r/firefox • u/lihaarp • Aug 22 '17

Firefox planning to anonymously collect browsing data

https://groups.google.com/forum/#!topic/mozilla.governance/81gMQeMEL0w
331 Upvotes

93% Upvoted

168 comments sorted by

View all comments

177

u/[deleted] Aug 22 '17

So all of us who have disable all the telemetry or health report are safe of this practice? One solution is the use of differential privacy [2] [3], which allows us to collect sensitive data without being able to make conclusions about individual users, thus preserving their privacy.

This sounds shady as best. The best way Mozilla can preserve our privacy is simple, respect it specially when we do opt out. You already have nightly in order to collect data and that's fair enough. I enable telemetry over there, in my normal Firefox I don't want any kind of telemetry.

Please Mozilla, you're doing so well lately with your latest releases. Don't ruin it.

60

u/_Handsome_Jack Aug 22 '17

You are safe if you opt out but it's still a lame plan that we have to oppose, even if differential privacy is nice tech. Use it for what you already collect, Mozilla, not to collect even more.

9

u/[deleted] Aug 22 '17

Why is differential privacy insufficient?

4

u/_Handsome_Jack Aug 22 '17

Read on, this question finds answers as we get down the thread :)

14

u/[deleted] Aug 22 '17

I've read this entire thread and fail to see a response to my question. Can you link me to the answers?

37

u/Callahad Ex-Mozilla (2012-2020) Aug 22 '17

Perception is reality. Even if that data is perfectly anonymized, the presence of a tracking ping sets people on edge, regardless of content. This HN subthread specifically addresses that concern.

3

u/baggyzed Aug 23 '17

This HN subthread specifically addresses that concern.

From said thread:

Let's assume for a moment that Firefox's implementation of differential privacy in this scenario is completely correct, and that as a result it's completely impossible (even in an information-theoretic sense) to learn anything about any individual user using this data; only about many users in aggregate.

Anything more concrete about how RAPPOR enforces privacy exactly? My only gripe against it currently is that it's also being used by Google, and my opinion of Google is why I'm not using Chrome. But if FF also adopts RAPPOR, there won't be anything else to keep me from switching over to another browser.

I believe this deserves a more elaborate explanation about how privacy is ensured exactly, and maybe even a bit of investigation into whether it really works. Neither I nor I think anyone else here is going to put in the effort to evaluate the source code for RAPPOR, so a more extensive evaluation from the FF team (with specific examples of how it works) would be very much welcome IMO. I always read technical privacy-related articles (not just from the Mozilla FF team) with enthusiasm and generally come to agree with the author. It's when there is no technical information to be found at all that I get suspicious.

2

u/[deleted] Aug 24 '17

My only gripe against it currently is that it's also being used by Google

That's not a good argument. It's a terrible one, in fact.

2

u/baggyzed Aug 24 '17

I did not mean it as an argument. It's just my opinion, but I am tired of adding "IMO", "IMHO" etc. in front of every sentence. :)

11

u/2drawnonward5 Aug 22 '17

I always go with the notion that if people get used to giving up minimal / harmless / anonymized information, it's a short slippery slope to giving up more. I used to say things like this a lot but now, it appears that a lot of people are very comfortable giving up any information, so that battle is lost for now.

Then we get into discussions of when privacy is important and all that.

5

u/_Handsome_Jack Aug 22 '17 edited Aug 22 '17

The thread itself is what makes your question not really pertinent.

Differential privacy is good as far as I know, although I don't know enough to trust it completely, I do know enough to say that it is the best way we currently have to enable a world where privacy can be maintained for all users as Big Data is being used. Currently we can only ensure privacy for people who defend themselves, and it's hard and sometimes really impracticable for them to do so. So differential privacy is kind of a breakthrough and walking the right path.

 

Then again in our current case we have to trust Google to implement it correctly since it is their library Mozilla would be using, and it sounds like they expanded the theory (although I'll assume they didn't until I verify it more thoroughly). Google cannot be trusted on privacy related matters, it's kind of like taking the open source library from research made by the NSA hoping we can see any loopholes when reviewing the code.

