Firefox Focus – A new private browser for iOS and Android
blog.mozilla.org
blog.mozilla.org
So, think about how much of a monopoly position Windows Phone 7 had, and try to imagine Apple had that. You can probably imagine why Apple is not in any shape to abuse their position.
> "For clients that have "send anonymous usage data" enabled Focus sends a "core" ping and an "event" ping to Mozilla's telemetry service. Sending telemetry can be disabled in the app's settings. Builds of "Focus for Android" have telemetry enabled by default ("opt-out") while builds of "Klar for Android" have telemetry disabled by default." [2]
[1]: https://f-droid.org/packages/org.mozilla.klar/
[2]: https://github.com/mozilla-mobile/focus-android/wiki/Telemet...
https://developers.google.com/analytics/devguides/collection...
[1] https://blogs.oracle.com/marketingcloud/email-marketing-clar...
[2] Lord of the Rings reference. Most apt description I can think of for the dread that comes at the mere thought of pissing off German regulators in this area.
Could be related to having a history of having to deal with mass surveillance, see stasi.
[1]: https://developers.google.com/cast/docs/android_sender_setup
It seems very likely that Firefox would be making use of GCM/FCM - I think most major apps do - so this could be it.
Incidentally, this same topics is one of the main controversies around the development of the Signal chat client - it uses GCM, which a good few prospective users object to on similar grounds.
Unfortunately, unless you've rooted your phone, GCM/FCM is the only battery-efficient way to provide push to Android phones.
But, and this is the interesting part, the userspace library of FCM can be easily reversed and cloned (the information required for that is here https://gist.github.com/justjanne/153bd4886f92be0ee57fb40842...), and the system-side part of FCM has been cloned in an open way (see the µG project).
Note: I should possibly have been clearer above by saying "is the only battery-efficient way to provide push to Android phones without root"
AFAIK f-droid always had a warning about firefox containing and promoting non free in addition of tracking users
from https://f-droid.org/wiki/page/org.mozilla.firefox :
This app has the NonFreeAdd Antifeature. This app has the Tracking Antifeature. This app has the UpstreamNonFree Antifeature.
The proprietary module (now long removed) is among the reasons the iceweasel project was born (not the debian one but the GNU one that has been renamed icecat when debian took over the iceweasel name).
It is a known fact that for years 90% or more of mozilla money came from google in exchange for making its search engine the default including tracking through an additional parameter in the URL.
There is waterfox a project to build a firefox version free of the mozilla tracking and crap: https://www.waterfoxproject.org/
Disabled Encrypted Media Extensions (EME)
Disabled Web Runtime (deprecated as of 2015)
Removed Pocket
Removed Telemetry
Removed data collection
Removed startup profiling
Allow running of all 64-Bit NPAPI plugins
Allow running of unsigned extensions
Removal of Sponsored Tiles on New Tab Page
Addition of Duplicate Tab option
Locale selector in about:preferences > General
There used to be a collection of privacy patches to remove all the tracking, leaking and privacy issues but I can't find it through web search, it seems to have been replaced by https://github.com/williex/firefox-privacy
Mozilla insist it is health report, analytics and telemetry which is marketing words for tracking and spying.
Do you have a reference for this? The Wiki page, and the project application, seem just to refer to a desire to avoid non-free plug-ins:
> ALL GNUzilla Programs will basically BE Mozilla Source Builds, with the major exception being the implementation of NO proprietary softwares, including plug-ins, according and adhereing to the GPL.
(http://savannah.gnu.org/task/?4529). That's certainly not inconsistent with what you said, but it seems a stretch to deduce what you said without some other reference.
No, it's not possible.
Mozilla employees and community members are very talented and capable people, but they are not capable for keeping a nefarious secret :) hehe
remember, you can check the source code. You can build your own version. Telemetry helps people. Telemetry helps Mozilla deliver better firefox. STOP SPREADING FUD.
The point is you cant have it both ways, both decrying tracking of users and then actively enaging in it, and agressively defending it when it comes to light.
You have to understand how extremely strict Mozilla is with using third-party services for things like crash reporting and telemetry. It is extremely difficult to find services that meet our very high standard for privacy.
AFAIK Focus and Adjust make no connections to google. Check the source?
The telemetry is documented in detail at https://github.com/mozilla-mobile/focus-android/wiki/Telemet...
We also include Adjust in Focus (not in Klar) for attribution tracking - to understand where the install came from. (This is useful if you are spending money on campaigns and you would like to understand what campaigns are the most effective)
If you have questions or suggestions, check the https://github.com/mozilla-mobile/focus-android/blob/master/... for ways to reach the team.
Recording users' behavior by default with informing the user clearly and giving him the option to opt-out is abhorrent, regardless of the benignity of the reason behind it.
Disclosure: I use firefox, but periodically strip all relevant hidden add-ons and disable all information sending possible.
> Recording users' behavior by default with informing the user clearly and giving him the option to opt-out is abhorrent, regardless of the benignity of the reason behind it.
