Mozilla: *Privacy Not Included

https://foundation.mozilla.org/en/privacynotincluded/

113 65 5 years ago

foundation.mozilla.org

I really don't like this website. The criteria appears to be "things Mozilla thinks technology companies should be doing", and not necessarily related to privacy.

For example—sites get downgraded if they don't require strong passwords. Now, maybe websites should require strong passwords, that's a completely reasonable position to take. But if you, the user, are using a strong password, whether or not others are required to use strong passwords has no impact on your privacy. Especially because privacy ≠ security.

Engineering-MD• 5 years ago

All good points, thanks for your input. I liked it as I haven’t seen a similar ones from a reptile company but agree it could be better.

grey_earthling• 5 years ago

I haven’t seen a similar ones from a reptile company

I know this is a typo, but it's also an excellent pun.

Stampo00• 5 years ago

I agree. This site seems unnecessarily inflammatory and confrontational. Purely elitist PR publicity nonsense instead of educational. It's a bad look on Mozilla and it turns me off.

Talk up your own features instead of smearing other people's products. Products that aren't even your competition, I might add!

It's flame bait for its own sake, trying to take advantage of outrage culture in an attention economy.

Be better, Mozilla.

CodesInChaos• 5 years ago

if you, the user, are using a strong password, whether or not others are required to use strong passwords has no impact on your privacy

That only applies if the site only gives you access to your own data. If your friends grant you access to some of their data, your poor security compromises their privacy.

dane-pgp• 5 years ago

whether or not others are required to use strong passwords has no impact on your privacy.

It's worth considering, though, that attackers may target sites that don't mandate strong passwords, because the password hashes in the site's database are likely to be easier to crack (and users with simple passwords are likely to reuse those passwords).

Once an attacker has chosen to target that site, that increases the chances that they find themselves able to read your data regardless of the password you used, because they'll have access to the whole database.

In fact, a site which hasn't put the engineering effort into enforcing strong passwords (not even a simple regex, let alone more complex approaches like checking for compromised passwords against the haveibeenpwned database) is also likely to have undervalued security in other areas, again making them a target.

Wowfunhappy2• 5 years ago

It also works the other way though. If attackers target the site, they'll know some users have weak passwords, so if you have a strong password, they'll move on quickly to easier targets.

I'd say on the whole it evens out.

Grieving• 5 years ago

sites get downgraded if they don't require strong passwords

Assuming "strong", as usual, means uses upper+lower letters, numbers, symbols, etc., this directly contradicts NIST's current password recommendations. They recommend enforcing a minimum length instead, and recommend a "minimum minimum" of 8. They also recommend checking passwords against a set of the most common ones from leaks. The NCSC's top 100k list is good (pre-filtering those under your minimum helps too--only 47k remain after removing pws under 8 chars): https://github.com/danielmiessler/SecLists/blob/master/Passw...

France_is_bacon2• 5 years ago

From my understanding, the only real way to create a password is to make it really, really long. Like, "Sometimes 10 people will get together on Friday night. Wow!" Or whatever you want. Makes it easy to remember. Personally I just usually string a bunch of random numbers and upper/lower/special characters - 40 of them. Just like this: https://www.youtube.com/watch?v=rERApU26PcA

tuukkah3• 5 years ago

The site has a section that explains the criteria including that Mozilla didn't decide on them alone but with other non-profits.

Regarding passwords: "If the product uses passwords for remote authentication, it must require that strong passwords are used, including having password strength requirements. Any non-unique default passwords must also be reset as part of the device’s initial setup. This helps protect the device from vulnerability to guessable password attacks, which could result in a compromised device."

https://foundation.mozilla.org/en/privacynotincluded/about/m...

ezoe• 5 years ago

The most absurd claims are for the Nintendo Switch. They blame it for having a third-party software which collect real vehicle driving data and send its data to the third-party's server.

https://foundation.mozilla.org/en/privacynotincluded/nintend...

By the same logic, Firefox has a third-party software(Hacker News) which collect and send data to the third-party's server. Gosh I shall be scared.

Or they are so lacking the technical analysis. Lego apps for example:

https://foundation.mozilla.org/en/privacynotincluded/lego-hi...

They conclude it's safe because they can use it offline... after they download and install the special smartphone apps to their smartphone. Seriously I see no smartphone that honor my privacy. By using the smartphone, it's already fail. Also, It seems they don't say that based on reverse engineering effort to make sure the app do nothing wrong. If I was a malicious app developer, I just store the data to the local storage and upload it the next convenient time the network access is available.

that_guy_iain• 5 years ago

One was on there because last year they didn't meet their "security standards" whatever those are but this year they do. So they improve in your eyes but you're still going to bash on them. Another one was that in the past there was a security hole. Those were the first two items I clicked.

