6 ms·

To me the key question is whether these checks are anonymous. If not -- if Firefox or a plug-in is sending a unique ID, than any advertiser or government agency

by wiggumz 11y ago

To me the key question is whether these checks are anonymous. If not -- if Firefox or a plug-in is sending a unique ID, than any advertiser or government agency could pay for that tracking information and then your privacy would be toast, at least until you can reset that ID.

kpcyrd 11y ago
Even if there's no unique ID, if you've installed a lot of plugins this combination can uniquely identify you. If you query addon updates daily, they could associate your IP of the day with your "I have installed these addons"-fingerprint. A debian style update mechanism could solve this, but this would be really bandwidth expensive.
- hackuser 11y ago
  > Even if there's no unique ID, if you've installed a lot of plugins this combination can uniquely identify you This is a good thing to remember, but I'm not sure it undermines the parent's point. No matter what security you use for anything, you always are exposed to another threat; that doesn't make all security useless. The value of security is to make attacks more difficult.
rockdoe 11y ago
I don't understand your post because it's full of blanket meaningless statements. A government agency doesn't need to pay anything, they could use legal means to extract the information. I don't think there's anything stopping plug-ins from sending unique IDs. SafeBrowsing uses a cookie that makes up a unqiue ID. (The latter discussion is well documented in Mozilla's Bugzilla) But what tracking information would make your privacy toast? Privacy has levels. SafeBrowsing leaks your WAN IP to Google. (You already leak this to every site you visit) Plug-ins likely leak details about the plugin configuration (as Ghostery does). What's the value there?
aw3c2 11y ago
I consider my IP address to be private information. If I chose to disclose it to a site, ok, but I don't mean to tell third-parties about it.
- ivanhoe 11y ago
  Well, technically you are not talking to 3rd parties, you are checking for updates on the author's site. For extensions that rely on up-to-date lists and definitions to work this is a crucial step, otherwise they'll be pointless. Antivirus software does the same thing. OS does the same thing. How it is now all of the sudden a problem?
- nijiko 11y ago
  Any time you use the web, be sure, thousands of people have your IP instantly.

by wiggumz 11y ago

kpcyrd 11y ago

Even if there's no unique ID, if you've installed a lot of plugins this combination can uniquely identify you. If you query addon updates daily, they could associate your IP of the day with your "I have installed these addons"-fingerprint. A debian style update mechanism could solve this, but this would be really bandwidth expensive.

hackuser 11y ago
> Even if there's no unique ID, if you've installed a lot of plugins this combination can uniquely identify you This is a good thing to remember, but I'm not sure it undermines the parent's point. No matter what security you use for anything, you always are exposed to another threat; that doesn't make all security useless. The value of security is to make attacks more difficult.

rockdoe 11y ago

I don't understand your post because it's full of blanket meaningless statements. A government agency doesn't need to pay anything, they could use legal means to extract the information. I don't think there's anything stopping plug-ins from sending unique IDs. SafeBrowsing uses a cookie that makes up a unqiue ID. (The latter discussion is well documented in Mozilla's Bugzilla) But what tracking information would make your privacy toast? Privacy has levels. SafeBrowsing leaks your WAN IP to Google. (You already leak this to every site you visit) Plug-ins likely leak details about the plugin configuration (as Ghostery does). What's the value there?

aw3c2 11y ago

I consider my IP address to be private information. If I chose to disclose it to a site, ok, but I don't mean to tell third-parties about it.

ivanhoe 11y ago
Well, technically you are not talking to 3rd parties, you are checking for updates on the author's site. For extensions that rely on up-to-date lists and definitions to work this is a crucial step, otherwise they'll be pointless. Antivirus software does the same thing. OS does the same thing. How it is now all of the sudden a problem?
nijiko 11y ago
Any time you use the web, be sure, thousands of people have your IP instantly.