Each Firefox download has a unique identifier

Re:Each Firefox download has a unique identifier by car_analogy on Thursday March 17, 2022 @06:25PM (#30716569)

Any connection to Mozilla's servers reveals your IP to them. Given the amount of telemetry in Firefox, it's foolish to assume they don't log these IPs. And in either case, they could be legally compelled to. But afaik, under US law, they cannot be compelled to subvert their software, e.g. to add such spyware features if they were not already present.

[ Parent | on HN ]

Re:Each Firefox download has a unique identifier by zagrebian on Thursday March 17, 2022 @06:36PM (#30716646)

Why would Mozilla need the IP address? It doesn’t seem useful for their telemetry.

[ Parent | on HN ]

Re:Each Firefox download has a unique identifier by d110af5ccf on Thursday March 17, 2022 @07:08PM (#30716859)

Even if they don't (currently) feel that they need them, they could be compelled by law enforcement to retain logs and forbidden from revealing this fact publicly. Or their network could get infiltrated.

[ Parent | on HN ]

Re:Each Firefox download has a unique identifier by ygjb on Thursday March 17, 2022 @10:13PM (#30718054)

How do you propose to prevent a user from leaking their home IP address to Mozilla without undermining the ability to: * Download the browser * implement a safe browsing mechanism * support automatic updates (which are a critical security feature)

[ Parent | on HN ]

Re:Each Firefox download has a unique identifier by dane-pgp on Friday March 18, 2022 @01:46AM (#30719094)

If the updates are signed, then there is no danger in downloading them from a third party mirror. As for finding a mirror, Mozilla could put locations as TXT records in the DNS.

There would still be the problem that someone would have a log of your IP address downloading a Firefox update, but it wouldn't be Mozilla. Also, with a big enough list of mirrors, across 100 different jurisdictions, the probability of any given mirror being subpoenaed and having data on any given user is very small.

As for how to bootstrap the whole thing by letting the user securely download Firefox in the first place, that is of course difficult, but it should be an infinitesimally rare event compared to checking for browser updates. A user could therefore take special care to use public Wi-Fi when doing the initial download.

[ Parent | on HN ]

Re:Each Firefox download has a unique identifier by car_analogy on Thursday March 17, 2022 @07:01PM (#30716812)

What part of Mozilla's behavior makes you assume they don't? It's easy to come up with some dubious internal justification to store IPs (like to determine where to focus internationalization efforts).

[ Parent | on HN ]

Re:Each Firefox download has a unique identifier by mynameisvlad on Thursday March 17, 2022 @07:11PM (#30716875)

It's not even internal justification, it's just plainly the default for practically any web server that does logging. You would have to go out of your way to disable it.

[ Parent | on HN ]

Re:Each Firefox download has a unique identifier by detaro on Thursday March 17, 2022 @07:15PM (#30716907)

Not logging IPs or establishing controls on it is table-stakes for anyone doing anything serious about privacy.

[ Parent | on HN ]

Re:Each Firefox download has a unique identifier by perryizgr8 on Thursday March 17, 2022 @09:05PM (#30717597)

Yeah, kind of like not embedding each download with a unique ID. Oops...

[ Parent | on HN ]

Re:Each Firefox download has a unique identifier by mynameisvlad on Friday March 18, 2022 @01:30PM (#30725048)

Yeah, it definitely is. But that doesn't automatically mean they actually did it.

"Best practices" are moot unless they're implemented, and since the default is to log these things, then something (even a blog post from them claiming it's been done) has to exist to show it's there and doing the right thing.

[ Parent | on HN ]