I think the burden here is backwards? URLs may contain Protected Health and other Identifying Information. If this data leaks SSL and could be sent to a 3rd party, then it makes Firefox an unsuitable client for a great many applications.

EDIT: OK. It's boolean flags (like use of flash) plus an eTLD+1 (example.org; not myname.example.org?). Even so, I believe this tracking should be opt-in with a disclosure screen that explains exactly what Mozilla is recording. Informed consent is a practice we should be promoting, even if it seems unnecessary.

They don't plan on collecting URLs, just (eTLD+1). The only real issue I can see here are users who have registered their own domain under an eTLD, and have it set to their home page.

eTLD: https://en.wikipedia.org/wiki/Public_Suffix_List

> The only real issue I can see here are users who have registered their own domain under an eTLD

Doesn't the differential privacy system described above prevent even that from being an issue?

I'm not sure if they're planning on collecting every homepage domain here, or just asking something like "Is your homepage domain in the list of top 1000 domains?". In the former case, just having the domain listed could leak information. In the latter case, I can't see any issues.

It's more like: "Is your homepage google.com? Flip a coin, if it's heads tell me the truth, otherwise flip another coin and answer yes if it's heads or no if it's tails." (A bit simplified, but that's the general idea behind differential privacy.)

They're not planning to send full URLs, only domains. Also, the system described is resistant to attacks even if the data is captured (SSL leaks). I don't have enough statistical knowledge to understand how that works, though.

My concern is that it relies on differential privacy, or privacy through deniability. Which seems like a poor fit when it comes down to submitting URLs visited, unless they plan on submitting fake URLs when the "coin flip" comes up as tails twice in a row?

Not to mention, people will tend to visit the same websites repeatedly. The entire premise of DP is that the real data will stand out from the noise, creating a compelling picture of what an individual visits on the web. How will that aggregate data be anonymized, when it is reported with (a minimum of) an IP?

In short, this still requires a lot of trust in Mozilla, even with the DP algorithm, to not do the wrong thing with the dataset. And, in my eyes, making this opt-out and not opt-in already compromises that trust.

That’s still personalized data.

Mozilla has been violating even the minimal legal standards in the EU for years, and no one cares.

It’s insanity that an organization promoting its products with privacy doesn’t even meet the minimal legal standards. We’re seeing Google Analytics tracking in parts of the browser ("Get new Addons" page, for example), without even the legally required cookie warning.

EU law is clear on this, as soon as you store any data, do any tracking, connect to any third party, or transmit anything for analytics, you have get opt-in.

do_I_have_very_bad_medical_condition.com

Wouldn't that still leak health information? Less overall, but if any is bad, this still isn't acceptable.

Sure, except that with differential privacy, say 5% of telemetry reports would be marked as visiting do_I_have_very_bad_medical_condition.com anyway – regardless of whether they actually did.

What if a person visits 10 domains all indicating the same thing?

5%^10. Very very unlikely. Sounds very similar to "guilty beyond all reasonable doubt".

> URLs may contain Protected Health and other Identifying Information

A URL must not contain PHI. If it does, a breach has already occurred.

And Firefox is only collecting the domain names, it looks like.

What do you mean, a URL must not contain PHI? You can't prevent a non-tech minded person from submitting questions about their health to any text field linked to a form with a GET method.

I'd argue that domains are the same- there are tons of domains that clearly indicate what they're about (e.g. stop-drinking.example)

You can argue it all you want. Whoever is storing that is responsible under the Canadian laws criminally. It's probably the same if not worse in other countries (Germany, etc).

@clarkevans But submitting search input via the GET method (e.g. https://www.google.com/search?q=how+to+stop+drinking ) are a common practice in leading search engines.

> What do you mean, a URL must not contain PHI? You can't prevent a non-tech minded person from submitting questions about their health to any text field linked to a form with a GET method.

You can't, but that can't be part of Mozilla's threat model, and it's not relevant here anyway because Mozilla isn't collecting it.

And even if they were, that's not considered PHI legally. You are free to type any information about your own health that you want anywhere; that doesn't make it legally PHI, unless you are providing it to a Covered Entity.

> I'd argue that domains are the same- there are tons of domains that clearly indicate what they're about (e.g. stop-drinking.example)

This information is not legally considered PHI. As for privacy, SNI means that all domains you visit are already visible in transit, even if you are using SSL. Domain names are not considered private.

> This information is not legally considered PHI.

Do you have any sources that go into more detail?

When I've worked on PII in analytics, even TLDs were treated carefully. (obviously not the same from a legal perspective...)

> Do you have any sources that go into more detail? When I've worked on PII in analytics...

