Dear Mozilla, stop watching me

http://emilis.github.io/privacy/2013/06/16/mozilla-stop-watching-me.html

by emilis_info • 13 years ago

163 54 13 years ago

emilis.github.io

swombat• 13 years ago

Mozilla is effectively the only player in the browser space that I still feel I can trust not to have commercial motives to hoover up data about me. That's why I've switched to Firefox since the NSA scandal started.

I think they could do worse, strategically, than take a strong, consistent stance throughout their product(s) and communications, to make Mozilla the browser and email client of choice for those who don't want to leave a huge slimy trail of cookies and web bugs for anyone who's interested to track.

Worth noting this is not saying that either Safari or Chrome are worse browsers in general, or that they have security holes to feed the NSA machine - but any piece of data that a US company has about you is a piece of data that could be passed to the NSA under a FISA order, or even a future law change a decade away from now.

The fewer of those pieces of data you create, the better, imho.

oscargrouch• 13 years ago

Very good analysis! also mozilla can be more safer?! yes indeed.. but he got a good point too.. there's a bad behaviour and culture of trying to watch of what you are doing on your behalf, without notice.

What we let them(anyone outside) note about us.. should be our decision.. .. you click a button, you sign a contract.. data should not "escape" from us.. this is a bad behaviour, and its contagious.. US companies are full of it.. its not just a government issue.. companies have been doing this for years.. with different purposes than government..

This is just the beginning of the unveilling of a bad behavioral pattern that must stop, period.

Nobody is giving a #$% about our privacy and our rights, because they are being served of you and me in a silver plate and this make them more powerful and rich.. even if they are "the good guys".. everybody must stop..

Its good people are wakening up!

jmilkbal3• 13 years ago

Mozilla are the only ones without a hidden modus operandi. They make a web browser and have become the organization to trust because their mission is make the web a better place. Google want to sell ads and do everything in their power to bombard its users about whom they so desperately needs to know everything. Apple and Microsoft are busy creating lock-in. I don't actually understand how any one knowing about these and knowing what a force for good Mozilla strives to be could possibly use anything but Mozilla products. We are implicitly telling these companies that we accept their behavior. The same attitudes about deomcracy, "how can my single voice mean anything", applies just as much to corporations and using their products and sending money to them. It's a plague and we can work against. You just have to (at least in the context of this thread) spend a few seconds to go back to the browser with your interests at heart and quit destroying the web for the rest of us.

rasterizer2• 13 years ago

You are overreacting, not to mention reaching the wrong conclusions from these NSA reports. The problem isn't measurement, that is a cornerstone of engineering (and of everything else really), the problem is government overreach.

It's almost as insane as that piece in Slate claiming that Hadoop is evil because it enabled large scale data analysis (http://www.salon.com/2013/06/14/netflix_facebook_and_the_nsa...). Technology is not the issue.

This newly found aversion to tracking and measurement is a stupid knee-jerk reaction to the news.

derleth3• 13 years ago

The problem is opt-out instead of opt-in. If measurement and tracking are so benign, tell people you're doing it and allow them to agree or disagree, on an opt-in basis. Otherwise, it's not benign.

rasterizer2• 13 years ago

I disagree. Opt-out is the right approach, if you are using someone else's product you should assume you're interactions with it are being measured.

It's beyond quid pro quo, it's how software improves and evolves, and it is to the benefit of everyone: you, other users, vendor.

Amadou2• 13 years ago

There is still a problem with opt-in in that most people are not cognizant of the risks and so are unable to make an informed choice.

lawnchair_larry• 13 years ago

This newly found aversion to tracking and measurement is a stupid knee-jerk reaction to the news.

It's not new at all, and we don't appreciate it.

QUFB• 13 years ago

It looks like Mozilla outsourced their tracking to a third party, Blue State Digital[1].

  $ host sendto.mozilla.org
  sendto.mozilla.org is an alias for secure-mozilla-1.bsdtools.com.
  secure-mozilla-1.bsdtools.com has address 66.151.230.193

[1] http://www.bluestatedigital.com/

emilis_info6• 13 years ago

It seems so.

On the other hand I outsourced my blog tracking to Google Analytics. I am guilty of the same crime.

Do you do that too?

I have now removed Google Analytics code in my blog until I will find an alternative that keeps my visitors data more private: https://github.com/emilis/emilis.github.com/commit/ad40981a4...

toni• 13 years ago

Have you seen Piwik Analytics[1]? It's an open source web analytics app (much like Google's) that you can run on your own server.

[1] http://piwik.org/

nostromo• 13 years ago

I think we should learn to pick our battles.

Email itself is 100% insecure. You should assume that 100% of your email is available to the intelligence community. (There's a reason Petraeus never sent any email to his mistress. According to William Binney, the NSA keeps copies of all emails sent to or received in the US.) So, they already know this email was sent to you.