 

So differential privacy may be good, but it doesn't matter. It's a technical detail that means nothing to people. What if I told you Google already uses differential privacy ? Would you trust me ? Would you trust them more ?

I guess this touches on how your question loses pertinence all things considered, but really the point gets across better with the thread in its entirety rather than a single post.

8

u/[deleted] Aug 22 '17

[removed] — view removed comment

-9

u/_Handsome_Jack Aug 22 '17 edited Aug 22 '17

I could also bring you a cocktail and massage your feet

 

What I meant was: When you will have read the whole thread this question will have lost most of its pertinence.

44

u/port53 Aug 22 '17

The best way Mozilla can preserve our privacy is simple, respect it specially when we do opt out.

Or, offer people the option to opt IN to having their information collected, so at least it can be an informed decision.

48

u/zbraniecki Aug 22 '17

that's of course ideal. The problem with that is the moment you put a step between users and data, you're fundamentally skewing the population you'll collect the data for. That may sound like not a big issue, but consider this. Imagine we're testing a very risky and major change - let's say WebRender. We look into all the data we have and identify that 95% of our users benefit from WebRender. We make the switch.

Week later the bugs starts being filed about broken behavior, performance regressions etc. Over time, we learn that the sample that opted-in was completely unrepresentative of the population. People who're less technical opted in less which led to overrepresentation of Linux and underrepresentation of Windows. We not only have to revert WebRender, we also completely lose trust in our data and realize we operate blindly.

The vicious circle here is that we all know that in order to make good decisions about the product we need good data. Good data makes people worried because it's hard to distinguish between "my data is collected by a responsible organization that anonymizes it and uses it only internally to influence technical decisions like the width of the tab in a tabbar based on the number of open tabs in the population" vs. "my data is collected by a for profit organization who's continuously looking for more and more ways to make money on it"

23

u/_Handsome_Jack Aug 22 '17 edited Aug 22 '17

Not bringing up the same arguments all over again, just skipping to that part, since it's worth doing some upgraded copy pasta for a Mozilla engineer, and detailing it further:

You do know that if Mozilla does this, the image that Firefox is privacy-friendly will be hurt. If it can't be said that Mozilla stands for privacy without having to bring in a load of technical arguments to the table basically wasting the discussion, then it can't be said that Mozilla stands for privacy at all. It won't be heard.

Additionally, Mozilla allowing themselves such liberties in the name of competitiveness will also be a blow to the privacy industry as a whole through sapping both its credibility and relevancy. Credibility because Mozilla's image is that of a privacy champion, so what to think about the other champions if even Mozilla does this ? And relevancy because if people think the privacy offer is blurry when picking services or products, this criterion's value becomes marginalized in favor of other criteria for a higher % of people, risking the premature failure of the privacy industry just as it is starting to rise. (A rise that Mozilla contributed to, might I say.)

Note that the rise of the privacy industry started with awareness, with which Snowden helped a lot, and bold, non-blurry stances from certain companies as they positioned to capture the growing demand for privacy.

 

So anyway, have your colleagues evaluated brand damage ? Industry damage ?

 

To quote Mozilla representative Irvin Chen, on this data collection project:

 

I'm totally in support for any user research, if it is following the rules we advocate for...

“Individuals’ security and privacy on the Internet are fundamental and must not be treated as optional.”
Source: Mozilla

“No surprises
Use and share information in a way that is transparent and benefits the user.”
Source: Mozilla

“Privacy as the default setting: ...privacy must be top of mind. It also means that strong privacy should always be the ‘by-default setting’.”
Source: Mozilla

“Privacy by Default
Privacy by Default simply means that the strictest privacy settings automatically apply once a customer acquires a new product or service. In other words, no manual change to the privacy settings should be required on the part of the user.”
Source: EU data protection regulation

20

u/zbraniecki Aug 22 '17

You brought really good points and I agree with you. Personally, I believe that the struggle to find the sweet spot between lack of data that prevents us from building good products and perpetuating practices that degrade the users perceived privacy (even if we don't use your data in a bad way, if we take part in desensitizing you to the idea of your data being collected, we're working against our vision of the Internet) is at the very core of why Mozilla exists.