Honestly, I think this is the worst Mozilla thing I've seen. It's all preachy on things from the past.

teddyh• 5 years ago

For an even more strict selection, I suggest H-Node: https://h-node.org/hardware/catalogue/en

banana_giraffe2• 5 years ago

The first thing I looked at, the Google Nest Protect says:

    Microphone: Device: Yes
    Tracks Location: Device: Yes
    Biometric: Voice recordings

Huh? There's no GPS, no mic (at least, there are no voice based features, and teardowns I've seen haven't spotted a mic).

There might be reasons to not want one, for sure, but inventing reasons isn't a good sign.

Edit: I was wrong, ignore me.

chewmieser• 5 years ago

It does definitely have a mic but it's supposedly only used for sound checks (and audio never leaves the device):

https://support.google.com/googlenest/answer/9250972?hl=en

banana_giraffe2• 5 years ago

Fair enough, that's still a long ways from recording my voice all the time.

Now I need to revisit the teardowns I've seen to see how they missed this.

auslegung• 5 years ago

It might track location via Wi-Fi.

jamesgeck0• 5 years ago

The Nest device doesn't use GPS, but it does use a variety of sensors (sound, IR, etc) to try to determine if you're home or not, thus technically establishing your location.

vetinari• 5 years ago

Technically, you don't need GPS for location tracking. All you need is to scan for BSSIDs around you and then check in a database, where in the world they are. Conveniently, Google has one such database ;).

(That's also the reason why Android gates wifi network scanning behind location permission).

pseudo03• 5 years ago

So glad Mozilla laid off all their Servo devs to focus on what's really important: IoT sex doll privacy evaluations.

lapetitejort• 5 years ago

Snark aside, were I in the market for such a device, I would absolutely want to know how privacy focused it was. I appreciate that Mozilla includes the category in the list. They exist, people will buy them. There's no sense in acting like CES and plugging their ears whenever they're brought up.

chomp2• 5 years ago

This is Mozilla Foundation, not Mozilla Corp.

nerdponx• 5 years ago

Even better: this is where your donation money goes.

pseudo03• 5 years ago

The corporation is a wholly owned subsidiary of the foundation. It's effectively one organization structured to minimize taxes. What exactly is your point anyways?

tylersmith• 5 years ago

Not even a real or useful measure of privacy implications. Just the completely subjective feeling of being "creepy" expressed as a percentage as if it were a precise and objective measurement.

perryizgr8• 5 years ago

Google seems to do a better job than some of the other Big Tech companies when it comes to privacy.

Huh??!

slivanes• 5 years ago

Google sells access to users, but doesn't share/sell user information.

jesboat• 5 years ago

Same with Facebook.

wmf• 5 years ago

Technically real-time bidding doesn't sell your information... it gives your information away for free.

rasz• 5 years ago

dont bite the hand that feeds you

chris_engel• 5 years ago

They say sonos does a good job on privacy. Did I miss something? Did they finally drop their approach of GPS-locating each speaker, phoning home what you listen to every couple of minutes and bricking the speakers to avoid re-sales?

antisthenes• 5 years ago

So this was the end-game for Mozilla?

An Aliexpress like shop that tries to capitalize on whatever brand value they think they have left? Does the internet really need another janky affiliate page full of IoT crap?

I've said it before and I'll say it again: guys, focus on making a good browser.

paulcarroty• 5 years ago

Cool to know Bose got lawsuit for stealing users data: https://www.businessinsider.com/bose-lawsuit-alleged-spy-hea...

fragileone• 5 years ago

I wish there was a RSS feed of some kind available. Whether it be for a changelog, a Twitter feed or blog posts.

tuukkah3• 5 years ago

I really don't like the comments here. Why do people assume that the Mozilla foundation is a clueless scammer? Before questioning their methods and motives, how about reading what the site says:

"Welcome to Mozilla’s Privacy Not Included buyer’s guide. Our goal is to help you shop smart—and safe—for products that connect to the internet.

In 2017, when we first started Privacy Not Included, we didn’t know if people would be interested in a guide about the privacy and security of connected toys, gadgets, and smart home products. Turns out, they were. [--]" https://foundation.mozilla.org/en/privacynotincluded/about/w...

slapfrog3• 5 years ago

Why do people assume that the Mozilla foundation is a clueless scammer?

