Firefox Personal Data Promise

https://blog.mozilla.org/firefox/firefox-data-privacy-promise/

by sciurus • 7 years ago

176 60 7 years ago

blog.mozilla.org

kreetx• 7 years ago

Do they take periodic donations somewhere? ;)

Krasnol• 7 years ago

https://donate.mozilla.org/en-US/?presets=50%2C30%2C20%2C10&...

dblohm73• 7 years ago

Note that donations are used exclusively for Foundation efforts; donation money is not put toward product development.

(The Foundation is a great cause, obviously, but I want to ensure that you are aware of how your donation will be used.)

dogecoinbase• 7 years ago

I love Mozilla, but it's difficult to take this seriously while they're still partnering with Cloudflare on in-browser resolvers that bypass my local DNS resolver and expose my lookups to Cloudflare: https://blog.mozilla.org/futurereleases/2019/04/02/dns-over-...

josteink2• 7 years ago

I mean... I’m fine with Cloudflare DoH being an option.

But being the default? That’s just crazy.

afiori5• 7 years ago

As far as I remember having a predefined default was never actually considered.

Kalium2• 7 years ago

Do you think there are users for whom this might be a valuable feature that protects them from snooping ISPs?

Any such feature, of course, must be something configurable such that any user wishing to use their own DNS provider can do so.

autoexec• 7 years ago

Maybe, but no one is forced to use their ISPs DNS either. Giving user's data to one snoop to protect them from another doesn't sound like a win to me either way.

captn3m0• 7 years ago

Mozilla has published a DoH resolver policy[0], which should hopefully allow more resolvers to be added to the default list, and let Firefox pick as per latency.

My personal resolver gives me better latency than both CF and Google, and I plan to get it added to the list[1].

[0] https://wiki.mozilla.org/Security/DOH-resolver-policy

[1] https://captnemo.in/dns/privacy/, https://captnemo.in/doh/

seieste2• 7 years ago

DOH makes Pihole ineffective.

sjwright3• 7 years ago

Pihole is redundant in Firefox with uBlock Origin.

zaarn• 7 years ago

PiHole just needs to implement DoH as both client and server.

sjwright3• 7 years ago

What makes you think your local DNS resolver is more secure? Does it have a secure connection to all of its upstream sources?

pbhjpbhj3• 7 years ago

Um, wtf? So, they're now bypassing user choice on DNS in order to send your domain lookups to Cloudflare and this is supposed to be security?

From https://bugzilla.mozilla.org/show_bug.cgi?id=1529437 it says "[QA:] We have finished testing ... GREEN - SHIP IT" and "signed version [...] for release". Does that mean it went mainstream and is now a browser default?

I see a preference name "network.trr.uri" with a cloudflare URL used for "dns-query" ... that looks bad?

Edit: just found this from Mozilla

"We are currently exploring what the right testing approach should be with users who have opted to participate by using Firefox Nightly." (from Senior Dir. for Eng., https://www.theregister.co.uk/2018/03/20/mozilla_firefox_tes...)

Mozilla's official line is that they consider using nightly as an opt in to send all your DNS requests to a third-party.

Now come on, no-one at Mozilla believes that is true to users expectations.

cfv• 7 years ago

I for one hope they keep this promise better than the EME one, about which I'm still super salty

jraph• 7 years ago

I don't know. I hate DRMs and so far I've successfully managed to avoid using EME.

But I recently said good things about Firefox to someone, and noticed one day that they switched to it from Edge. It felt like a small victory.

This person uses Netflix and Spotify. If Firefox didn't support EME, they would not have ditched Spotify and Netflix. They would probably have gone back to Edge, or installed Chrome and used EME from there. EME would not exist in my ideal world but in this case I'm kind of happy EME works in Firefox. Using Firefox over Edge or Chrome is a net gain. Maybe this person will evolve and start to refuse DRMs and/or seek free software (one can dream), but this is not today. Firefox acts like an entry point to this world. If the entry point is too rough, it will not be taken. One thing at a time.

EME is a lost battle, but the war is not over.

