9 ms·
Firefox 128 enables "privacy-preserving" ad measurements by default
- 0x0 2y agoSearch in settings in firefox seems to have a bug. Searching for "adver" gives no hits related to this, despite this setting being under a header labeled "Website Advertising Preferences"
- entuno 2y agoYeah, I spotted that the other day and commented on the previous story about this. It definitely works for other titles, but not for this new opt-out privacy related setting. How very convenient...
- bozey07 2y agoI suppose I should finally switch to Librewolf. I really don't like Firefox forks, for the slow updates and because I do genuinely use some bleeding edge features, but I'm tired of Mozilla.
- jumpCastle 2y agoAre the updates really slow?
- bozey07 2y agoOh, I don't know, I don't mean to slander Librewolf. I'm just saying that intermediaries are sure to cause some kind of inefficiency.
- monacobolid 2y agoNo, the updates are not slow. I've been running Librewolf for years now, no major complaints. FYI I'm on a rolling release (linux) distribution, but I doubt that changes much. If you are comparing it to stock Firefox, there is no competition (Librewolf is imho just more enjoyable experience); if you are comparing it to Chromium (and other Chromium-based browsers), in my experience the biggest 'problem' is the lack of support for pwa's. Anyways, give it a try.
- EasyMark 2y agoI believe librewolf updates very quickly, to be fair, it's really stock firefox with just some privacy/performance tweaks that are probably automatically enabled and then run through CI and then released.
- voytec 2y agoGoogle: ... Mozilla: How high?
- moffkalast 2y agoMozilla: What is my purpose? Google: You keep the antitrust division's fingers away from Chrome. Mozilla: Ohmygod.
- mrweasel 2y agoMozilla also needs this for their own ad business: https://blog.mozilla.org/en/mozilla/mozilla-anonym-raising-the-bar-for-privacy-preserving-digital-advertising/ https://blog.mozilla.org/en/mozilla/mozilla-anonym-raising-t...
- voytec 2y ago> Mozilla also needs this for their own ad business Mozilla wants it. I suspect that it's Google that _needs_ Mozilla to also run ads.
- stefan_ 2y agoOh goodie the latest Mozilla C-level "playing VC" expedition! Anything to not focus on the actual core business.
- mrweasel 2y agoMakes you wonder how much it would cost to "just" do Firefox. I'm sure it's not free and there is some overhead in terms of management, politics, work on standards, fundraising, legal, and perhaps a little marketing. Still, what we need to raise collectively to have a modern browser, built on "not chrome" and with none of the services or other programs Mozilla is running?
- hulitu 2y agoThis has nothing to do with Google. Mozilla is now an advertising company.
- ollybee 2y agoThere's some good context in the Mozilla kb article on this feature: https://support.mozilla.org/en-US/kb/privacy-preserving-attribution https://support.mozilla.org/en-US/kb/privacy-preserving-attr...
- lopis 2y agoI actually think this is a great initiative. Let's be honest, ads and ad tracking is not going anywhere, and Mozilla is trying to come up with a version of that which isn't terrible. And this sounds reasonable.
- Xelbair 2y ago> Let's be honest, ads and ad tracking is not going anywhere Citation needed.
- hagbard_c 2y ago> Let's be honest, ads and ad tracking is not going anywhere True, they're not going anywhere on my systems since they get stopped at the gates; not one but many gates, defence in depth is the norm when dealing with vermin. We will fight them at the router, we will fight them in the name services, we will fight them at the firewall and in the applications. Wherever they come, we shall be. We will never surrender. The ad industry can blame itself for this, they have shown themselves to be reliably unreliable and are no longer welcome.
- michaelt 2y ago> Let's be honest, ads and ad tracking is not going anywhere Sure they are - just install ublock origin. Even if you're OK with the snooping and the attention hijacking and the slow pageloads and the pictures of rotting teeth, plenty of malware has been delivered by inept ad networks. Frankly, I find it strange when someone doesn't block ads.
- shadowgovt 2y agoublock is a tiny fraction of users. If it became ubiquitous, online advertising would respond with something more embedded in the content and harder to block out.
- martin_a 2y agoduplicate of: https://news.ycombinator.com/item?id=40965161 https://news.ycombinator.com/item?id=40965161
- asicsp 2y agoThere was an even earlier discussion with more comments: https://news.ycombinator.com/item?id=40952330 https://news.ycombinator.com/item?id=40952330 (192 points | 2 days ago | 180 comments)
- ScaredToUseName 2y agoThis is why whenever I install firefox, I first turn off wifi. Then I go through the settings and disable the ‘studies’ and other telemetry, etc, before switching the wifi back on. That will prevent the having to wait 30 days for the data to be deleted from Mozilla servers with it’s ‘on by default’.