PHI is an incredibly well-defined term legally and is not equivalent to PII. Some things that constitute PHI actually wouldn't qualify as PII.

There are a lot of resources that explain HIPAA in great detail; if you want to know the specifics like here, you have to read the bill and the case law itself.

>>You can't, but that can't be part of Mozilla's threat model,

How normal everyday people actually use their product cant be a part of the threat model... Really?

That is scary...

I don't care what the legal definition of PHI is, I am concerned that Mozilla is collecting actual personal health information (if not through URLs, the domain name concern is still valid). And I know that DNS resolution is not necessarily secure from snooping, but having one extra orginazation explicitly collecting this data is more dangerous than not having one extra org collecting it.

As a practical matter, there are lots of applications that use GET for user submitted search data. Since GET requests encode user entered information into the URL and since the URL is typically found in web server logs and other tracking/history mechanisms, it is unwise to use GET for user-submitted data in applications that are concerned with privacy. However, it was not always considered unwise: REST advocates recommend GET when the underlying information representation doesn't change as a side effect of the request. Therefore, one might just as well say that logging of URL query parameters is the technical problem.

That said, when a "breach" has occurred is a legal distinction involving the control of information -- when protected data moves beyond those who have a duty to protect it. Saying that a particular technical approach creates breach is inaccurate.

I think logging is unrelevant here because it can be set up to log POST data too or not to log query string. But the problem with leaking data via referrer exists. Google encrypts (or obfuscates) search query in referrer for example.

A group of URLs tied with the IP accessing them may leak such data. Maybe not in exact violation of the law, but it would allow for a reasonable estimate of the chance of someone at that IP address having some given condition.

Any submission of data requires the transmission of an IP address, which is personal data and necessitates appropriate protection.

I very much hope that the Debian maintainers (and hopefully also the guys preparing Fennec in F-Droid) will disable such data collection mechanisms, either completely or hidden behind an explicit opt-in instead of the opt-out suggested in the e-mail.

> Any submission of data requires the transmission of an IP address, which is personal data and necessitates appropriate protection.

Do you have a citation for that broad assertion? My understanding is that this is highly variable across legal jurisdictions and even in Europe, which typically leads the way in privacy, it's not that simple. See e.g. https://www.whitecase.com/publications/alert/court-confirms-... discussing an EU Court of Justice ruling that had two requirements: the ISP can link that IP address to an individual AND the website operator can get that information from the ISP.

Within the new European GDPR framework, IP addresses are to be considered as personally identifiable information, so the concern is warranted. What's decisive when characterizing an information as identifiable or not is not the fact of being actually able to perform the de-anonymization of the information (e.g. via the ISP in case of an IP address), but the mere possibility of it.

Legally though Firefox would be allowed to collect this anonymous data from the user by having him/her send the data e.g. to an API endpoint they provide via IP-based communication, they would just not be allowed to associate the data with the IP address of the user submitting the data. In the end, it comes down to trusting the party that collects the data, at least if they don't perform anonymization of the IP address via other means, e.g. by passing the information through a third party proxy server.

BTW, GDPR does forbid to turn on such data collection by default (privacy by default), so they would be required to get the explicit opt-in from the user for that.

>Within the new European GDPR framework, IP addresses are to be considered as personally identifiable information,...

My understanding is that many of these details are yet to be settled with GDPR. The case referenced above was not interpreted under GDPR, which has yet to take effect. The definitions of personally identifiable data data rather vague, and precedent has not been set. A quick search showed conflicting opinions, but one perspective to consider is quoted below:

> In addition, businesses should note that Recital 26 to the recently adopted EU General Data Protection Regulation ("GDPR") states that the test for whether a person is "identifiable" (considered in detail above) depends upon "all the means reasonably likely to be used" to identify that person. The CJEU in Breyer did not directly consider the issue of likelihood of identification. If the BRD was not reasonably likely attempt to identify Mr Breyer from his IP address, this could potentially give rise to a different analysis under the GDPR. Consequently, it may be necessary for the CJEU to revisit this issue after enforcement of the GDPR begins on 25 May 2018.

This is a few years old, so if you know of some new decision or regulation that clarifies it would be great to know!

https://www.whitecase.com/publications/alert/court-confirms-...

The GDPR does not provide a list of data types that are considered personal or not personal, instead it uses a definition which states what criteria need to be met for data to be personal and gives a list of relevant categories, which explicitly includes "online identifiers":

https://gdpr-info.eu/art-4-gdpr/

Now, you could of course argue that often it's not possible to infer the identity of a person given an IP address (e.g. because it is a dynamically allocated IP address by an ISP or an IP address of a proxy server through which many users connect to the Internet) and therefore store it, it would be very hard to impossible though (IMHO) to ascertain that none of the IP addresses which you store could be used to identify a specific person (what e.g. if there are 5 % static IPs in your data?). This in turn would make treating all of your IPs as non-personal data a risky business to say the least, as there will almost certainly be a way to identify at least some of your users from their IP addresses. The fact that you don't know about a particular way of doing this identification is not relevant for this.