Zhenya• 7 years ago

Is there a place where I can see everything they promise to keep safe about me?

lucideer3• 7 years ago

It's great to see this recent marketing initiative from Mozilla to frame themselves as a privacy-first company. Mozilla has always been considered by the community as an organisation that should respect the privacy of their users, but there hasn't until now been such direct public statements to that effect to point to.

Mainly I hope this can now be pointed to by Mozilla/Firefox users as a set of standards that should be followed when Mozilla devs put in place measures that infringe users' privacy or don't do enough to protect it.

Right now, https://mozilla.org/ sets 15 Google cookies and 12 Google localStorage tracking values when you visit it. Mozilla's previous statements[0] justifying this have been fairly weak. I really hope this new PR initiative gives some extra leverage to those asking for change.

[0] https://groups.google.com/forum/#!msg/mozilla.governance/9IQ...

winningcontinue• 7 years ago

Be careful taking in this new direction as anything more than marketing PR. As you've stated before, I don't even think this time, it's anything more than the marketing department speaking for everyone. Mozilla has had weak statements on previous PR controversy's before. On a longer timescale, the organization will change it's position again due to economic and cultural pressures.

wayneftw4• 7 years ago

It's interesting to me how you can call out this post and recent others as a "marketing initiative from Mozilla" without any apparent backlash (as of yet), but when I called it "brigading by Mozilla supporters and fans" on multiple other threads I was completely removed from the conversation. Is there really a difference?

Is this the sort of story that casual users or even avid fans of the browser would organically promote? That's the logic that I was handed in some of the responses to me. Am I that out of place to assume that the following is how it goes down? 1.) The marketing/evangelical folks at Mozilla create a story and post it here and elsewhere. 2.) They put out a call to all their supporters in various channels to come and help promote the story (and keep other commenters in line apparently)...

I think the problem is that comment forums always optimize towards showing me what the currently active mob/majority thinks about a topic rather than sorting things towards my own personal tastes. I'd much rather see a rating system that weights posts/topics and comments based on my history. For instance: if I've promoted a certain topic in the past, put it higher. If I typically promote a given user, put their comment higher. If I typically promote a certain user who promoted another comment, put that comment higher. And so on. Basically censor the stuff I usually disagree with instead of allowing mob rule. [1]

I don't see the point of trying to make everybody see the same truth because that's not how real life works. Mostly, people tend to live in tribes. Wouldn't it be nice if the Internet wasn't always in your face telling you how wrong you are? IMO, such systems would put a chill on the global culture war.

[1] - This might be the perfect problem for a graph database. If anyone wants to work on something like this, let me know how to contact you and I'll give you all of my ideas!

feanaro4• 7 years ago

So, in other words, you want the internet to help you cement yourself in your current positions?

ryacko• 7 years ago

Most people follow like minded people, become surprised when they have an unexpected opinion, and sometimes unfollow them. Not sure developing new social media would gain adoption.

evmar• 7 years ago

Where in this page is the actual promise? Is it the "take less" bit? That is a surprisingly weak statement.

I think almost all of the statements made here are worded vaguely enough that could be equally have been claimed by Google, e.g. "never sell ... your info" / "only data we want is ... data that serves you in the end". But I think Mozilla's actual intended position is pretty far from Google.

afiori5• 7 years ago

It is the same claimed position maybe, but Google consider targeted ads a service to users

pbhjpbhj3• 7 years ago

Mozilla do too though, for example for Hello, or Pocket? They also have an advert for Firefox Mobile on desktop browsers. So Mozilla's ads are clearly de minimis in comparison, but they don't disagree on the prinicple of targeting ads to users (even after they've expressed a preference to receive no advertising).

AdmiralAsshat• 7 years ago

Pocket is notably absent from the "Firefox Family". Perhaps because they can't make that same personal data promise?

lucideer3• 7 years ago

Funnily enough, the Pocket logo is present in the thumbnail for the Firefox Family video on https://www.mozilla.org/en-US/ Pocket does not however feature in the video (which is unironically hosted on that Google video hosting platform...)

jeena• 7 years ago

That's really weird that they don't host the video themselves but instead on YouTube and send all their users (who go on that webpage) automatically to Google.

sp332• 7 years ago

Pocket isn't really Firefox-branded. Neither are Seamonkey, Thunderbird, Bugzilla, Rust, etc which didn't make the list.

mondoshawan2• 7 years ago

How about "take nothing" instead of "take less"? No PII should be "taken" anywhere. They're a browser -- a platform -- and as such they should be taking great strides to prevent collection of anything at all by applications running on that platform.

lucideer3• 7 years ago

Tbh, I don't have as big an issue with Mozilla "taking" lots and lots of my PII as I do with Mozilla sending data about me to 3rd-parties.