- voytec 2y agoI use ESR with pre-baked policy[0] stored in /usr/lib/firefox/distribution/policies.json before the installation/1st run. Configures cookies, studies, disables logins, credit cards saving, asking for location, promptimg for notifications, studies, pocket, telemetry etc. During 1st run, it installs all pre-defined extensions. For some reason, changing search engine via policy no longer works, but that can be bypassed by auto-installed extension that changes search engine. [0] https://mozilla.github.io/policy-templates/ https://mozilla.github.io/policy-templates/
- capybara_2020 2y agoDid you check and see if this feature i.e. the "Website Advertising Preferences" is turned for you right now? I have all telemetry turned off but when I went and checked this "feature" was enabled by default with no notification it had been added.
- solardev 2y agoSo they're doing their own FLoC?
- wkat4242 2y agoPretty much yes though this one is far more privacy-minded, where FLoC was just a thinly-veiled attempt at business as usual. I turned it off immediately nonetheless. One thing to note though is that the switch doesn't exist in mobile Firefox. And it's not clear to me whether that means the feature doesn't exist at all or that I just can't turn it off?
- hagbard_c 2y agoUse Firefox Nightly on Android and you get access to about:config and with that this switch.
- benou 2y agoand for those wondering, looks like it is called "dom.private-attribution.submission.enabled"
- capitainenemo 2y agoHah. Thanks. I was stopping by this thread again to post exactly that. I have to say that config option was not obvious. After scrolling through about:config and filtering only the modified list I still couldn't find it. I finally backed up prefs.js, toggled it, then pulled a diff. And, I needed the config entry because I couldn't find any gui option to opt out of it on mobile.
- tutipop 2y agoYou can access about:config with chrome://geckoview/content/config.xhtml even in non-nightly versions. Credit goes to this guy - https://news.ycombinator.com/item?id=40955452 https://news.ycombinator.com/item?id=40955452
- mrweasel 2y agoI was looking at this when I upgraded and that setting does not need to be there. If it was off by default, no one would feel the need to locate that check box and enable it. So just turn it off, remove it from settings and yank the code. The language is even rather vague and Mozilla seems to good a long way to avoid explaining that this is the alternative Google has designed for Chrome to replace tracking via third party cookies (Protected Audience API I believe). Now it is better than third party cookie, but having neither is best. This does not need to be in Firefox.
- erk__ 2y agoThis is not the same as Protected Audience API which Mozilla have been very critical about [0], this is something they have worked on with Meta over the past couple of years. If you press the read more button there you go to this page [1] that explains it more. 0: https://blog.mozilla.org/en/privacy-security/googles-protected-audience-protects-advertisers/ https://blog.mozilla.org/en/privacy-security/googles-protect... 1: https://support.mozilla.org/da/kb/privacy-preserving-attribution https://support.mozilla.org/da/kb/privacy-preserving-attribu...
- AlexandrB 2y ago> this is something they have worked on with Meta over the past couple of years The farmers working with the wolf on a feature to "help" the sheep.
- shadowgovt 2y agoIt's better for a browser feature the user has some control over to be the implementation point for this than incentivizing site owners to come up with novel tracking strategies.
- account42 2y agoExcept this is not how things work. All you are doing is giving the advertisers another tool to track you, it won't magically make them stop using all the other ones.
- jobigoud 2y agoTools > Settings > Privacy and Security > Website Advertising Preferences > Allow websites to perform privacy-preserving ad measurement
- prime17569 2y agoFYI Safari has been doing this (also enabled by default) for years on all Apple platforms. To disable it on macOS: Safari > Preferences/Settings > Advanced > Uncheck "Allow privacy-preserving measurement of ad effectiveness" To disable it on iOS: Settings > Safari > Advanced (scroll all the way down) > Turn off "Privacy Preserving Ad Measurement"
- hamilyon2 2y agoIn French it is deceptively named too. The explanation on official website is no better. I always knew that safari is no better than other browsers, but the overt deception is a new low.
- ErigmolCt 2y agoThank you for sharing this information
- ibejoeb 2y agoHang on. What does it mean to disable this? 1. Does it disable measurement? - or - 2. Does it disable the privacy-preserving feature, i.e., enable tracking? What I really want to know: is it better for me to check the box or not?