It's not an assumption, it's an evaluation they are continuing to earn by quacking like a duck.

tuukkah3• 5 years ago

Can you point to something concrete that makes Privacy Not Included clueless or scammy? EDIT: Or if it's that the foundation did some clueless and scammy things earlier that cost them all their reputation, what were they?

ursugardaddy• 5 years ago

Mozilla needs to drop the whole 'we need the web equivalent of a slave uprising'/'more than deplatforming' thing

alphabet9000• 5 years ago

site needs a copy editor, or something.. "Scroll to see how creepy people find these products!" reads like they are talking about "creepy people"

DonHopkins• 5 years ago

That man's nuts! Grab 'em!

agilob• 5 years ago

This page promotes companies that make it impossible or very hard to delete accounts or data

https://backgroundchecks.org/justdeleteme/

schroeding2• 5 years ago

The votes seem... pretty useless for most products? :-D

For example, by the votes the Sony WF-1000XM3s[1] are 31% "half-creepy", 12% find them even "super creepy".

Why? Hot take, but IMO these headphones are as "not creepy" as it gets. You don't have to use the app, they work fine as is. The app doesn't need any permissions. Still, the majority find them at least "half-creepy".

Or this Canon Printer [2] here. It's... a printer? Which allows to print stuff from the cloud via your own device. (Discontinued) Google Cloud Print could be creepy for some, but the printer works fine without it, locally. The majority thinks "Yep, that's pretty creepy"? Or are they just voting with the default setting "half-creepy", without moving the slider? :-P

10%~30% "not creepy", 30% "half-creepy", 10% "very creepy" seems to be the default distribution of votes for all more or less harmless products. Maybe the default value of a vote should be "not creepy", not "half-creepy" :-D

[1] https://foundation.mozilla.org/en/privacynotincluded/sony-wf... [2] https://foundation.mozilla.org/en/privacynotincluded/canon-p...

slapfrog3• 5 years ago

Just my two cents, a product having an optional app at all makes me disinclined to buy it. It's not a strict disqualification, but it's definitely a negative to me. I really dislike when companies even suggest I install their apps, and prefer to do business with companies that don't do that. The best sort of company is one that doesn't even know what an app is.

DavideNL• 5 years ago

Why? Hot take, but IMO these headphones are as "not creepy" as it gets.

It says so in the “Can it snoop on me?” section… for example the app tracks your location…

agentdrtran• 5 years ago

Which it has to do if you use the auto-switch modes or location modes function.

marcinzm• 5 years ago

If you allow it to so that it can do location based profiles. You can not allow that feature and during the onboarding screens it asks if you want that feature.

schroeding2• 5 years ago

Right, that explains why some users would vote for "creepy". But the information in this section is not really true. The user is not forced (or nudged / dark-patterned / etc) in any way to give those permissions.

Location: Yes, it can ask for the Location permission, but it does that only if the user explicitly wants it to do so, doesn't it? You have to activate "Adaptive Sound Control", and also explicitly activate location based ANC control. And then you still have to give it the permission in the operating system dialog.

Camera: You can make pictures of your ears to use some kind of strange "sound optimization", which only works with a few apps. Only then does it ask for the Camera permission, and it never uses / asks for it again afterwards.

So the information Mozilla provides is not really accurate, and that could skew the votes. I don't know if that's any better. :-D

GekkePrutser2• 5 years ago

Most modern printers are creepy AF. They constantly phone home their ink status etc. A lot of them apart set up helpful WiFi access points where anyone can connect and see what you've left on the scanner plate. HP I'm looking at you.

kbenson• 5 years ago

To to mention the watermarking and money detection stuff printers do in their drivers which users have no control over.

gundmc• 5 years ago

A ton of the products have a plurality of "Half Creepy" votes. I suspect it's because people wanted to see the results and you have to vote to see them. Half-creepy is populated by default.

Fun idea, but I don't think there is much valuable information to glean from the ratings.

trvz• 5 years ago

This is utterly phony, coming from the company that updated their browser some time back to send its users' DNS data to fucking Cloudflare unless they opted out.

ub99• 5 years ago

A bit off-topic: is there a law requiring that sex toys must be blurred out? Even the ones that just look like a bent piece of silicon (not dildo-like)…

klyrs• 5 years ago

Okay, now do Firefox's telemetry...

hutzlibu• 5 years ago

How about extending that list to software and add something like "Firefox mobile" to that list, that comes advertised as privacy focused, fighting all those evil ad tracking technologies - but comes bundled with their own ad-tracking enabled by default!? And telemetry. And "participating in studies".

So yes, if you are a little bit tech-savy, it is easy and the first thing to disable. But it is still a very "creepy" to me, that those things are enabled by default, which means it stays enabled for the majority of users.

havelhovel• 5 years ago

I use a VPN and Firefox with NoScript installed. You might think I would be on board with Mozilla's privacy zealotry, but this page rubs me the wrong way. Dunking on IoT and wearables as "Super Creepy!" just seems out of touch with consumer preferences. My Amazon Halo is the first piece of technology I've been excited to use in a long time. I guess Mozilla thinks I'm creepy by association.

Mozilla: *Privacy Not Included

Related Stories