My advice: If you do not use a very robust method for making sure that all the IPs you store are non-identifiable I would recommend not storing them at all (or at least truncating them to 24 bits, which does also not always eliminate deanonymization risk though).

GDPR was approved on 25th of may 2016 with the IP address defined as the poster above you specified is my understanding

It might not be legally protected, but that doesn't change how sensitive it is.

What's up with calling obvious stuff by "broad assertion"?

Are you saying that people can not be identified by their IP address?

Because it's neither obvious nor globally true. Legal status varies around the world and from a technical perspective an IP address on its own doesn't usually identify a person unless you have other information — account data, correlated data from other sites, etc. — and things like NAT and public wifi make that necessary to reliably link activity.

I think it's important to talk about this issue – especially the importance of not storing it long-term — but from my perspective the real concern is the industry dedicated to linking and sharing your online activity. Without that an IP has little value and with it they can deanonymize most people without using IPs.

> Any submission of data requires the transmission of an IP address, which is personal data and necessitates appropriate protection.

And requires an opt-in under EU law, which makes this entire thing even more ridiculous.

Then don't send the correct source IP address, with simple statistics gathering like this I hardly expect they require a response. It would mean there would be no personal data whatsoever.

Most ISPs filter spoofed IP addresses nowadays[1]. Even if your ISP doesn't prevent it, NAT might. You wouldn't get a whole lot of responses this way, and there'd be a strong bias because of regional differences w.r.t. filtering.

[1]: https://spoofer.caida.org/summary.php

How would you do that, though? The browser has to open a socket to something to do this, after all. And that already is a violation.

You'd just send a UDP packet with a spoofed source address and forget about it. There's no need to open any sort of 2-way connection for data that's only being transmitted in one direction (from browser to metrics server).

You could transmit the telemetry through Tor.

Tor is blocked in some places and viewed as very suspicious in others. If you're already in a place where you're trying not to draw attention to yourself, using Tor might not a good option.

This isnt how tcp/ip works

With udp/ip it would work, if none of the routers on the way to the destination filters spoofed IPs.

Wouldn't spoofing IP addresses risk the data packets being filtered out by ISPs or other upstream network providers? IMO if keeping IP addresses hidden is a concern, it'd be better to use something like TOR.

Does an IP address actually require an opt-in? And if it does, does it only apply if it is being stored?

Yes[1], no[2]. An IP address is "personal relationships" data and collecting, processing or using such data is prohibited unless allowed by law or the concerned person gives consent.

[1]: https://en.wikipedia.org/wiki/Bundesdatenschutzgesetz#Types_...

[2]: https://en.wikipedia.org/wiki/Bundesdatenschutzgesetz#Overvi...

The way I interpret this, if you don't collect, process or use the IP address beyond it being incidentally involved in the transmission of anonymized data, it shouldn't require explicit consent.

Otherwise literally everything that connects to the internet in some way would have to treated in that way, and that's not how the law is currently enforced.

> Any submission of data requires the transmission of an IP address

Not true. Tor has demonstrated that it's entirely possible to transmit data over the internet without revealing your IP address to the party you're transmitting to.

At a heavy latency cost, and under dubious asumption that regular people control all exit nodes.

Actually no, it doesn't matter who controls the exit nodes as long as your only concern is keeping your IP private. (Exit nodes can indeed do bad things to unencrypted traffic, but that's irrelevant for this use case.)

Latency also doesn't matter here; this telemetry could take 5 minutes to reach its destination and it wouldn't matter, so long as the data is eventually received.

Hmm, I've never thought of that. I like your idea.

The point is not whether this method is "sufficiently anonymous", the point is:

I don't want my browser to collect any kind of data.

Why?

No, seriously; why? I don't get this mentality at all.

Let's ignore the exact implementation here for a moment, and assume that Firefox is somehow magically doing this data collection in such a way that it is guaranteed the data collected cannot be traced back to you as an individual. (E.g. "sufficiently anonymous".)

What problem do you have with that, specifically? How does this harm you in any way?

If it's through "secure" code, you can't always guarantee it in the future nor what Mozilla does with this data in the future. Also it doesn't set a good precedent to proceed in this direction of opt-out behavior in Firefox.