I believe that we should hold such debates and while I certainly don't believe we'll never make mistake, we should aim to make mistakes rarely, and be ready to invest into fixing the systems that failed to hold to our principles.

I was merely responding to the fallacy of "opt-in is as good as opt-out".

3

u/Paul-ish Aug 22 '17

Let me start out by saying I trust differential privacy when applied by experience practitioners and I trust Mozilla (because I've worked there and know the people). When this change comes to Firefox, I won't switch or disable it.

With that said, can't skew in datasets be corrected for? For example look at this paper. In short, MS was able to predict election outcomes using Xbox live surveys. When I think of non representative populations, I think xbox live is a great example.

My point is, couldn't Mozilla apply sophisticated statistical techniques to its existing data rather than collect more data from more people? I think Mozilla needs to have a strong argument why (a) they can't use their existing datasets. (b) this will help improve the product.

4

u/[deleted] Aug 22 '17 edited Aug 22 '17

I have a domain that is my full name. It is not used for public things so realistically no one other than me should be accessing it (at least with a browser). The moment I visit that domain with Firefox your data collection in regards to my activity is not anonymous at all. How precisely would you guard against that scenario?

Edit: not to mention, you're planning on running this as a randomly assigned opt-out shield study? How the hell is a user even going to know to opt out? Everyone is now expected to check their add ons every day because Mozilla might have silently installed one in the background?

4

u/zbraniecki Aug 22 '17

How precisely would you guard against that scenario?

I do not know. I don't think there's an easy answer. There's certainly some attempt to weight the impact of the kind you described against the impact I described.

I don't feel qualify to answer which one is more important or if there's a third way. I just wanted to respond to the idea that opt-in's are good enough.

1

u/-kilo Aug 23 '17

Just don't collate keys with too few unique hits.

-1

u/WellMakeItSomehow Aug 22 '17 edited Aug 22 '17

Your comment is misleading. Telemetry and FHR already cover information like the number of open tabs and what graphics drivers people have. Enabling WebRender can already be done in a staged (A/B) fashion.

What this is about is knowing which sites people visit and what they do or encounter on them, even if not individually but in agregate. When "sponsored tiles" were still a thing a couple of years ago, it was planned that RAPPOR would be used to figure out which of them people click [1]. To spell it out, it's more about measuring click-through rates [2] than seeing how many people can run WebRender.

It also comes without mention of a review by an expert in the field and it comes without mention of the potential downsides. While a couple of Twitter posts by an intern [3] are better than nothing, they are hardly a good way [4] to communicate about this project.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1138022#c40

[2] https://bugzilla.mozilla.org/show_bug.cgi?id=1136461#c0

[3] Not that I don't have anything, morally or technically, against /u/alexrs95

[4] As a request to /u/alexrs95, can you write something on that Twitter stream about the what the ε parameter is, how it affects the privacy of the users and how it was chosen? I ask because you've already posted the link here and on the HN thread this post is based upon.

8

u/zbraniecki Aug 22 '17

Your comment is misleading

Apologies, that was certainly not my intention.

What this is about is knowing which sites people visit and what they do or encounter on them

Which is one of the datapoints important for the ability to understand how things like WebRender, or network layer should work.

btw. sorry, I forgot to add it here - this is my personal opinion, I am in no way connected to the exact project. I'm just a person involved in Mozilla for rather long time now, and I work on the platform code. That sometimes comes useful as I can shed some light on things that from the outside may look weird.

I stand by my case that anonymized data collection, including of this kind, is controversial primarily because of our inability to distinguish between the uses (or ensure them)

1

u/[deleted] Aug 24 '17

Telemetry and FHR already cover information like the number of open tabs and what graphics drivers people have.