- Rinzler89 2y agoYes
- dist-epoch 2y agoIf you're not paying for it, you are the product.
- haunter 2y agoAnd if you are paying for it you are an idiot. See Youtube Premium for example. Or just generally giving money to Google in any shape or form.
- PhilipRoman 2y agoDanegeld won't save you in the long run, nothing is stopping the companies from spying on you anyway and profiting twice.
- doe_eyes 2y agoThe scare quotes here are uncalled for: it is privacy-preserving. The approach allows measurement without disclosing who, specifically, did what with the ad. The best objection to these proposals isn't privacy, it's that a browser vendor is lifting a finger for advertisers. I guess the fundamental question there is if we prefer to outright shut down online advertising, or give it the tools it needs to be less bad. Opinions differ, but all major browser vendors are in the latter category.
- ants_everywhere 2y agoIsn't it the same old tools used by other ad companies, like differential privacy?
- JW_00000 2y agoA major difference is that the data is stored in your browser, and aggregated anonymously by Mozilla (also using differential privacy). Using the techniques you refer to, the ad platforms both store the data and then aggregate it, possibly promising to add differential privacy. The advantages I see are: (1) you can verify which data is collected by the browser and when/how it is sent to Mozilla, because this code is open source and running on your machine; (2) you maybe trust Mozilla more than an ad company.
- pietervdvn 2y agoAccording to their blog post, Let's Encrypt will run the aggregator service - which is even better.
- account42 2y agoBetter for whom? Even more of normal internet operations flowing through ISRG is concerning itself. Let's Encrypt alone already gives them more power than any private organization should have.
- throwawa14223 2y ago
- stranded22 2y agoI was about to clear it - but, you know what, it IS needed. Website publishers need to know what works and what doesn’t - otherwise they cannot improve nor generate revenue. So, privacy preserving measuring? I’m in, well done Mozilla.
- zihotki 2y agoIt is needed for advertisement business, for Mozilla corp. (which is an ads business too https://blog.mozilla.org/en/mozilla/mozilla-anonym-raising-the-bar-for-privacy-preserving-digital-advertising/ https://blog.mozilla.org/en/mozilla/mozilla-anonym-raising-t... ), not for Firefox users. Mozilla has enough money to run Firefox for a decade without accepting any additional money if they stop spending money left and right on non-relevant things.
- stranded22 2y agoYeah, fair point. Sometimes, I’m a . Off it goes!
- deleted 2y ago[deleted]
- Freak_NL 2y agoLeaving the ethical discussion aside; from a practical standpoint this won't impact anyone worried about privacy using Firefox unless they insist on not using an ad-blocker (which would be add odds with caring about privacy¹). This feature would only be used if you click on (or perhaps just encounter?) an ad and eventually buy something on the target website. 1: Or just caring about your mind constantly battling distractions.
- TekMol 2y agoMore infos about it: https://blog.mozilla.org/en/mozilla/privacy-preserving-attribution-for-advertising/ https://github.com/mozilla/explainers/tree/main/ppa-experiment https://datatracker.ietf.org/doc/draft-ietf-ppm-dap/ The gist of it is that Mozilla and ISRG now proxy the tracking data and give aggregated reports to advertisers. And that they handle the data in a way so that neither Mozilla nor ISRG alone can access the unaggregated data: Our DAP deployment is jointly run by Mozilla and ISRG. Privacy is lost if the two organizations collude I wonder if this is really the only way privacy can get lost. What if an advertiser uses an ad ID only once for real (specifying a specific user) and then sends 999 fake impression signals for that ID to Mozilla? When they get the aggregated data for the 1000 impressions, they would be able to deduct who did the one real impression, no?
- zihotki 2y agoYou forgot to add one more link for context - Mozilla acquired ads company Anonym https://blog.mozilla.org/en/mozilla/mozilla-anonym-raising-the-bar-for-privacy-preserving-digital-advertising/ https://blog.mozilla.org/en/mozilla/mozilla-anonym-raising-t...
- slightwinder 2y ago> The gist of it is that Mozilla and ISRG now proxy the tracking data and give aggregated reports to advertisers. So Mozilla becomes the treasure-guard? What prevents them from abusing or leaking the data in the future?
