> and Cloudflare can gather them from DNS
but is contractually forbidden from saving that information.
> What happens if they get a FISA warrant?
They have to follow the law? Wrong threat model.
You are not permitted to hand-wave corrupt government interception or rubberhosing of civilian data as "wrong threat model." These technologies are central to, and must be focused specifically on, protecting all civilian data from all governments. That is the primary purpose of all privacy systems. Not to protect you from coffee-shop denizens trying to snoop which dating sites you use.
If it's one of the large monopoly providers, it's as much a one-stop-shop as Cloudfront is.
Though outside the US, the NSA doesn't require a FISA warrant to intercept data, nor does it face any US legal restrictions on doing so.
At least from a general perspective I don't see a big difference.
> And there’s no logging.
Until the courts say there must be.
I used to work at an ISP.
We configured (wrote policy language for) our DPI platforms to do header inspection of all HTTPS traffic to measure customer experience to different websites, to improve the customer experience.
The raw data was (theoretically) accessible to ~4 people and deleted as soon as ETL had succeeded, and the anonymised results (aggregated only by region, product etc.) were available to the operations team (another ~8) and product management (~4).
This complies with our countries personal information regulations.
Mozilla proponents seem to be quite anti-ISP.
Why is that?
>> What happens if they get a FISA warrant?
> They have to follow the law? Wrong threat model.
If this happens for non-US citizens, this is violation of privacy laws of the affected user.
If this is rolled out, I will either ensure my distro switches this off by default, or have to consider changing browsers (away from Firefox).