(Even as a Firefox/Mozilla fan,) I completely agree that this behavior is what Mozilla should follow everywhere. I always choose to enable telemetry for Firefox because I want to help Mozilla and trust it. But defaults need to be sensible and protective of the user, first and foremost. If most people choose to turn it off on first run when asked for, then the actions to be taken would be educating users (in simple language) on the scope of data collection and improving the reputation of the organization/company behind it.
To me privacy is of vital importance, tracking is to be avoided at all cost, so this is as bad as it can be. But I'm now used to mozilla engaging in tracking, giving away my privacy to google for money and firefox developers punishing users and distros who disabled their included spying tool.
If that's not controversial, that's at least ironic.
(Just to clarify: this particular behavior was observed on a version from a Play Store, not FDroid. And this was about 1.5 months ago or so. But I doubt things had fundamentally changed since then.)
And if you feel statistics of time to FIRST_PAINT invades your privacy you can disable telemetry reporting.
You can also see what your browser collects in about:telemetry, but don't equate performance measurements with surveillance -- that's FUD.
It's about a certain promise^W marketing statement and behavior that at least partially contradicts it.
Since you've used the term "anonymised" quite pointedly, I'm guessing the latter. I do find it surprising that anyone would assume data Google is collecting on your usage is somehow anonymous.
EDIT: grammar
Apparently this is also true of applications & services you pay for these days too. Includes ISPs, cell companies, cable apps where you input your customer code, paid subscriptions to online news... the list is endless.
Now, people are rightfully suspicious of any software that phones home at all.
This private browser, having been using it since beta on iOS, is nothing more than just a private browsing window like the one offered in Desktop version (I am not here to debate the technical implementation since I do not know).
Telemetry does not break privacy. Privacy is a contract between the user and the product creator. In this case, Mozilla offers opt-out and does its best effort to document. User has the right to opt out or even choose not to use the software.
To me, this is a positive user feedback, but not some PR bullshit (frustration I get it). When someone says your session is private under TLS, well, your IP and user-agent are almost guaranteed captured in server logs, but you can choose to believe/not believe the service provider promises in the respective ToS.
If you want to trust Mozilla AND Google AND trust that no gag orders have been issued to the above companies by the NSA, CIA, FBI et al, fine. That's the way 99% of apps work. They all have privacy policies, and people generally trust them.
The whole point of explicitly "private" or "anonymous" software is that there are a bunch of users that do NOT trust the above.
Calling your software "private browsing software" and then having Google-anything embedded in it is like serving vegetables cooked in chicken broth and calling your dish "vegetarian". Although 90% of the population will gladly eat your chicken broth, it's disingenuous to sell it to actual vegetarians.
Since it's all free software, you can check what events are actually sent here: https://github.com/mozilla-mobile/focus-android/blob/master/...
> - Adjust SDK: an install attribution tool (aka install referrer tracking). This is only used to determine whether the app was installed as the result of a specific (google-hosted) ad campaign. Adjust depends on play-services-analytics. ( https://www.adjust.com/glossary/install-referrer/ ).
play-services-analytics is what I meant by "the Google SDK" in question; sorry if that was unclear!
So, yes, you give data to Google. The Google analytics dependency you include could literally be malware, and you could not test, or know. And you never know if it doesn’t just decide to steal your data and transmit it all, be it by Google’s decision or because an NSL was issued to demand Google do that.
So, yes, as soon as you include this dependency, the entire browser has to be considered compromised, and you might as well just use Google Chrome.
This is a very strange conclusion that you present. I feel you are just twisting and turning to come to an unfavourable outcome here.
Even Google has decent data collection policies. They will not randomly make an application collect data without the developer opting in. We did not opt in. We are not including any sort of google analytics api key to enable anything.
In any case I have filed https://github.com/mozilla-mobile/focus-android/issues/1174
I’m not sure if you’re trying to intentionally ignore the issue here.
You are asking people to trust Google. If people trusted Google, they’d use Google Chrome in the first place. Your entire userbase is people that don’t trust Google, at all.
If you use Google proprietary software in Firefox, and tell people to just trust Google, you just entirely destroyed every value Firefox ever had, and your own job.
The whole purpose of Firefox is that I don’t have to trust Google. That I don’t even have any kind of interaction with Google. That I can exist without having to use Google’s technology.
If you use Google Analytics in Firefox’ Addon menu, or in Firefox Focus, and say "but Google doesn’t technically track people because we have a contract with them", then I can just as well use Chrome. If I trusted Google to keep their word, I’d use Chrome.
Chrome runs far faster, looks better, is easier usable, has better addon support, works with more websites because everyone only supports Chrome anymore, it actually supports 10 bit video, oh, and it even does hardware video decoding on Linux.
The entire reason anyone still uses Firefox is because they don’t trust Google. If you ask people to trust Google, you’re literally telling them to just use Google Chrome.