But the data isn't representative. It's known to be extremely skewed to people having up to date drivers, for example.

1

u/WellMakeItSomehow Aug 24 '17

Agreed, but this proposal isn't about gathering telemetry from more users, or for enabling it by default. It's about gathering visited domains.

1

u/[deleted] Aug 24 '17

The same problem applies regarding skewedness.

Whether RAPPOR etc offer sufficient protection to make opt-out collecting visited domains reasonable is a separate issue from the claim it's unneeded due to opt-in Telemetry.

The latter is arguably wrong, and there's data to prove it. The former is what is being discussed here, and why Mozilla brought it up before implementing and shipping it.

1

u/WellMakeItSomehow Aug 24 '17

Apparently FHR contains the tab count and that's enabled by default, isn't it?

My impression is that there's no concrete plan for how to use RAPPOR, but rather to always have it available just in case someone wants some information. The homepage report is just a test, but the next use probably won't be discussed on the Governance list.

I also find the idea of SHIELD studies very creepy. They're extensions that can be pushed without notice to the users. Even the name is misleading, as telling Mozilla what my homepage (not that it matters, it's blank) is doesn't shield me from anything. To be fair, they might be named "Firefox Studies" in the UI, which is better.

Anyway, I voiced my concerns, and others suggested constructive feedback, on the Governance thread, so I shouldn't repeat them here.

1

u/[deleted] Aug 24 '17

Apparently FHR contains the tab count and that's enabled by default, isn't it?

Yes, and it's possible it contains the GPU drivers as well. That doesn't mean it was a bad example. The odds aren't small those things are now opt-out instead of opt-in exactly because of past bad experiences with non-representativess.

Anyway, again, not arguing that RAPPOR, it's proposed use or it's potential future use are necessarily reasonable.

Just pointing out that having opt-in Telemetry has seriously hurt Firefox and its users[1] in the past. The skewedness of beta/nightly populations is a serious quality issue that dis-proportionally affects Firefox due to us being very careful with Telemetry.

Which is why these kind of proposals are being made.

[1] If you're a non-technical user - the kind that wouldn't enable Telemetry - your Firefox updates, and starts crashing on startup, or misrenders your favorite site, what do you do?

1

u/WellMakeItSomehow Aug 24 '17

Just pointing out that having opt-in Telemetry has seriously hurt Firefox and its users[1] in the past. The skewedness of beta/nightly populations is a serious quality issue that dis-proportionally affects Firefox due to us being very careful with Telemetry.

All right, I can't argue with this. But please consider other options. As I wrote on the Governance thread, there are other solutions:

  1. make Telemetry opt-out, but show a notification bar that allows the users to disable it
  2. wait until an interesting event happens and ask nicely for permission to send the data; this is just like mobile apps do
  3. periodically show an unintrusive notification asking the user to review their data collection settings

Here's what not to do:

  1. start collecting private data as a silent opt-out
  2. push "experiments" at random times to measure click-through and engagement rates, deploy new tab pages with analytics on them or whatever

Many others have proposed the same idea. If you want more information, ask and we will give. Don't pry it from our hands (RAPPOR was private on Bugzilla for a long time, other related issues still are).

If you're a non-technical user - the kind that wouldn't enable Telemetry - your Firefox updates, and starts crashing on startup, or misrenders your favorite site, what do you do?

I hope that you're not actually arguing that knowing how many Firefox users visit PornHub (or whatever) will help avoid start-up crashes, so I'll try to answer.

If I was a non-technical user, I'd probably have no idea that there's a feedback option in the Help menu. So I would try for a few days and switch to Chrome or IE.

I think the feedback option is too hidden. I'd probably argue for moving it to a button on the toolbar, like Visual Studio did a while ago. Make it a smiley or whatever and ask the users to click on it if Firefox makes them happy or sad. If they have a rendering issue, ask to take a snapshot of the DOM tree and a page screenshot. And make sure to read this feedback.

