Hacker News Reader

Comment by dsff56 | Hacker News Reader

I stopped using firefox since they are delivering cliqz with every 100th download which will analyze and store your browsing history and is a shame for the mozilla foundation. I'm using waterfox now btw...

View on HN

This threw me off, I really didn't expect Mozilla to bundle in something like this.

However, here's the info, straight from the source: https://blog.mozilla.org/press-uk/2017/10/06/testing-cliqz-i...

Looks like < 1% of installs in Germany will get this preinstalled. Here's how to remove if you're one of the unlucky ones: https://support.mozilla.org/en-US/kb/cliqz-recommendations-f...

Finally, Cliqz has a Firefox Test Pilot program (German-only): https://testpilot.firefox.com/experiments/cliqz

It’s opt-out as well. I wonder if this is actually legal in Germany, they have pretty strict laws.

I'm shocked; how is this at all consistent with Mozilla's principles? Situations like this one damage trust; what else is going on that I didn't happen to stumble across? From the announcement:

Users who receive a version of Firefox with Cliqz will have their browsing activity sent to Cliqz servers, including the URLs of pages they visit. Cliqz uses several techniques to attempt to remove sensitive information from this browsing data before it is sent from Firefox. Cliqz does not build browsing profiles for individual users and discards the user’s IP address once the data is collected. Cliqz’s code is available for public review and a description of these techniques can be found here.

And it's opt-out; it's not clear if the users receive an opt-out notification:

Users will receive a version of Firefox with Cliqz recommendations enabled out of the box.

https://blog.mozilla.org/press-uk/2017/10/06/testing-cliqz-i...

I thought this guy was nuts but he's correct: https://blog.mozilla.org/press-uk/2017/10/06/testing-cliqz-i...

But at least Mozilla is up front and transparent about what it's doing. I'd love to know the extent of what Google/Chrome is doing...

> Mozilla is up front and transparent about what it's doing

A statement in a blog that only a tiny percentage of users will read is not at all transparent.

Do users who receive browsers with Cliqz get a clear, effective opt-out warning? Really, it should be opt-in but that doesn't appear to be the case:

The users will receive a version of Firefox with Cliqz recommendations enabled out of the box.

https://blog.mozilla.org/press-uk/2017/10/06/testing-cliqz-i...

> Do users who receive browsers with Cliqz get a clear, effective opt-out warning? Really, it should be opt-in

Either way would render the experiment useless (self-selection bias). Obviously if something like this should make it into Firefox proper, that would make something like an opt-out warning a hard requirement.

Either way would render the experiment useless (self-selection bias).

But that is Mozilla's problem, not their users'.

As probably would be the legal position in many places, if news of this got out more widely and regulators started getting involved. It's hard to see how this wouldn't fall foul of even general EU data protection laws today, never mind anything stronger that is specific to Germany.

> But that is Mozilla's problem, not their users'.

Sure, I'm just telling you how we arrived at the current situation and why your proposed alternative is a nonstarter for an experiment that tries to figure out if this feature adds user value in the first place.

If the warning is a hard requirement after the experiment, running an experiment without the opt-out warning biases your results. Having the warning in the experiment gives you a better picture of what happens to users when you present them the option.

Except that the question that the experiment wants to answer isn't what happens when you present users with the option. That would only become relevant later. The question right now is whether Cliqz' address bar autocomplete results are superior to the status quo.

It would have to be opt-in or the user would have to be clearly informed, if it actually collected personally identifiable information. That's German law. But it doesn't.

They're doing more or less what Mozilla is doing: spyware.

> at least Mozilla is up front and transparent about what it's doing

I read HN, I'm a web dev, I try and keep up to date with this kind of thing and I've never heard of it. How is any non techie supposed to?

It will not store "your browsing history". It will store the webpages that you've browsed to, without identifying information about you associated with it and the entries will be intermixed with all other users' browsing history entries, so it's not going to be possible to identify you.

I find the Cliqz issue horrifying and am considering Waterfox for similar reasons, but I have to point out that "every 100th download" is a gross misrepresentation - it's an experiment to be tried in "<1% of German users of Firefox" (which is still bad, but a very different thing from every 100th download). According to [this comment](https://www.reddit.com/r/firefox/comments/74n0b2/mozilla_shi...), "the experiment can be removed like any addon."

I still find this a very bad sign about the directions they're willing to explore, but it's important to get the accurate scale of the thing.

One step forward two steps backwards. Why does every large organization on the internet have to be a shithead in 2017. Mozilla - no amount of sanitization will prevent shitty websites sending sensitive data in URLs therefore you don't include this in your product. Even if you obtain consent - because it isn't in your users best interest to have this enabled. I'm extremely disappointed.

This should be it's own story. Wow, really disappointing. The European GDPR can't come soon enough.

Reply on news.ycombinator.com