According to F-Droid [1], it contains `com.google.android.gms:play-services-analytics`.
Focus does have:
- Mozilla telemetry: enabled by default in Focus, disabled by default in Klar. This only sends data to Mozilla servers, and only concerns what features people use (i.e. do people use share, do people use custom tabs, do people clear using the bin button or the notification). This stuff is used for deciding what features to prioritise (or remove), and doesn't involve Google servers.
- Adjust SDK: an install attribution tool (aka install referrer tracking). This is only used to determine whether the app was installed as the result of a specific (google-hosted) ad campaign. Adjust depends on play-services-analytics. ( https://www.adjust.com/glossary/install-referrer/ ). This only comes into play if you install the app from the play store (which funnily enough Google own). This is the only time play-services-analytics shuld be used, i.e. on first install. This is also disabled in Klar.
(The more interesting question is: could Focus receive the INSTALL_REFERRER itself for ads attribution instead of using Adjust? That data might be meaningless without asking google to tell you where it came from, and they provided it in the first place anyway...)
"Firefox Klar is a version of Firefox Focus for Germany, Austria and Switzerland with user activity tracking disabled by default."
This stuff is used for deciding what
features to prioritise
The hypocrisy to advertise "tracking protection" as a key feature and then send tracking data to your own servers is hillarious.
Anonymised data would make me happier though :)
Also, Mozilla's privacy policy explains what Mozilla can do with the data. Generally it's not a matter of trusting the company as much as it is believing they'll follow their own privacy policy, which IMO is a reasonable assumption for most companies (including Facebook and Google, which use your data but do tell you about it)
Focus increments a counter if you search. With no way of knowing who you are, what you searched for or any way to correlate it to other telemetry.
But sometimes it is true and sometimes it is not. The difference matters.
Collecting aggregate usage statistics does not have the same consequences as building detailed personal profiles and storing them indefinitely.
https://wiki.mozilla.org/Telemetry/FAQ
It collects things like "how slow is rendering" or "do you use feature X?". It's all anonymized, and you can verify this from the source (you can also turn it off). Folks are very careful if adding new telemetry metrics.
This isn't trackable data.
Sure, this example is contrived. But in some cases features make app development more complicated (ALSA support in desktop firefox might be a better example, but I'm not super familiar with that case). Knowing that a feature isn't used makes it easy to accurately remove crufty/complicated features without negatively impacting a lot of users. And makes it possible to justify retaining complex features that happen to be useful to many users.
Same story with crash reports (typically users have to explicitly confirm sending crash reports in many applications, no idea what kind of system Focus uses though). You need to know which issues are actually important, developers don't have infinite time (as much as we wish we did).
(I used to be sceptical too... but you're sailing blind without this kind of data, and ultimately hurting both yourself and your users.)
Page refresh pattern data would go a long way in deanonymizing the user panopticlick style.
This makes me shudder. I don't want tcp/ip packets flowing from my computer to yours, telling you how often I refresh.
Mozilla unlikely does that right now, but they have to advertise truthfully nonetheless. Even if the reason is merely that people won't turn on that feature otherwise, there is no need for us to tolerate such hypocrisy.
Why not do privacy properly? Then the first comment in any conversation won't be well, there is that in-house telemetry.
Denying the ability to collect telemetry data for privacy conscious products is to deny them the ability to improve their products using data-driven approaches that have been proven to be overwhelmingly effective in practice.
This would be an extremely heavy handicap, and could very easily make a tangible difference in the prospect for any such product to gain the market share and the resulting network effects needed to become and remain competitive with products and companies that couldn't care less about your privacy.
So at the end of the day, condemning companies like Mozilla who clearly make a serious effort to collect only the most essential and non-identifiable metrics to improve their product can be quite counter-productive if your endgame is for privacy-conscious apps and companies to be as successful as their mainstream counterparts one day.
Visual Studio removed 'macro' functionality, and a bunch of developers went to the forums to complain and demand an explanation.
That explanation was as follows: None of those developers enabled "send usage feedback," so the usage statistics for macros was close to 0%. The developers sensibly thought it made sense to stop supporting that feature.