Stopwatching.us is going to present your signature to Congress anyway. If you're paranoid about the US government, it doesn't make sense to sign the petition.

The only additional data they can receive from this innocent tracking code is that you read the letter (if you decided to display images) and that you clicked on a link (if you in-fact did).

The intelligence community could conceivably do a lot of terrible things with everyone's phone records, everyone's Facebook data, everyone's Google searches... but if you want to remove measurement completely from the web, that's a bridge too far.

mike-cardwell2• 13 years ago

Where you see "innocent tracking code" some people see "exploiting a hole in the way a piece of technology works to obtain information about people that they don't expect you to be able to obtain, and never gave you permission to collect"

lelandbatey• 13 years ago

I don't know. It's a bit like saying Sherlock Holmes invades your privacy because he's naturally more observant.

gngeal• 13 years ago

You should assume that 100% of your email is available to the intelligence community.

Well, at least the message bodies can be encrypted, can't they?

reidrac• 13 years ago

Unless you're using tracking mechanisms such as the discussed in the post, the only information the sender has is that the destination SMTP server acknowledged the delivery.

After that, you know nothing. The mail could be deleted straight away and never delivered to a mailbox.

I think it's a valid point, specially when this is part of a campaign for privacy. Is it that important for Mozilla to collect that information?

EDIT: typo

derleth3• 13 years ago

We should fight the battles we have in front of us. Mozilla should know better, and needs to be taught if it does not.

joe_the_user• 13 years ago

Just to quibble, most news sources claim Petraeus did send email to his mistress. That seems to be how he got caught

http://www.nydailynews.com/news/national/petraeus-emails-ref...

mmanfrin• 13 years ago

I think most news sources simplified: what he did was write draft emails, then they would use the same account and read the drafts then delete them -- leaving no email.

x0x0• 13 years ago

As far as I understand, the argument is that, by not actually reading emails or listening to phone calls, but merely observing who communicated with whom, they're abiding by the law but getting quite a lot of information anyway. I don't know what you can do about phone calls, but for emails, email clients could simply send a stream of emails at random intervals to everyone in our address books. If you encrypt the email it's easy to set an ignore flag. Thus actual communications would be masked.

zobzu• 13 years ago

I don't think these sites are formally hosted or run by Mozilla. They probably just support the outcry "lets asks govts to stop watching us"

They certainly should think twice when they redirect a DNS overnight.

reedloden• 13 years ago

Only the HTML version of the newsletter uses tracking links. If you want "tracking-free" e-mails from Mozilla, sign-up for the plain text version. See https://bugzilla.mozilla.org/show_bug.cgi?id=772788 for details. :)

pvnick• 13 years ago

Hey Reed! Good to see you're still with Mozilla

emilis_info6• 13 years ago

Thanks for the link. I will switch to the plain text version :-)

emilis_info6• 13 years ago

Author here.

My purpose with this post is not to expose Mozilla, but to show how deep many of us are in this business. I admit I am guilty of similar practices myself.

I think we should use this privacy crisis to stop and rethink what are we gathering about our users, how are we doing it, can we really guarantee their privacy in our countries and on technological platforms we use.

If you really care about your users, think before gathering any of their data. It may end up somewhere you or they do not want.

ndesaulniers• 13 years ago

My purpose with this post is not to expose Mozilla, but to show how deep many of us are in this business.

Do you think you could have chosen a better title to reflect this?

emilis_info6• 13 years ago

I think so. At least I would like to have added "please" at the end.

I am sorry. My only excuse is that my two kids were running around disturbing my ability to focus.

BTW: I am a big fan and a user of what you do. I think Firefox OS is one of the technologies that will help us reclaim some of our freedoms and privacy back.

jasonlotito2• 13 years ago

You should point that out in your article. You should also point out the fact that you are using multiple 3rd party services that are far more questionable then what Mozilla uses on your page, allowing them to track your readers.

I admit I am guilty of similar practices myself.

That's all well and good, but the article doesn't reflect that in the least.

salman89• 13 years ago

Where do we draw the line as companies in terms of user data collection? Should we stop tracking our users entirely?

Government eavesdropping aside, I see the internet as just another form of communication. Anytime you talk to someone, you are entrusting them with whatever you are communicating to them. If you knew a friend doesn't keep secrets well, you probably wouldn't tell them any secrets. When Mozilla sends you that email with the tracking links, you are entrusting them with that data, and are hoping that the data leads to a better relationship between them and you or offers some mutual benefit.

What is different in internet communication is that it is hard for a user to determine what company is trustworthy and when that trust has been violated. Most users also simply don't care when that trust has been violated - no one should like that their user data at some level is sold to advertisers by Facebook, but that won't stop them from using it (I myself am guilty of this).