That is the elephant in the room that everyone at mozilla tries to ignore by putting Google Analytics into the addon menu of Firefox (and, as result, also in the Tor browser), and by importing a Google Analytics library into Firefox Focus. This destroys the one single value that Firefox has in the current world: It’s not Google.
> st3fan: Because that library is there does not mean that we are giving data to Google. It does not even mean that it is active or that it is sending anything.
Having gone through the comment chain in other places it seems like your entire position in the debate between you and st3fan is based on ignoring what he's actually saying in general. In response to their request for evidence your responded
>That's pretty simple. Don't use proprietary software.
which sidesteps the query entirely and does nothing to lend credibility to your original position.
I don't expect to change your mind and frankly I don't have a reason to, but if your goal is to have productive or persuasive conversations then you may want to evaluate your current communication strategy.
I thought Firefox Focus was a great step forward in privacy, but I am dismayed to see it includes Google code, that it uses a third party analytics library, and that the developers do not see either of those as a big problem.
I'd like to see some actual evidence that we can act upon rather than a strong unsubstantiated opinion. If we really leak anything than I will stand corrected and the team will fix that promptly.
That's the simple question you can act upon.
No proprietary software, and don't even think about doing any tracking until you have explicit opt-in.
I think you're being a little silly though.
people have minimal ownership of code and time they contributed. they should not allow people to screw the project over without being vocal.
its like someone invading your home, breaking everything, and people just telling you "if you don't like it just move elsewhere".
Firefox's about:config does not seem to work on FF Focus either.
There is no Google Analytics in Focus. Check the source code please to verify this.
Ergo, Focus uses com.google.android.gms:play-services-analytics.
Ergo, Focus talks to certain Google Services.
If you recursively import a proprietary binary, it still ends up in the resulting apk. I’ve checked the APK, the Google Analytics libary ends up in it, and it is not in any way sandboxed from the rest of the browser.
I can assure you that Adjust does not talk to google analytics behind our backs. It may have that option, but we did not configure it to use that functionality. What would it talk to, we did not configure an API key.
I will find out if we can remove this dependency to avoid confusion.
Filed https://github.com/mozilla-mobile/focus-android/issues/1174
(And for completeness, Adjust source code at https://github.com/adjust/android_sdk)
Focus does have:
- Mozilla telemetry: enabled by default in Focus, disabled by default in Klar. This only sends data to Mozilla servers, and only concerns what features people use (i.e. do people use share, do people use custom tabs, do people clear using the bin button or the notification). This stuff is used for deciding what features to prioritise (or remove), and doesn't involve Google servers.
- Adjust SDK: an install attribution tool (aka install referrer tracking). This is only used to determine whether the app was installed as the result of a specific (google-hosted) ad campaign. Adjust depends on play-services-analytics. ( https://www.adjust.com/glossary/install-referrer/ ). This only comes into play if you install the app from the play store (which funnily enough Google own). This is the only time play-services-analytics shuld be used, i.e. on first install. This is also disabled in Klar.
(The more interesting question is: could Focus receive the INSTALL_REFERRER itself for ads attribution instead of using Adjust? That data might be meaningless without asking google to tell you where it came from, and they provided it in the first place anyway...)
"Firefox Klar is a version of Firefox Focus for Germany, Austria and Switzerland with user activity tracking disabled by default."
This stuff is used for deciding what
features to prioritise
The hypocrisy to advertise "tracking protection" as a key feature and then send tracking data to your own servers is hillarious.
Anonymised data would make me happier though :)
Also, Mozilla's privacy policy explains what Mozilla can do with the data. Generally it's not a matter of trusting the company as much as it is believing they'll follow their own privacy policy, which IMO is a reasonable assumption for most companies (including Facebook and Google, which use your data but do tell you about it)
Focus increments a counter if you search. With no way of knowing who you are, what you searched for or any way to correlate it to other telemetry.
But sometimes it is true and sometimes it is not. The difference matters.
Collecting aggregate usage statistics does not have the same consequences as building detailed personal profiles and storing them indefinitely.
https://wiki.mozilla.org/Telemetry/FAQ
It collects things like "how slow is rendering" or "do you use feature X?". It's all anonymized, and you can verify this from the source (you can also turn it off). Folks are very careful if adding new telemetry metrics.
This isn't trackable data.
Sure, this example is contrived. But in some cases features make app development more complicated (ALSA support in desktop firefox might be a better example, but I'm not super familiar with that case). Knowing that a feature isn't used makes it easy to accurately remove crufty/complicated features without negatively impacting a lot of users. And makes it possible to justify retaining complex features that happen to be useful to many users.
Same story with crash reports (typically users have to explicitly confirm sending crash reports in many applications, no idea what kind of system Focus uses though). You need to know which issues are actually important, developers don't have infinite time (as much as we wish we did).
(I used to be sceptical too... but you're sailing blind without this kind of data, and ultimately hurting both yourself and your users.)
Page refresh pattern data would go a long way in deanonymizing the user panopticlick style.