- TekMol 2y agoThe way I read it is that: 1) The data is encrypted in a way that Mozilla can't encrypt it without the help of ISRG. 2) There is a way for ISRG to help Mozilla create aggregated data from the raw data without either of them being able to see the raw data in this process. Maybe I'm wrong. Would be interesting to hear how 2 can be accomplished. Would have to be some crypto magic I have not yet heard about.
- natrys 2y agoAnybody know if it's possible to turn this off at build time and how? This seems like a thing we ought to have a conversation about with the distro maintainers.
- krelian 2y agoThere is a lot fire directed at Mozilla on HN. I'm not saying I support or can make sense of all of their decisions but I'd love for someone in the criticizers camp to explain what steps they would take to make Mozilla and the continued development of Firefox a financially sustainable and independent endeavour.
- account42 2y ago> There is a lot fire directed at Mozilla on HN. Gee I wonder why... Could it be them disregarding users preferences over and over again or claiming to stand for privacy while siphoning your data at every opportunity. Sure will be hard finding an example of that behavior.
- AlexandrB 2y agoWhat's the point of an alternative to Chrome if it replicates the same bad behaviors and follows the same incentives?
- subjectsigma 2y agoI have some ideas of varying quality. Others have been mentioned in the thread. Really, though, it’s not like me or any of the commenters are being paid millions a year to fix these problems. If I were being paid $6,903,089 I feel like I might be well-equipped to fix them.
- ndriscoll 2y agoThey've been pulling in half a billion dollars per year for 15 years. They should have budgeted to invest part of that money to build a development trust fund.
- yjftsjthsd-h 2y ago> but I'd love for someone in the criticizers camp to explain what steps they would take to make Mozilla and the continued development of Firefox a financially sustainable and independent endeavour. Let me give them money. Either straight-up take donations to fund firefox development, or sell a "Firefox Pro" that doesn't have these stupid anti-features. But don't refuse to take money from users and complain that because you don't take money from users you're "forced" to screw them over.
- criddell 2y agoI have a website. If I wanted to take advantage of this being on in my visitors browser (I really don't), what would I do? How do I use this? What exactly is it?
- PedroBatista 2y agoI've been using Firefox for more than 20 years since the Phoenix days, even when it was cleary slower than Chrome (it still is but the diferences are minimal ) I'm not acting surprised, but I think it's more than time to start looking into a viable alternative. It's "Chromium" (?) still a thing? Do you guys know if there is a browser based on Firefox that doesn't have any of the BS Mozilla is putting into their browser? I'm really praying for Ladybird but of course it's still not ready for prime time.
- grantith 2y agoOne Firefox based alternative https://floorp.app/en https://floorp.app/en
- EasyMark 2y agowhat does floorp bring to the table other than a more configurable UI, split tabs, etc. Does it have privacy enhancements over regular firefox like librewolf, et.al. ?
- cobertos 2y agoChromium is still a thing, I use it at work, considering all the corporate-ware that gets installed into Chrome by default now. Waterfox and Librewolf seem to exist, and I imagine there's more Firefox forks out there. No idea on the state of things though
- EasyMark 2y agodoesn't chromium still phone home to google though? Don't you have to use something like brave or ungoogled chromium to stop that from happening?
- cobertos 2y agoHmm, I'm not sure in what capacity Chromium phones home. I definitely have no ability to setup Google account sync nor did it play nicely out of the box with the Chrome web store, so I assumed not? But I haven't done my own tests
- Phemist 2y agoIs Firefox's implementations of the Topics API as introduced in Chrome a couple of months back? Or is this something different?
- fifteen1506 2y agoDifferent
- _flux 2y agoCould PPA be used for the needs of developers doing analytics for determining which features are actually being used? For web-apps or for local apps? It seems it could be a more private way to implement such functionality, if applicable.
- ErigmolCt 2y agoWant to move away from browsers with potential corporate influences
- nicman23 2y agowell it is good that i just bought 256gbs of ram... (compiling ff needs like 80)
- pacifika 2y agoI’ve begrudgingly kept this enabled because if this works users are a lot better off, cannot be manipulated as they are currently, and it frees up the browser makers to break all the ways people are being tracked, pointing advertiser networks to this alternative.