That is unfortunately not alluded to directly at all in this promise.

In fact, for an org championing privacy, one would expect them to at the very least be compliant with something like the GDPR. However, the privacy link[0] in the footer of their website lists data to 3rd-parties by default and describes (pretty non-straighforward) methods to opt-out of each of these individually, rather than the normally required explicit consent of GDPR.

[0] https://www.mozilla.org/en-US/privacy/websites/#cookies

dblohm73• 7 years ago

Most of the data that is collected by Mozilla is not PII.

See our data collection guidelines: https://wiki.mozilla.org/Firefox/Data_Collection

mondoshawan2• 7 years ago

It's good and all that you have a policy, but the fact remains that you have the ability to make exceptions for collecting PII in category 4. That's what I mean by "don't collect" -- this stuff isn't your data. Get your mitts off it.

seieste2• 7 years ago

If the data differs between users, then it can be PII — this is confirmed by the fact that browser fingerprinting works.

MaximumMadness• 7 years ago

Firefox is really doubling down on their positioning vs Google, I feel like every day I see a new privacy-focused promise or tool on the front page from Mozilla

sjwright3• 7 years ago

It was a perfect time to strike while Google is being seen to make anti-user decisions with Chrome and ad-blocking add-ons. I don’t know if it was a coincidence but the timing was excellent.

cdransf2• 7 years ago

I wish they didn't use G Suite:

``` <<>> DiG 9.9.7-P3 <<>> mozilla.org mx ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42182 ;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;mozilla.org. IN MX

;; ANSWER SECTION: mozilla.org. 60 IN MX 5 alt1.aspmx.l.google.com. mozilla.org. 60 IN MX 5 alt2.aspmx.l.google.com. mozilla.org. 60 IN MX 10 aspmx3.googlemail.com. mozilla.org. 60 IN MX 1 aspmx.l.google.com.

;; Query time: 39 msec ;; SERVER: 172.26.38.1#53(172.26.38.1) ;; WHEN: Fri Jun 07 10:30:00 PDT 2019 ;; MSG SIZE rcvd: 150 ```

bastawhiz• 7 years ago

Of all the things I wish Mozilla did differently, their choice of internal corporate email provider is roughly at the bottom of the list. Using a FOSS solution provides essentially zero benefit to even a fraction of a percent of their users.

cdransf2• 7 years ago

Sure, but it undermines their public opposition to Google and their practices. DuckDuckGo appears to operate just fine on Fastmail.

jodrellblank• 7 years ago

We ask ourselves: do we actually need this? What do we need it for? And when can we delete it?

That is the minimum of every company's obligations under the European GDPR (Genderal Data Protection Regulation) and even then as far as "our promise to you" goes the answer can simply be "yes, to guide us making better services, for as long as you use anything from Mozilla".

Tech companies are using the word “privacy” a lot these days [..] They all want you to think they can be trusted.

mmhmm.

wetpaws• 7 years ago

We learned hard way with google that company promises arnt really worth that much

atklp• 7 years ago

Looks like they conveniently forgot of when they sent the entire browsing history of some users to a third party advertisement agency. Thanks for protecting my privacy, Mozilla! Looking forward to your next surprise.

https://blog.mozilla.org/press-uk/2017/10/06/testing-cliqz-i...

schmichael• 7 years ago

What the US needs is a regulatory framework like GDPR that incentivizes this sort of behavior. Private data should be considered a liability, not an asset. Taking less and keeping it private+secure should be the default -- not the exception that needs calling out.

Kudos as usual to Mozilla for going out of their way to promote these principles.

blokeley• 7 years ago

The article could have simply said, "Mozilla intends to comply with the European General Data Protection Regulation".

Firefox Personal Data Promise

Related Stories