There's a tradeoff associated with extreme privacy, and perfect is the enemy of good.
This private browser, having been using it since beta on iOS, is nothing more than just a private browsing window like the one offered in Desktop version (I am not here to debate the technical implementation since I do not know).
Telemetry does not break privacy. Privacy is a contract between the user and the product creator. In this case, Mozilla offers opt-out and does its best effort to document. User has the right to opt out or even choose not to use the software.
To me, this is a positive user feedback, but not some PR bullshit (frustration I get it). When someone says your session is private under TLS, well, your IP and user-agent are almost guaranteed captured in server logs, but you can choose to believe/not believe the service provider promises in the respective ToS.
If you want to trust Mozilla AND Google AND trust that no gag orders have been issued to the above companies by the NSA, CIA, FBI et al, fine. That's the way 99% of apps work. They all have privacy policies, and people generally trust them.
The whole point of explicitly "private" or "anonymous" software is that there are a bunch of users that do NOT trust the above.
Calling your software "private browsing software" and then having Google-anything embedded in it is like serving vegetables cooked in chicken broth and calling your dish "vegetarian". Although 90% of the population will gladly eat your chicken broth, it's disingenuous to sell it to actual vegetarians.
Since it's all free software, you can check what events are actually sent here: https://github.com/mozilla-mobile/focus-android/blob/master/...
> - Adjust SDK: an install attribution tool (aka install referrer tracking). This is only used to determine whether the app was installed as the result of a specific (google-hosted) ad campaign. Adjust depends on play-services-analytics. ( https://www.adjust.com/glossary/install-referrer/ ).
play-services-analytics is what I meant by "the Google SDK" in question; sorry if that was unclear!
So, yes, you give data to Google. The Google analytics dependency you include could literally be malware, and you could not test, or know. And you never know if it doesn’t just decide to steal your data and transmit it all, be it by Google’s decision or because an NSL was issued to demand Google do that.
So, yes, as soon as you include this dependency, the entire browser has to be considered compromised, and you might as well just use Google Chrome.
This is a very strange conclusion that you present. I feel you are just twisting and turning to come to an unfavourable outcome here.
Even Google has decent data collection policies. They will not randomly make an application collect data without the developer opting in. We did not opt in. We are not including any sort of google analytics api key to enable anything.
In any case I have filed https://github.com/mozilla-mobile/focus-android/issues/1174
I’m not sure if you’re trying to intentionally ignore the issue here.
You are asking people to trust Google. If people trusted Google, they’d use Google Chrome in the first place. Your entire userbase is people that don’t trust Google, at all.
If you use Google proprietary software in Firefox, and tell people to just trust Google, you just entirely destroyed every value Firefox ever had, and your own job.
The whole purpose of Firefox is that I don’t have to trust Google. That I don’t even have any kind of interaction with Google. That I can exist without having to use Google’s technology.
If you use Google Analytics in Firefox’ Addon menu, or in Firefox Focus, and say "but Google doesn’t technically track people because we have a contract with them", then I can just as well use Chrome. If I trusted Google to keep their word, I’d use Chrome.
Chrome runs far faster, looks better, is easier usable, has better addon support, works with more websites because everyone only supports Chrome anymore, it actually supports 10 bit video, oh, and it even does hardware video decoding on Linux.
The entire reason anyone still uses Firefox is because they don’t trust Google. If you ask people to trust Google, you’re literally telling them to just use Google Chrome.
That is the elephant in the room that everyone at mozilla tries to ignore by putting Google Analytics into the addon menu of Firefox (and, as result, also in the Tor browser), and by importing a Google Analytics library into Firefox Focus. This destroys the one single value that Firefox has in the current world: It’s not Google.
> st3fan: Because that library is there does not mean that we are giving data to Google. It does not even mean that it is active or that it is sending anything.
Having gone through the comment chain in other places it seems like your entire position in the debate between you and st3fan is based on ignoring what he's actually saying in general. In response to their request for evidence your responded
>That's pretty simple. Don't use proprietary software.
which sidesteps the query entirely and does nothing to lend credibility to your original position.