Should tech companies not collect user data in the fear that a 3rd party may one day steal that data? Or should they not collect user data for some other reason?

Volpe3• 13 years ago

Where do we draw the line as companies in terms of user data collection? Should we stop tracking our users entirely?

Well then "Login" would stop working. I think there is no universal line. Just inform users of what you are collecting.

namank• 13 years ago

You're wanting to do away with the whole concept of analytics.

Though I've often pondered over the implications, I'm not convinced that not gathering analytics is the solution here. This is not too far from the debate about AK-47 - would it be better if the gun had never been invented? How about nuclear power?

The point is that analytics are the way of the future, the differentiation lies in the purpose for which you leverage them.

derleth3• 13 years ago

You're wanting to do away with the whole concept of analytics.

How about making analytics opt-in?

Volpe3• 13 years ago

aggregate data of usage is not a breach of privacy, it's only when I have individual data about someone that privacy becomes an issue.

Perhaps analytics needs a standard for how they are stored (i.e only store aggregates, not individual records)

sinak• 13 years ago

tl;dr: We built this site on a really tight time constraint, and had to use Blue State Digital to process emails and store personal data, hence the tracking codes.

I helped build stopwatching.us as part of the coalition of organizations and individuals in support, and thought I'd give a quick bit of insight into why the tracking stuff is in there.

When we came up with the idea for the site last Friday, we quickly realized that one of the trickiest parts to manage would be the privacy policies of the different organizations involved. There's over 80 different partners, and about 6 different core organizations involved. Mozilla and EFF in particular have really stringent legal conditions and privacy policies for any sites they promote, and we needed to make sure we abided by them.

On Mozilla's end we needed to have some way of collecting and storing emails and personal information that would get through their legal department quickly. Since they've used Blue State Digital in the past and screened both their technology and privacy policy, that was deemed the fastest way to make things work.

BSD includes things like the email tracking code automatically, and as far as I know there's not an easy way to strip that stuff out. Hence the tracking stuff in the emails.

jmilkbal3• 13 years ago

Thank you. Mozilla is a force for good. Mozilla have done nothing to show they are not worthy of our trust and you demonstrate that we have no reason to question it still.

emilis_info6• 13 years ago

I am very glad that Mozilla takes privacy so seriously. I am glad it was a conscious decision. Also: I noticed the tracking codes in the email using Mozilla Thunderbird.

By the way: the email I got was probably sent to Mozilla supporters, not to StopWatching.us signatories (although it seems they use the same From address).

However, in the light of this privacy crisis, I think Mozilla should take time and think some more of what could be done.

It doesn't look good anymore that the fastest solution was to choose a technology provider that uses recipient tracking. It is bad that BSD privacy policies probably don't stand a chance against a government request with a gag order. I can only hope that the privacy policy treats US and non-US citizens alike. I can also hope that the screening checked that BSD systems don't store too much data about the recipients.

jmilkbal3• 13 years ago

Mozilla observing the effectiveness of their campaign is not the same as building a complete profile on you. This is quite different from using a phone with Android or iOS or using Chrome whose primary goals are such. Be safe out there, use Mozilla products and have a little faith. Mozilla is the only mainstream force for good in its area.

GigabyteCoin• 13 years ago

Is Mozilla really "watching" you? Or perfecting their UI design flow? Considering they are one of the groups who created StopWatching.us I would imagine it's the latter.

That tracking image is just trying to see how many people opened the email. And yes, they can tell you opened the email. So what?

The tracking of links is simply trying to gauge popularity for each link in the context of what the email was about.

The reason they're watching you click things in the email you willingly signed up to receive, is because they want to keep you as a subscriber and not anger you by sending pointless emails that you never interact with.

Written from my Firefox browser.

jasonlotito2• 13 years ago

I wonder if I was the only amused by the OP's use of Quantcast for tracking on that page, as well as allowing other 3rd parties like WordPress, Twitter, and IntenseDebate to track users as well.

The point is well and good, but those in glass houses should be careful when throwing stones.

Amadou2• 13 years ago

Part of the problem is that it so many of the tools available have tracking embedded in them. The mozilla guy who posted about how this came to be hit on it - they used a service for email that tracked by default and made it difficult, if not impossible, to disable the tracking.

This situation is the inevitable result of an industry that is built on advertising dollars. All of the tools are designed with that in mind and they crowd out tools that don't support that business model.

emilis_info6• 13 years ago

(OP here). I am amused myself.

I have cut out Google Analytics include from my blog code after I wrote the post. Now I see that I will have to switch off IntenseDebate comments as well.

Thanks for pointing out!

SunboX• 13 years ago

"Yes, saw. Is covered by opt in privacy policy and only used in aggregate, but looking into how we use and whether it's DNTable."

Source: https://twitter.com/msurman/status/346564623539003393

Dear Mozilla, stop watching me

Related Stories