4 ms·

> Firefox is making a strong case for itself as the privacy centric browser. They try their best to market themselves as a privacy-centric browser. To promote

> Firefox is making a strong case for itself as the privacy centric browser. They try their best to market themselves as a privacy-centric browser. To promote themselves as so they add some shiny things like making clearing browser history a two mouse clicks more accessible. But I'm still worried. I'm really nitpicking but... That 3rd party cookie controversy that lasted for almost an year, the "oh, we're full of FLOSS ideals and are firmly against DRM but... hey, wait, users want Netflix, gotta support DRM" controversy, the recent "sponsored tiles" controversy, the update of over-engineered and undocumented proprietary Firefox Sync/Accounts that makes it even harder to not depend on their servers, the complete ignorance on TLS client certificates' UI and usability (which is why we're still stuck with passwords), the BrowserID/Persona thingy that happily continued the trend that makes your identity owned by a third party, and so on. I know, it's not good to complain in such rude manner, but the issues do exist. Personally, I wouldn't really trust Firefox. Not without lots of addons, at least. Unfortunately, I guess this can't be helped. A large project like Firefox seems to be impossible without steady and fairly big money income, and since this money comes from advertisers whose interests are in complete opposite of users' privacy, Mozilla just have to make some sacrifices. Still, among the mainstream browsers they're better than competitors.

zaachary 12y ago
I'm not going to rebut each mischaracterization, but I did work on Persona, so: > the BrowserID/Persona thingy that happily continued the trend that makes your identity owned by a third party Nah. You could happily choose any Identity Provider that implemented the protocol, including a self-hosted one.
- drdaeman 12y ago
  Nope, that's a pretty common misconception though. You surely can own a server (I do) but you just can't own a domain. You're merely leasing one from a registrar. You see, I strongly believe identity's an intrinsic property of a person, and if you need a provider for one there's something really wrong with the setup. I'm completely fine with asserting notaries, but not providers.
  - pwnna 12y ago
    Yes. Identity is an intrinsic property of a person. However, how would you design a system to check this property? It's a very difficult property to measure. Having someone vouching for it is a relatively safe and easy way to do this.
    - drdaeman 12y ago
      As usual, with credentials. It's just that credential must be something you can handle by yourself and not require a third party to provide to you. A third party may assert some aspect of your identity by providing a statement that the person who's in possession of the certain credentials has been verified by this notary to indeed have certain properties. But if me and some website are starting to become acquainted why do we need any third party as a strong requirement? When I walk into some office I don't have to show my passport, I just introduce myself and we get to the business. And then, if there's a necessity (!), business owner may ask me to provide some assertions of my identity. I don't see any reason it shouldn't work in a same manner on the web. Like, for example, "Hey there, you may call me Aleksey and here's my, say, public key so you could authenticate me at a later time."
      - wodenokoto 12y ago
        Remembering your face is what a cookie can do for you. You log-in via a trusted 3rd party (that may be owned by you) and you receive a cook for use next time. If you change your face the next time you walk in, like say you visit from your iPhone instead of you PC, they cant recognize you and will of course need strong verification, after which you may receive a cooking.
        drdaeman 12y ago
        This is a workaround. A completely different topic. My issue with Persona is about its very concepts, not some particular implementation issues.
  - xorcist 12y ago
nnethercote 12y ago
You'll find some recently-announced privacy initiatives interesting: * http://blog.mozilla.org/privacy/2014/11/10/introducing-polaris-privacy-initiative-to-accelerate-user-focused-privacy-online/ http://blog.mozilla.org/privacy/2014/11/10/introducing-polar... * http://monica-at-mozilla.blogspot.com.au/2014/11/tracking-protection-in-firefox.html http://monica-at-mozilla.blogspot.com.au/2014/11/tracking-pr... * http://blog.mozilla.org/nnethercote/2014/11/12/quantifying-the-effects-of-firefoxs-tracking-protection/ http://blog.mozilla.org/nnethercote/2014/11/12/quantifying-t...
- drdaeman 12y ago
  Thanks. Those look good. Less radical than I could wish for, but certainly good. Hope the existence of those features will be well-marketed, so they'll be enabled by sufficiently large amount of people to be able to blend into this crowd.
wodenokoto 12y ago
Yes it sucks that Mozilla loses some battles, but you surely must understand that there are stronger players around the world and it is impossible to win every battle. Firefox today is full of DRM features. They are called plug-ins. What theyre doing is cutting it down to one, secure plugin instead of a few insecure ones. Seems like a step up, though of course you can always wish for more. But again, stronger foes. I still dont understand the controversy about the tiles. Everybody freaks out that a browser which take in more than 300 million dollars a year in advertisement is going to show an ad. I actually thought selling that space is a good idea. Why should Mozilla give away free traffic like that? They can still quality control the links. Perfection is the enemy of good.

