parties on startup.
- kibwen 3y agoSure, and yet this comment has zero relevance to the content of this post, because this method cannot disprove that any of these browsers have telemetry, nor do any of these connections imply telemetry on their own. Read the source code if you want to prove or disprove the absence of telemetry. And if you don't control the source code or if you can't build reproducibly, you've already lost.
- freediver 3y agoHow so? This method (monitoring connections through network proxy) is perfectly viable for detecting outbound connections from a browser. If a browser makes an unwanted connection to the browser vendor and/or third party site, that is unwanted telemetry. Regardless of what the purpose of that request was, user's IP address has been transmitted (hence telemetry from user standpoint) and users's privacy was not respected. Client source code is irrelevant from the standpoint of privacy, as such requests are processed server side and to my knowledge no browser with telemetry has open sourced their server side data processing code.