This makes me shudder. I don't want tcp/ip packets flowing from my computer to yours, telling you how often I refresh.
Mozilla unlikely does that right now, but they have to advertise truthfully nonetheless. Even if the reason is merely that people won't turn on that feature otherwise, there is no need for us to tolerate such hypocrisy.
Why not do privacy properly? Then the first comment in any conversation won't be well, there is that in-house telemetry.
Denying the ability to collect telemetry data for privacy conscious products is to deny them the ability to improve their products using data-driven approaches that have been proven to be overwhelmingly effective in practice.
This would be an extremely heavy handicap, and could very easily make a tangible difference in the prospect for any such product to gain the market share and the resulting network effects needed to become and remain competitive with products and companies that couldn't care less about your privacy.
So at the end of the day, condemning companies like Mozilla who clearly make a serious effort to collect only the most essential and non-identifiable metrics to improve their product can be quite counter-productive if your endgame is for privacy-conscious apps and companies to be as successful as their mainstream counterparts one day.
Visual Studio removed 'macro' functionality, and a bunch of developers went to the forums to complain and demand an explanation.
That explanation was as follows: None of those developers enabled "send usage feedback," so the usage statistics for macros was close to 0%. The developers sensibly thought it made sense to stop supporting that feature.
There's a tradeoff associated with extreme privacy, and perfect is the enemy of good.
I'd like to see better support for getting SSL/TLS info - why can't I tap on the padlock and get the certificate info (EV, OV, DV?), cipher suite, HSTS etc?
- Firefox Focus, which blocks all sorts of stuff
- 1Blocker, which blocks all sorts of stuff
- Unobstruct, which blocks Medium's "dickbar" popups.
that is the question
It was, in great part, their legal team and strategy that pushed me away from Apple.
"Browsers" on iOS, such as Firefox Focus and Chrome, just repurpose the built-in Safari engine with some modifications (bookmark sync, extra content blocking, etc.)
remove the rule that allows script from the original domain. done. now all sites will be quarantine, until you white list them.
On the browser itself, I launched it, navigate on a URI, closed it, relaunched it, type the firsts characters of my previous URI and it auto completed it. From my history I guess.
So it's not like incognito mode on other browsers. (Haven't retested again)
They launched the android version not too long ago. This is probably just a push to get the word out to people who may not have heard. Fair enough in my opinion.
> From my history I guess
I don't think it's from your history. It seems like many common websites are preset to autocomplete; stackoverflow.com for example. Because it doesn't save history this seems like a nice way to reduce friction for users. I could be wrong though.
> I don't think it's from your history. It seems like many common websites are preset to autocomplete; stackoverflow.com for example. Because it doesn't save history this seems like a nice way to reduce friction for users. I could be wrong though.
In my experience, your statement is correct. Firefox Focus does not store history. It does have a long list of sites that it autocompletes. Whenever I visit HN, I actually type news.ycombinator.com into the address bar since Focus does not have bookmarking. But I don't mind that, and consider that as a feature.
I've just tested it again and indeed it haven't occurred again.
A good thing so :)
- Erase your history.
- Go to HN, click any link you haven't clicked before.
- Wait for it to load.
- Erase your history. Make sure you see the notification "Your browsing history has been erased".
- Go to HN again, and see the link you've just clicked still highlighted as 'visited'.
I'll check if there's an issue filed for this tomorrow.
If I want to install this on my Fire HD I either have to download the .apk from some dodgy mirror site or install Google Play with some workaround on the Fire HD. Cause Firefox Focus is not available in the Amazon App Store. I mean yeah I can do both in the end, not a big deal, but I just want the .apk nothing else.
It includes apk download links in addition to source code links and Google play store links.
The thing GP was complaining Mozilla weren't doing.
[1] https://f-droid.org/packages/com.github.yeriomin.yalpstore/
As an aside, I only use FDroid on my devices to install APKs (the only exception being Signal which now provides bare APKs[3]).
[1]: https://f-droid.org/packages/org.mozilla.klar/ [2]: https://github.com/mozilla-mobile/focus-android/releases [3]: https://signal.org/android/apk/
I almost only use FDroid, but it can be sometimes of a pain. Like not even having Firefox and VLC is kinda bananas
http://www.androidpolice.com/2014/11/19/meet-apk-mirror/
https://www.apkmirror.com/faq/#What_measures_do_you_take_to_...
If I want to check Hacker News let's say 5 times throughout the day and feel like leaving a comment, I have to login again, without autocomplete..?
Maybe I'm missing something.
It's amazing how far apart I got from every single one of Mozilla's visions, from using Firefox as my main browser 8 years ago.
I love the fact that—as an example—as I travel Google shows me tools that I'll be interested in, like a currency converter, translate + word of the day in the local language, etc. etc.
I would absolutely hate having my main browser constantly forget who I am. I feel almost blessed every time I visit a website that I can log in with one click (or I'm already logged in), and when I sign up or buy stuff I can autofill my name, email, address, and credit card without having to start from scratch.