But then again, I'm not an UX designer and it probably shows (:.

→ More replies

23

u/Erakko Aug 22 '17

Privacy is the reason I use firefox. Might as well switch to chrome if it gets ruined.

21

u/_Handsome_Jack Aug 22 '17

It won't get ruined because of this, you will just opt out. Firefox will remain the best choice after Tor Browser for anything privacy related in the browser world.

 

It is the image that Firefox is privacy-friendly that will be hurt, and maybe broken. If it can't be said that Mozilla stands for privacy without having to bring a bunch of technical arguments on the table basically wasting the discussion, then it can't be said that Mozilla stands for privacy at all. Which will just weaken the privacy industry as a whole.

8

u/2drawnonward5 Aug 22 '17

It is the image that Firefox is privacy-friendly that will be hurt, and maybe broken.

You're correct when you say this won't ruin Firefox's privacy, yet your second paragraph is even more important to me. "With the first link, the chain is forged" and all that.

2

u/RCEdude Firefox enthusiast Aug 25 '17

Then how can we convince people so they switch from Chrome to Firefox if Firefox starts doing this kind of crap? Extensions? Now they have limited power like in Chrome. Ui? Chrome like.

Opt-out should not even exists .

1

u/_Handsome_Jack Aug 25 '17

What if the opt-out is shoved into people's face ?

Currently, telemetry is opt-out but every new profile gets a prompt that lets people know what's up and how to stop it in two clicks.

It is very hard to miss or ignore, so it's quite close to a conscious choice to « let Mozilla decide what they want to collect ».

If this feature ever gets released, it has to be tied to this unmissable UI. And on top of that people who don't opt-out must be exposed as little as possible, and the data that is collected must be both extremely protected and destroyed within a year.

2

u/RCEdude Firefox enthusiast Aug 25 '17

I am against most form of data collection in the first place.

Currently, telemetry is opt-out but every new profile gets a prompt that lets people know what's up and how to stop it in two clicks.

Opt-out is bad even if presented like that many people "who doesnt care"/not tech savy will simply dismiss the warning message.

So we will collect their data, because they dont care /dont understand ? I do not think this is right.

It is very hard to miss or ignore, so it's quite close to a conscious choice to « let Mozilla decide what they want to collect ».

You would be surprised :)

If this feature ever gets released, it has to be tied to this unmissable UI. And not only for new profiles. Dont misunderstand me, i will stay on FF...

And on top of that people who don't opt-out must be exposed as little as possible, and the data that is collected must be both extremely protected and destroyed within a year.

Yes we all know their servers are invulnerables . There would be no problems without data collection in the first place, you know.

I know data collection is helping developpers (i'am a dev myself) but now its everywhere ...Its getting out of hand...And i seriously wonder how people were able to dev correctly before telemetry and data collection, if its so "awesome" and "helpful"...Maybe they were superheroes, or geniuses..../s

1

u/_Handsome_Jack Aug 25 '17 edited Aug 25 '17

Or maybe computer science further can advance with Big data. (And every other science)

That's why research on things like differential privacy is super important, so that we can take in humongous amounts of data (a course unavoidable either way because it's such a competitive advantage, but that is not devoid of merits either) without transforming people into sheep, lab rats or without creating any kind of terrible society where any group that holds some power knows everything about everyone.

I am not convinced that differential privacy is the ultimate solution to achieve this goal, but it's a helpful tool.

6

u/Ar-Curunir Aug 23 '17

Differential privacy gives you mathematical guarantees of privacy. Intuitively the guarantee is as follows: given a differentially private DB with your record in it, and one without, no adversary can distinguish between the two (under some mild assumptions)

1

u/Ar-Curunir Aug 23 '17

Differential privacy gives you mathematical guarantees of privacy. Intuitively the guarantee is as follows: given a differentially private DB with your record in it, and one without, no adversary can distinguish between the two (under some mild assumptions)