- deleted 2y ago[deleted]
- ChrisArchitect 2y ago[dupe] More discussion: https://news.ycombinator.com/item?id=40952330 https://news.ycombinator.com/item?id=40952330
- luke-stanley 2y agoAs a loyal user, I didn't quite see this coming. Under `Browser Privacy`, I have `Enhanced Tracking Protection` set to `Strict`. I had studies turned off, when I go to `about:studies` it explicitly says: "No new studies will run.". I have `Tell web sites not to sell or share my data` checked. I have `Send web sites a “Do Not Track” request` checked. It seems like Mozilla still thought it was okay to automatically add a "Allow web sites to perform privacy-preserving ad measurement" checkbox. Yet with that all set, they seem okay to let it be checked by default, so they can send off my data! They say: "A small number of sites are going to test this and provide feedback to inform our standardization plans, and help us understand if this is likely to gain traction." - that sounds a lot like a study, and I've opted out of studies! I did not consent, and as best I can tell, Mozilla has breached GDPR. As best I can tell, Mozilla disregarded my preferences. It seems they have violated these GDPR principles: a lack of consent, purpose limitation (unintended data use), `Data protection by design and default` AKA `privacy by design` (by ignoring settings), and right to object (disregarding preferences). It is absolutely unfair to argue that it is not personal information about me. It seems to me that they are lying, or at the very least twisting words so thin. My trust in them is vanishing. There is no way to reliably verify their differential privacy, and even if there was, they still had no informed consent to collect the data and send it off. To give controls to a user, and then totally ignore them, is what got Facebook in big trouble. It really looks like Mozilla is not only not listening to explicitly stated user preferences, preferences that have been set intentionally, but it's outright ignoring them and doing the very opposite of what the users intention is! If they thought that they had a good reason to do so, and that the ends justifies the means, they are so very wrong. I have used Firefox for as long as it's existed. For Mozilla, this is an almost sadistic own goal. How did they think that this was going to be okay? Did they think people would not find out? There will have to be changes after this at Mozilla if they were to regain trust and I'm really sceptical they can do it. I really want / wanted them to succeed but I don't see how.
- shrimp_emoji 2y agoThe new leadership has made it an ad company.
- 2y ago
- illiac786 2y ago[flagged]
- karmakaze 2y agoIt would have been less alarming if the Firefox 128 release had shared more of that info. All I see is this: > Firefox now supports the experimental Privacy Preserving Attribution API, which provides an alternative to user tracking for ad attribution. This experiment is only enabled via origin trial and can be disabled in the new Website Advertising Preferences section in the Privacy and Security settings. Which (1) isn't clear if my installation is opted-in or out (what exactly does 'supports' mean? am I in the 'origin trial'?), (2) how to check or disable it--what/where are the configuration settings? Opaqueness doesn't go well with privacy-preserving. It gives a sense of bias which erodes trust.
- illiac786 2y ago100% agree. Very poor communication. Very frustrating, considering how little effort it would have been, compared to the amount of work that went into this feature…
- karmakaze 2y agoThe way this story is unfolding feels like a tipping point in the management of Mozilla/Firefox. Imagine if it was Apple doing this to Safari, it would certainly rile up more users even though it would be the same thing.
- metadat 2y agoRelated discussion from 2 days ago: "Firefox added [ad tracking] and has already turned it on without asking you" https://news.ycombinator.com/item?id=40954535 https://news.ycombinator.com/item?id=40954535 (170 comments) -- Also, there are two options to disable the ad tracking behavior: 1. Use LibreWolf instead — Advantage: This is also a long-term solution :) 2. Follow @thangalin's instructions to disable it in Firefox: > Step 1. Visit about:config > Step 2. Set dom.private-attribution.submission.enabled to false Credit: https://news.ycombinator.com/item?id=40955221 https://news.ycombinator.com/item?id=40955221
- puppycodes 2y agoThe truely scary part of this isn't even the default "feature", It's the utter failure of Mozilla to read the room. Knowing their users would feel betrayed and doing it anyway is what freaks me out. To me it spells trouble for them monitarily that they are willing to anger their core userbase for cash on hand.
- mardifoufs 2y agoThis might be a stupid question but who exactly gets access to that data? What's the process for getting said access? I guess it's paid but is it accessible to most ad networks or just the big players? (I can see upsides and downsides either way)
- gorbachev 2y agoSix and a half years ago: https://news.ycombinator.com/item?id=15931730 https://news.ycombinator.com/item?id=15931730 This is in their DNA.
- switch007 2y agoI'm curious (I know nothing about the tech): is this "privacy-preserving ad measurements" too complicated for the EU investigate and for law-makers to understand (is that the point)? Or designed to get the most data in the most GDPR-compliant way?