I'm not ready to give up extreme convenience and lots of time for the ideal of safeguarding my privacy with Google or Apple.
It looks like they're scrambling to try to stay afloat and miss and miss again.
I prefer to stay anonymous, but use the "real" FF occasionally for stuff I need to be logged in for. Browsing links friends send me, or checking something with a quick google search is something that I'd rather stay anonymous for, so I prefer having it available.
So just use something else! Oh, wait, you want to check your official university e-mail? That's provided by Google now. Oh, wait, you wanted to check city transit information? That's provided by Google now.
(I'd probably use Google for the latter anyway, but it'd be nice to be able to pretend that I had a choice.)
Google's own policies prevent it from doing data mining on GSuite accounts, like official email provided by Google in universities or companies or businesses. I'm sure other providers have similar policies as well. Unless you don't trust Google even a bit, your comparison on the email provider point is useless. I prefer separating things out and examining them instead of combining everything into one single worrisome name.
Yes, but if I sign up from my cell phone, I'd like to have that info on my desktop browser automatically and on other computers, so no.
> And currency converter, translations, word of the day, etc can all be done as browser extensions.
Sure, but what a pain. I wouldn't go through the pain of searching, installing, configuring, and then removing an extension for each one of of those things. I just don't care about any of them that much, it was just nice having them there automatically.
I'm pretty sure Safari will sync that info using iCloud, and I think Firefox has its own sync mechanism that can be used for this.
Or you could use any one of the numerous password managers (I use 1Password).
> Sure, but what a pain. I wouldn't go through the pain of searching, installing, configuring, and then removing an extension for each one of of those things.
If you actually care about having any of those, it's really not hard to search for and install extensions. You seem to be overplaying the difficulty involved here, especially for something of such relative low utility.
You can always use incognito mode, but this is more convenient.
It is also really fast and lightweight, which is a plus for most mobile devices.
It is not meant to replace your main browser (probably).
Also, as rcthompson said in another comment:
> This is useful to use as your default browser. It has a quick way to open the same link in another browser, so you can use it as a sort of quarantine to vet unknown links before exposing your main browser and all its juicy user data to a new website.
Honestly, most of the time when I use Google Searches is because I want to look for something, and I love when Google personalizes results so that if I type "Amiga" it knows it's the computer and I don't want to learn Spanish. Most importantly, I end up visiting lots of websites that I might want to comment on, visit later on/not lose if my phone dies, share with my girlfriend, etc.
I personally don't see any advantage with incognito mode unless you want to hide porn from your spouse, so I guess I'm not the target for a browser created to be incognito-mode-only, and if I was I would probably use Tor, because they might not be share my info, but my IP is there for everyone to see along with the websites I visit.
If you want to protect your privacy at least use tor.
I don't see how private browsing can protect you in any way, while your IP is in the clear along with all HTTP requests you make.
You might think that's hyperbole. I don't. I'm deadly serious; I think something worse than Trump is coming down the tracks because of an increasingly divided polis, and it's divided because of atomisation of world perspective. Filter bubbles driven by hidden preferences are directly responsible for shielding people from unpleasant perspectives, on both sides.
This is a very naïve view of what incognito/private browsing mode is for. Tor (not Torbrowser) is very different from incognito/private browsing. Even for your own use, it's another layer of defense to reduce the storage of information on the device about whatever you've been up to. Certainly porn is not the only topic that can polarize people and have them assume things about you. We live in a world where even tiny things can be taken out of context, manipulated and used against us either by the people close to us, or the places we work for, or even the government. You may share a device with someone or allow someone to borrow it. You may have your device stolen while having minimal or no passcode or other protection (like encryption of data stored). There are many layers to look at to be secure enough.
The way I see it, you're putting yourself more at risk if you do not distinguish what requires private/incognito mode (it could even be Facebook), how often you should clear things up (like browsing history, caches) on your device/computer, etc.
Maybe I didn't word it correctly, I meant that all it's good for is to hide porn from your spouse.
If you think incognito mode protects you in any way, than it's you who is naive.
If anyone really wanted to track you, they can use your IP and see every single page you've visited. Even the size of your window is enough to track you.
Tor is the only tool I know that you can use if you don't want to be tracked.
> We live in a world where even tiny things can be taken out of context, manipulated and used against us either by the people close to us, or the places we work for, or even the government.
Sure, but I think that we shouldn't be paranoid about it (please don't hack my account to prove a point :-)). What is the actual risk that your government will track your browser and use a tiny thing against you? I wear seatbelts because the risk of an accident is high, I don't wear a helmet to protect my head in case a small meteorite hits me.
I don't think any government or anyone has the right to spy on anyone else, and organizations should work to prevent that, but I think a lot of it is hype. We live in a world where people post pictures on Facebook of themselves drunk, doing drugs and showing off things they stole, all while leaving harsh, racist, hateful comments.