I don't expect to change your mind and frankly I don't have a reason to, but if your goal is to have productive or persuasive conversations then you may want to evaluate your current communication strategy.
I thought Firefox Focus was a great step forward in privacy, but I am dismayed to see it includes Google code, that it uses a third party analytics library, and that the developers do not see either of those as a big problem.
I'd like to see some actual evidence that we can act upon rather than a strong unsubstantiated opinion. If we really leak anything than I will stand corrected and the team will fix that promptly.
That's the simple question you can act upon.
No proprietary software, and don't even think about doing any tracking until you have explicit opt-in.
I think you're being a little silly though.
people have minimal ownership of code and time they contributed. they should not allow people to screw the project over without being vocal.
its like someone invading your home, breaking everything, and people just telling you "if you don't like it just move elsewhere".
Firefox's about:config does not seem to work on FF Focus either.
There is no Google Analytics in Focus. Check the source code please to verify this.
Ergo, Focus uses com.google.android.gms:play-services-analytics.
Ergo, Focus talks to certain Google Services.
If you recursively import a proprietary binary, it still ends up in the resulting apk. I’ve checked the APK, the Google Analytics libary ends up in it, and it is not in any way sandboxed from the rest of the browser.
I can assure you that Adjust does not talk to google analytics behind our backs. It may have that option, but we did not configure it to use that functionality. What would it talk to, we did not configure an API key.
I will find out if we can remove this dependency to avoid confusion.
Filed https://github.com/mozilla-mobile/focus-android/issues/1174
(And for completeness, Adjust source code at https://github.com/adjust/android_sdk)
[1]: https://developers.google.com/cast/docs/android_sender_setup
It seems very likely that Firefox would be making use of GCM/FCM - I think most major apps do - so this could be it.
Incidentally, this same topics is one of the main controversies around the development of the Signal chat client - it uses GCM, which a good few prospective users object to on similar grounds.
Unfortunately, unless you've rooted your phone, GCM/FCM is the only battery-efficient way to provide push to Android phones.
But, and this is the interesting part, the userspace library of FCM can be easily reversed and cloned (the information required for that is here https://gist.github.com/justjanne/153bd4886f92be0ee57fb40842...), and the system-side part of FCM has been cloned in an open way (see the µG project).
Note: I should possibly have been clearer above by saying "is the only battery-efficient way to provide push to Android phones without root"
AFAIK f-droid always had a warning about firefox containing and promoting non free in addition of tracking users
from https://f-droid.org/wiki/page/org.mozilla.firefox :
This app has the NonFreeAdd Antifeature. This app has the Tracking Antifeature. This app has the UpstreamNonFree Antifeature.
The proprietary module (now long removed) is among the reasons the iceweasel project was born (not the debian one but the GNU one that has been renamed icecat when debian took over the iceweasel name).
It is a known fact that for years 90% or more of mozilla money came from google in exchange for making its search engine the default including tracking through an additional parameter in the URL.
There is waterfox a project to build a firefox version free of the mozilla tracking and crap: https://www.waterfoxproject.org/
Disabled Encrypted Media Extensions (EME)
Disabled Web Runtime (deprecated as of 2015)
Removed Pocket
Removed Telemetry
Removed data collection
Removed startup profiling
Allow running of all 64-Bit NPAPI plugins
Allow running of unsigned extensions
Removal of Sponsored Tiles on New Tab Page
Addition of Duplicate Tab option
Locale selector in about:preferences > General
There used to be a collection of privacy patches to remove all the tracking, leaking and privacy issues but I can't find it through web search, it seems to have been replaced by https://github.com/williex/firefox-privacy
Mozilla insist it is health report, analytics and telemetry which is marketing words for tracking and spying.
Do you have a reference for this? The Wiki page, and the project application, seem just to refer to a desire to avoid non-free plug-ins:
> ALL GNUzilla Programs will basically BE Mozilla Source Builds, with the major exception being the implementation of NO proprietary softwares, including plug-ins, according and adhereing to the GPL.
