Hacker News Reader

Comment by dukenuke | Hacker News Reader

Firefox also sends enormous amounts of metadata about your browsing to the cloud and it's very difficult for non-savvy users to turn this off. They call it telemetry and 'safe browsing', but users overlook that every URL is checked against a database of URLs already in Google's 'safe browsing' repository. Firefox is not actually private and their business model can't allow for privacy, because they're in bed with Google.

Use something like Palemoon and configure about:config a bit more and you should be fine. But be very skeptical of Mozilla claiming FF is some privacy enhancing tool. Their plugins ecosystem is also a security nightmare...

View on HN

Firefox, at least modern versions of it, does not tell Google which sites you're visiting. It pulls a list from Google and checks against it: https://en.wikipedia.org/wiki/Google_Safe_Browsing

And Firefox enables you to turn this off in settings.

Firefox's telemetry can also be turned off. In fact, when you install Firefox, it asks you if you wish to enable it.

And regarding the plugins ecosystem, Firefox is moving away from the old XUL/XPCOM extension model towards WebExtensions, which should be better here.

Mozilla has very clear, detailed privacy policies for all data it collects:

https://www.mozilla.org/en-US/privacy/firefox/

You can find more developer-focused information on Safe Browsing and Telemetry:

https://wiki.mozilla.org/Safe_Browsing https://wiki.mozilla.org/Telemetry

My understanding of the Safe Browsing feature based on browsing the above is that a list of blacklisted URLs is downloaded to the client, this list is known phishing sites.

> Use something like Palemoon and configure about:config a bit more and you should be fine. But be very skeptical of Mozilla claiming FF is some privacy enhancing tool.

Keeping Firefox secure and making the right tradeoffs for collecting data to make the product better (like telemetry and crash reports) while avoiding using the data for nefarious purposes is a hard job, and I think Mozilla does it very well (disclaimer: I work there, and I see the way people treat and talk about users and their data).

> Their plugins ecosystem is also a security nightmare...

Assuming you mean extensions (aka Add-ons) - it is true that there isn't really a security model around classic Firefox extensions, which is one reason they are so powerful. The current form of Firefox extension is essentially the same as in the 1.0 days, and was intended to keep the browser slim and allow for new non-core features.

Web Extensions are intended as the replacement, they are similar to (and largely compatible with) the current Chrome extension system: https://wiki.mozilla.org/WebExtensions

Firefox already does and will continue to support more APIs than Chrome does, to enable more powerful extensions such as Tree Style Tabs.

what users overlook that every URL is checked against a database of URLs already in Google's 'safe browsing' repository

...the database of which is downloaded ahead of time and hence not transmitted to Google.

Read this: https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-...

because they're in bed with Google.

It's actually Yahoo, not Google, that funds Firefox.

If a user is too non-savvy to click a couple of check boxes in Options > Security to turn off Safe Browsing, they probably need that protection. Users this non-savvy are probably already being tracked left, right, and center and an easy target for malware served by advertising networks, and Safe Browsing is the least of their worries.

It's similarly easy to turn Health Report and Telemetry off from Options > Advanced > Data Choices.

Ignore the user you are responding to. Their expectations of Firefox are unrealistic and misinformed.

Is the claim that Firefox/Mozilla is in bed with Google sourced by the use of Google for data about safe browsing? Is there any other reason to think this now that they no longer receive revenue from Google?

Actually Mozilla ditched Google as their search revenue partner and now is partnered with select search engines depending on the market. Yahoo for the US, Yandex for Russia and Baidu for China, for example. Mozilla to my knowledge no longer relies on Google for any revenue.

See how do we generate revenue question: https://www.mozilla.org/en-US/foundation/annualreport/2014/f...

Yes, this is what I was referring to when I said "they no longer receive revenue from Google." He seemed to be basing the entire claim of the two companies being in bed together on Mozilla's use of Google's safe browsing data. I was asking if there was anything else now that the monetary agreement has ceased.

The opposite was the case. Mozilla was ditched by Google. It is logically that they say it the other way around, as it does sound much better, and gives the illusion that Mozilla is in control about their fate.

They got ditched after Google enforced minimalism (Australis) on Firefox with giving Mozilla "good design advice's" that of course backfired. And as soon as Mozilla's share dropped enough, Google gave them the boot.

There was a talk[0] which included some info about this recently at !!con[1]. The safe browsing dataset is compressed and stored as a bloom filter so that the check for a safe site can be performed locally.

0: http://bangbangcon.com/speakers.html#adam-marcus

1: https://youtu.be/C3ox1zQcV_I?t=16259 (timestamp is right at the beginning of the bloom filter details)

It's Chrome that uses a Bloom Filter.

Firefox uses a compressed Prefix set, which has no false positives (unlike the Bloom filter).

if you really want to talk about lack of privacy you should go after Chrome...

seriously, this is the very reason I use FF over Chrome.

Safe browsing doesn't work like that; the list is stored locally. When something does need to be fetched, Firefox obfuscates what's being fetched.

Most of telemetry is on Nightly only, IIRC. The bits that are on regular Firefox are thoroughly vetted to ensure that they don't impinge on privacy.

Figured I'd post this here since after reading your comment I made an effort to simply make my existing Firefox more private:

Install the "Privacy Settings" Firefox extension. This makes it easy to toggle the about:config options and has handy presets so you don't have to spend an hour reading articles to understand what to enable/disable.

I also tried "Policy Control" extension which is supposed to help prevent fingerprinting, but it didn't seem to work with EFF's panopticlick tool.

Reply on news.ycombinator.com