I would be worried more about ourselves leaving ever-lasting indications we're idiots on social media, more than about governments spying on us to get evidence to frame us.
Thanks to leaks and other revelations we don't need to be paranoid because we have enough information to understand to what extend the overreach goes. We can be reasonably anxious and mistrustful of State run programs.
This is what Google stores for you based on your agreed privacy terms: https://myactivity.google.com/myactivity
You don't have a privacy agreement with secret spy programs. Yeah maybe they are just going after the terrorists but maybe they are sharing all data across agencies. Maybe those agencies are using that data in unsavory ways to further their own agendas. A documented example is the DEA using https://en.wikipedia.org/wiki/Parallel_construction to make drug arrests based on data collected illegally.
My main problem is this leaky information/power. I generally trust the folks in the intelligence community to keep each other in check, but, by design there is no transparency for secret programs. There's an opaque group of people getting all the data and the funding. It is the weakest link and we can't inspect it to see how healthy it is. To me it is terrifying to think about the power in those tools and what the right wrong-person could accomplish with the information they have.
Firefox Focus just makes cookies and history ephemeral instead of durable. It looks like it blocks 3rd party scripts by default as well. Blocking 3rd party scripts with uMatrix has been better than using an ad blocker for me. Constantly having to adjust the permissions in uMatrix gives you a real idea of how much crap is tracking you all the time.
Install uMatrix, don't transport literal tons of cocaine across international borders, and you will probably be OK.
Don't be worried about leaving idiotic posts on social media. It apparently doesn't matter for high profile careers.
> It is not OK to act in a retaliatory manner when you are not the master of a domain and are specifically called out on it.
Who did I retaliate against? And who called me out on what, exactly?
I'm saying that Firefox Focus is a little toy if you really care about privacy, and to use Tor if you want be safe from spying.
I visit https://myactivity.google.com/myactivity every once in a while, but so far Google has used that information to make my life A LOT easier.
>If you think incognito mode protects you in any way, than it's you who is naive.
newscracker called you out specifically in the parent post with
> This is a very naïve view of what incognito/private browsing mode is for.
> If anyone really wanted to track you, they can use your IP and see every single page you've visited. Even the size of your window is enough to track you.
> Tor is the only tool I know that you can use if you don't want to be tracked.
Sorry, it seems like you didn't read my post fully or get it. I described that incognito/private browsing mode is one layer of defense, not the only layer. I also provided examples of your device being borrowed by someone else or it being stolen. In those cases, whether you used Tor (not Torbrowser, which I explicitly excluded even in my previous comment) doesn't matter. Whatever your browser has stored on the device - including browsing history, cache, cookies - is available to them to use or sell to others.
Also, I didn't mention the government as the sole hostile entity in my comment. One's own employer may use information in your browser cache on an employer provided device to fire the person or even file a criminal lawsuit against the person. Some malicious program a person downloaded may scrape all information from your caches and send that to insurers or other "data brokers" who in turn would classify you as too high a risk to support. There are far too many possibilities here that I cannot list every single one of them.
As for those who post pictures on social media about being drunk, posting racist messages, etc., that's really bad in many ways, but such protections and more should also start with each of us individually. It's in that space that I see using icognito/private browsing mode as one more helpful layer. Tor is another layer. Encrypting one's devices' storage is another. And so on.
They should be more transparent and upfront what they're collecting and why though.
... on their flagship browser. On their super-private, pinky-swear no tracking we-hate-ads-but-sure-do-love-you tiny browser, there should be... no tracking.
The 100% fresh, free-range, ethical browser
More privacy
Firefox doesn’t sell access to your personal information like other companies. From privacy tools to tracking protection, you’re in charge of who sees what.
More freedom
Following the pack isn’t our style. As part of the non-profit Mozilla, Firefox leads the fight to protect your online rights and champion an Internet that benefits everyone — not just a few.
Then you click the privacy policy and you're welcomed with:
Things you should know
Firefox automatically connects to us and our service providers to provide updates, security, Snippets, Firefox Health Report, and other features.
They also have a very loose definition of personal information: 'For us, "personal information" means information which identifies you, like your name or email address.' In times when we know a handful of cross-referenced metadata is enough to identify someone with a high level of success this is unacceptable from some entity who claims to champion privacy, online rights and user freedom. It only shows that either there are highly incompetent people in charge at mozilla or that they treat their users as too dumb to notice.
IMHO there should no tracking by default on firefox desktop and opt-in for those who want to. Actually I'd even go further and say that no browser should include tracking and should block all trackers, analytics, commercial advertising and other PR words for surveillance, spying and profiling.
With relatively few efforts this was something one could almost achieve, at least get closer to, through extensions in firefox. Mozilla put an end to it by dropping their extension engine.
It also depends on what the data is used for, let's take an absurdity : 'send drones to kill all users that started Focus 30 times a day on average'
A closer to reality example is "our data shows less than 1% users have alsa only system, our implementation is sort of broken in fringe case and requires an overhaul that we don't want to do so instead of fixing it let's just drop it altogether, less than 1% of users is not enough to matter".