(http://savannah.gnu.org/task/?4529). That's certainly not inconsistent with what you said, but it seems a stretch to deduce what you said without some other reference.
No, it's not possible.
Mozilla employees and community members are very talented and capable people, but they are not capable for keeping a nefarious secret :) hehe
remember, you can check the source code. You can build your own version. Telemetry helps people. Telemetry helps Mozilla deliver better firefox. STOP SPREADING FUD.
The point is you cant have it both ways, both decrying tracking of users and then actively enaging in it, and agressively defending it when it comes to light.
You have to understand how extremely strict Mozilla is with using third-party services for things like crash reporting and telemetry. It is extremely difficult to find services that meet our very high standard for privacy.
AFAIK Focus and Adjust make no connections to google. Check the source?
The telemetry is documented in detail at https://github.com/mozilla-mobile/focus-android/wiki/Telemet...
We also include Adjust in Focus (not in Klar) for attribution tracking - to understand where the install came from. (This is useful if you are spending money on campaigns and you would like to understand what campaigns are the most effective)
If you have questions or suggestions, check the https://github.com/mozilla-mobile/focus-android/blob/master/... for ways to reach the team.
Recording users' behavior by default with informing the user clearly and giving him the option to opt-out is abhorrent, regardless of the benignity of the reason behind it.
Disclosure: I use firefox, but periodically strip all relevant hidden add-ons and disable all information sending possible.
> Recording users' behavior by default with informing the user clearly and giving him the option to opt-out is abhorrent, regardless of the benignity of the reason behind it.
(Even as a Firefox/Mozilla fan,) I completely agree that this behavior is what Mozilla should follow everywhere. I always choose to enable telemetry for Firefox because I want to help Mozilla and trust it. But defaults need to be sensible and protective of the user, first and foremost. If most people choose to turn it off on first run when asked for, then the actions to be taken would be educating users (in simple language) on the scope of data collection and improving the reputation of the organization/company behind it.
So, think about how much of a monopoly position Windows Phone 7 had, and try to imagine Apple had that. You can probably imagine why Apple is not in any shape to abuse their position.
> "For clients that have "send anonymous usage data" enabled Focus sends a "core" ping and an "event" ping to Mozilla's telemetry service. Sending telemetry can be disabled in the app's settings. Builds of "Focus for Android" have telemetry enabled by default ("opt-out") while builds of "Klar for Android" have telemetry disabled by default." [2]
[1]: https://f-droid.org/packages/org.mozilla.klar/
[2]: https://github.com/mozilla-mobile/focus-android/wiki/Telemet...
https://developers.google.com/analytics/devguides/collection...
[1] https://blogs.oracle.com/marketingcloud/email-marketing-clar...
[2] Lord of the Rings reference. Most apt description I can think of for the dread that comes at the mere thought of pissing off German regulators in this area.
Could be related to having a history of having to deal with mass surveillance, see stasi.
If that's not controversial, that's at least ironic.
(Just to clarify: this particular behavior was observed on a version from a Play Store, not FDroid. And this was about 1.5 months ago or so. But I doubt things had fundamentally changed since then.)
And if you feel statistics of time to FIRST_PAINT invades your privacy you can disable telemetry reporting.
You can also see what your browser collects in about:telemetry, but don't equate performance measurements with surveillance -- that's FUD.
It's about a certain promise^W marketing statement and behavior that at least partially contradicts it.
Since you've used the term "anonymised" quite pointedly, I'm guessing the latter. I do find it surprising that anyone would assume data Google is collecting on your usage is somehow anonymous.
EDIT: grammar
Apparently this is also true of applications & services you pay for these days too. Includes ISPs, cell companies, cable apps where you input your customer code, paid subscriptions to online news... the list is endless.
Now, people are rightfully suspicious of any software that phones home at all.
To me privacy is of vital importance, tracking is to be avoided at all cost, so this is as bad as it can be. But I'm now used to mozilla engaging in tracking, giving away my privacy to google for money and firefox developers punishing users and distros who disabled their included spying tool.