zaachary 12y ago

I'm not going to rebut each mischaracterization, but I did work on Persona, so: > the BrowserID/Persona thingy that happily continued the trend that makes your identity owned by a third party Nah. You could happily choose any Identity Provider that implemented the protocol, including a self-hosted one.

drdaeman 12y ago
Nope, that's a pretty common misconception though. You surely can own a server (I do) but you just can't own a domain. You're merely leasing one from a registrar. You see, I strongly believe identity's an intrinsic property of a person, and if you need a provider for one there's something really wrong with the setup. I'm completely fine with asserting notaries, but not providers.
- pwnna 12y ago
  Yes. Identity is an intrinsic property of a person. However, how would you design a system to check this property? It's a very difficult property to measure. Having someone vouching for it is a relatively safe and easy way to do this.
  - drdaeman 12y ago
    As usual, with credentials. It's just that credential must be something you can handle by yourself and not require a third party to provide to you. A third party may assert some aspect of your identity by providing a statement that the person who's in possession of the certain credentials has been verified by this notary to indeed have certain properties. But if me and some website are starting to become acquainted why do we need any third party as a strong requirement? When I walk into some office I don't have to show my passport, I just introduce myself and we get to the business. And then, if there's a necessity (!), business owner may ask me to provide some assertions of my identity. I don't see any reason it shouldn't work in a same manner on the web. Like, for example, "Hey there, you may call me Aleksey and here's my, say, public key so you could authenticate me at a later time."
    - wodenokoto 12y ago
      Remembering your face is what a cookie can do for you. You log-in via a trusted 3rd party (that may be owned by you) and you receive a cook for use next time. If you change your face the next time you walk in, like say you visit from your iPhone instead of you PC, they cant recognize you and will of course need strong verification, after which you may receive a cooking.
      - drdaeman 12y ago
        This is a workaround. A completely different topic. My issue with Persona is about its very concepts, not some particular implementation issues.
- xorcist 12y ago

nnethercote 12y ago

You'll find some recently-announced privacy initiatives interesting: * http://blog.mozilla.org/privacy/2014/11/10/introducing-polaris-privacy-initiative-to-accelerate-user-focused-privacy-online/ http://blog.mozilla.org/privacy/2014/11/10/introducing-polar... * http://monica-at-mozilla.blogspot.com.au/2014/11/tracking-protection-in-firefox.html http://monica-at-mozilla.blogspot.com.au/2014/11/tracking-pr... * http://blog.mozilla.org/nnethercote/2014/11/12/quantifying-the-effects-of-firefoxs-tracking-protection/ http://blog.mozilla.org/nnethercote/2014/11/12/quantifying-t...

drdaeman 12y ago
Thanks. Those look good. Less radical than I could wish for, but certainly good. Hope the existence of those features will be well-marketed, so they'll be enabled by sufficiently large amount of people to be able to blend into this crowd.

wodenokoto 12y ago

Yes it sucks that Mozilla loses some battles, but you surely must understand that there are stronger players around the world and it is impossible to win every battle. Firefox today is full of DRM features. They are called plug-ins. What theyre doing is cutting it down to one, secure plugin instead of a few insecure ones. Seems like a step up, though of course you can always wish for more. But again, stronger foes. I still dont understand the controversy about the tiles. Everybody freaks out that a browser which take in more than 300 million dollars a year in advertisement is going to show an ad. I actually thought selling that space is a good idea. Why should Mozilla give away free traffic like that? They can still quality control the links. Perfection is the enemy of good.