The features you explained are exactly what I was looking for in a mobile browser. In fact, i wish they launch Focus for Desktops operating systems too.
Yes, I was just thinking the same thing. I can almost imagine a world where software believes me about what kind of experience I want, "full site" on mobile or "mobile site" on the desktop, rather than browser sniffing followed by awkward clicking around to correct its misapprehensions.
If you don't log in into websites, I don't see why you would leave yourself exposed and very easily hacked with Firefox or private browsing if there's Tor.
Private browsing is NOT secure. It's just a shortcut to avoid clearing your history manually. ANYONE can see who you are, and what sites you visit with easy-to-use tools that are available online for free.
Security is not an absolute. The best you can do is talk about whether something addresses a particular threat model.
There are different tradeoffs to Tor. A big downside is that unencrypted traffic is now easier for intermediaries to read and even change, because of how exit nodes work.
Everyone has use for both full-featured browsing where you can stay logged in to frequent sites, retain history/bookmarks and such, as well as private browsing where you don't want any history kept. On the desktop the way the UI is currently setup, full-featured is the default and private is an extra step you have to take, and as such private is typically only used for special occasions.
Focus reverses this dynamic by making private browsing easier, faster, and more streamlined than full-featured browsing, so people will start making private browser the default for most quick web tasks, and just go to the slower the full-featured browser when they need it.
Having two different launcher icons for these two modes is more convenient for the user, and AFAIK it isn't possible for a single app to install multiple icons in iOS[1]. Besides, not everyone wants to use Firefox as their main mobile browser. So a separate app makes sense.
[1] https://stackoverflow.com/questions/10048541/multiple-icons-...
But alas, the "simple and lightweight" Firefox Focus actually requires a heavyweight 64-bit processor:
> Why aren't older Apple products supported? Safari Content Blockers (which include Firefox Focus) are only available on devices with an A7 processor (64-bit) or later. Only 64-bit processors can handle the extra load of content blocking, which insures optimal performance. For example, since the iPad 3 has an A5 processor, Firefox Focus is incompatible.[1]
Come on, iPad 2's and 3's are less than 5 years old. There has to be some way to keep the iPad 2 or 3 alive if all you want to do browse the web.
[1]https://itunes.apple.com/us/app/icab-mobile-web-browser/id30...
You could always try to build it yourself.
They might have been able to get by without the 64bit requirement if it just blocked content in the webview, but it also blocks trackers in Safari.
Best idea ever. That's the most common use case people have and one that's drastically underserved by current browsers.
If people can't get their browser to quickly open a link to simple stuff, it means the web is failing. If the web is failing they'll quickly jump over to sending images over WhatsApp or fall into the trap of using the Facebook app for all their needs that could be otherwise served by the web.
For example, if you need to jump on the internet to look
up Muddy Waters’ real name, and instead of “McKinley
Morganfield” you get pop-up ads, screen takeovers,
“sponsored” content and other third-party advertising-
driven distraction, then you know what browser overkill
feels like.
Am I missing something, or can someone explain what they're referring to?
When I'm asked to look something up on my LG G2 budget phone, I usually just say "Can't, sorry" or "Sure, give me a few minutes".
I think you're taking the example a bit too literally. You know exactly what they're talking about. It's become almost impossible to use a phone browser for anything quick. They are slow to begin with, and with all the ads and other crap it's just not even worth it half the time.
Also, why the blog post then? I've had this app on my phone for many months now.
There's the clipboard...
Can we have something similar for desktop as well?
I think this browser is rather smartphone oriented, and might "clean up" some pages to make them lighter. I don't know.
Alternatively there is waterfox + ublock origins.
Waterfox is firefox without the mozilla crap:
Disabled Encrypted Media Extensions (EME)
Disabled Web Runtime (deprecated as of 2015)
Removed Pocket
Removed Telemetry
Removed data collection
Removed startup profiling
Allow running of all 64-Bit NPAPI plugins
Allow running of unsigned extensions
Removal of Sponsored Tiles on New Tab Page
Addition of Duplicate Tab option
Locale selector in about:preferences > GeneralHow? Lollipop, the first Google hit for "Android OS size on phone" (https://android.stackexchange.com/questions/118896/how-much-...), seems to be about 5 GB. (Maybe you don't run Android, or maybe a very old version?)
I've seen a phone like this running Lollipop. The best part is when it decides to auto-update all the built-in (Google) apps, collectively consuming a total of 1-1.5GB of /data, at which point Google Play refuses to let you install any apps because you do not have enough free space available.
Oh, so you read bigbugbag's comment (https://news.ycombinator.com/item?id=15049992)
> > wow those people are lucky and high on consumerism, my phone had 2GB.
as saying that it's 2 GB after the system installation? That seems to make it a strange response to itg's comment (https://news.ycombinator.com/item?id=15049947)
> > > Considering how may people still have 8GB/16GB phones, I doubt it. On iOS sometimes you have to delete apps, especially ones that build up large caches like Facebook.
which is clearly referring to the pre-OS available space.
facebook apps are good examples of this.