In this case, it's not through secure code though, it's through the nature of the data being sent itself. Differential privacy is meant to ensure you _can't_ use the data to make any sort of inferences about individual users; only about users as a whole.

That's kinda beside the point here though, as the GP seemed to be against collecting this data _regardless_ of whether or not it's anonymized or not. I'm interested in hearing why.

And I don't get the mentality where I should justify why I don't want my tools to report what I am doing.

I'm ok with testing things and sending feedback, but when I switch to a production environment, I just want my tools to behave like my tools, not the testing farm for somebody else.

Why should I prove to you that it would harm me? I just do not want it, it should be enough.

I don't know, to me that's a bit like running a torrent client and expecting the default setting to be "no seeding, download only". After all, the torrent client is _your_ tool, right? Why should it do anything except the bare minimum required to download the files you want? Why waste upload bandwidth on something that doesn't benefit the user?

Obviously that's ridiculous, right? If the default setting was to not seed, torrent clients would be much less useful for everyone involved. Browsers sending usage stats are much the same way. While no individual user benefits from _their machine_ sending those statistics, it's better for the user population as a whole if the default setting is to send them, since those stats help the browser vendor build a better browser. (And before you cry "privacy", remember that in this context we're talking about a situation where the statistics are being sent in a way that is "sufficiently anonymous" such that privacy isn't an issue. See the GP.)

So while I agree you certainly should have the right to disable sending usage statistics if you wish (just as many Torrent clients let you disable seeding), expecting that to be the default setting is a bit strange.

It’s a question of consent.

Imagine I came to your house, and photocopied all your documents.

Don’t worry, I blanked out the name, so it’s completely anonymous, and everything is where it used to be.

Would you be okay with that?

I certainly wouldn’t.

Making this opt-in or opt-out is a question of consent, and choosing opt-out shows that you don’t give a flying fuck about me, and only want your own benefit.

If you continue to post uncivil comments to HN we are going to ban you. You've had many more warnings than usual.

https://news.ycombinator.com/newsguidelines.html

What is uncivil in this comment? I’m sorry, but I don’t see anything problematic in there, and I’d say the same to anyone’s face IRL, given the same circumstances.

There is a swearword used, but it’s not in the context in any way uncivil, as the plural "you" that it is referring to is an abstract person, a hypothetical entity – not any actually involved person. (In this case, the potential future group of people at Mozilla who might decide to override an explicit choice I made for their own convenience)

Profanity isn't an issue on HN but "you don’t give a flying fuck about me, and only want your own benefit" is not, to my ear, the sort of thing one says to an abstract entity.

Have you also read the "and choosing opt-out" before that?

The topic is a choice that Mozilla plans to make, and is questioning users, and more about.

The decision has not been made.

My argument is that, if Mozilla (and whatever users Mozilla asks to give an opinion), choose to override the current decisions of users who do not want telemetry, and require a new hidden opt-out, then that would be proof that they (as group) don’t really care about the users choices.

The user I was talking to has no power in making that choice, nor do I. Nor is all of Mozilla making that choice.

I was using "you" with the meaning of the German word "man", (I’m natively German): one; you; they; people (indefinite pronoun; construed as a third-person singular).

Ok, probably a linguistic misunderstanding in this case. But you've straddled the civility/incivility line so often in your comments here that I still wish you would take a few more steps in the right (for HN) direction. I bet translation issues would cease to be a problem if you did.

Then why promote the browser as such?

Remove all "we respect privacy" from the advertisement.

It's misleading.

Because data collection that is "sufficiently anonymous" _does_ respect privacy. If it's completely impossible to tie the data collected to any one particular user, how does the existence of that data compromise privacy in any way?

We can go into an amazing yet pointless semantical argument of what "privacy" means. But let's look at this from a different perspective:

I like your faith. However, if this change goes in, and the capability is there, it will get misused. Because, statistically that's how these things go on this planet+capitalism.

Actually, the way they're implementing this, even if Mozilla decided to try to misuse the data in the future, they still wouldn't be able to, since the data itself is "sufficiently anonymous" (unless of course you want to argue otherwise, like the root comment was suggesting you do).

Or are you saying you're worried that they could _start_ collecting non-anonymized data in the future? If so, I don't really get that argument either. People always have the ability to change what they're going to do in the future, Mozilla deciding now not to collect this data wouldn't change that.

Ok, we changed the title from "Firefox planning to anonymously collect browsing data" to (hopefully more representative) language from the first paragraph of the article.

Can you tell me the URL of the page containing the form where I can submit my feedback?

See the OP.

This is like saying "diffie hellman key exchange has no flaws, therefore https implementations are perfectly secure".

I'm not saying anything has no flaws, just that if it has, it would be nice if you would inform Mozilla about them.