I am probably drastically simplifying things but the primary components of the app are just a content blocker and a preferences page.
There's a bug tracking work to migrate to Gecko though: https://github.com/mozilla-mobile/focus-android/issues/13 (see also the linked https://bugzilla.mozilla.org/show_bug.cgi?id=1322573)
And it happens to block the vast majority of ads, so Mozilla isn't exactly making friends with webpage owners by supplying this. Had they used Gecko for this, then the percentage of people on Gecko with ads blocked would have risen and that might have resulted in webpage owners spending less time to ensure that their webpage isn't broken on Gecko, therefore effectively dragging down the situation for actual Firefox.
Why not just turn off notifications for Firefox Focus? At least on Samsung-skinned Marshmallow, that seems to do the trick.
(Grumble grumble, but it still reminds me that I'm running in power-saving mode, which is a vital notification that only applies whenever the phone's on. Thanks, Samsung!)
I set it to my default browser and keep chrome handy on the side.
So I'd say its adblocking is still less effective than regular Firefox for Android + uBlock Origin add-on.
It does feel quite speedy, though. Could possibly be what I start using in the future to read HN articles.
You can install the Gecko version if you compile the code yourself for now. Although I believe they will probably switch to Servo instead of Gecko once it is ready.
Edit: It seems not: https://github.com/mozilla-mobile/focus-ios/issues/155
Could this someday integrate Tor, making it sort of an amnesiac Tor Browser for mobile?
This is the relevant issue on their GitHub repo: https://github.com/mozilla-mobile/focus-android/issues/66
edit: Please note that this is for the Android version only.
I like and use Orbot, but requiring it isn't the greatest UX.
ps: it's a potential modern dillo.
If you can live without tabs, try it, it's great.
Launching a separate app on the other hand is a familiar concept and does also explain quite nicely that browsing history won't be saved, as it's normal that data does not get shared between apps, whereas Private Browsing is a separate concept that needs understanding.
And this in effect had implications on the design. Not having tabs was a deliberate design choice, because this type of casual user does generally not understand those either.
That it would get so much adoption in the tech world was very much unexpected.
So, tabs are being worked on, Tor integration is coming, this sort of stuff. Tabs might take a little while still, though: https://github.com/mozilla-mobile/focus-android/issues/960
Why "browser.privatebrowsing.autostart" set to "true" does not work on Android version?
PS: I know I can clear everything (cookies, history, etc.) on exit.
[0] https://play.google.com/store/apps/details?id=com.sec.androi...
However it seems to default to HTTP not HTTPS. That's a deal breaker.
type about:config in the address bar, and
search telemetry (just by typing) -> disable
It's what comes up on FDroid and sounds identical.. though FDroid strangely doesn't host Firefox (Vanilla)..
>Klar by Firefox is the German-language version and only available in Germany, Austria, and Switzerland. It includes the same features as the English-language app Focus by Firefox.
https://support.mozilla.org/en-US/kb/difference-between-fire...
Regular Firefox is on F-Droid as "Fennec" -- I believe the justification in both cases is to avoid stepping on Mozilla trademarks.
A more precise comparison would be always-on incognito plus Disconnect[1]. So, it uses a dumb tracker block list like it could also be enforced by uBlock Origin, and the list that Firefox uses is the list that the Disconnect devs put together.
Then, again, it also depends on which browser's incognito mode you're talking about. Firefox's Private Browsing comes with Tracking Protection, which uses this same block list. So, privacy-wise this is actually identical to Firefox's Private Browsing mode.
[1]: https://addons.mozilla.org/en-US/firefox/addon/disconnect/
Although I'm not sure when the first iOS version was released.
https://www.theverge.com/2015/12/8/9870860/mozilla-focus-ad-...
This whole privacy meme is getting out of hand. I struggle to relate with this community nowadays...
Also, Focus has surprisingly been adopted by tons of power users. As a result, Mozilla is now very much working on features for non-technophobes, like tabs, and power users, like Tor support.
Initial impressions were good; it seemed snappy, I liked the UI, and it was using less memory than Chrome with the same number of tabs open. A couple of days in things went downhill.
On Mac OS I was getting short freezes every ~10 seconds. I found similar complaints ranging over a period of nearly five years, but no clear resolution. This morning I had FF lock up multiple times while editing Jira tickets. Since FF is still a single process, the entire browser was locked up and required a hard kill, which cost me work.
So, no thanks mozilla, back to Chrome. I know this is one person with one experience, but man, this one experience was pretty off-putting. Maybe I'll try again in another decade.
Multiprocess has been gradually rolled out since last year. Check about:support, you might have some ancient addon installed that isn't compatible.
Also, they are switching out the UI with Firefox 57, so I hope you like this one, too: http://design.firefox.com/people/shorlander/