Slashdot Mirror
Firefox 59 Will Stop Websites Snooping on Where You've Just Been (zdnet.com)
Firefox 59 will reduce how much information websites pass on about visitors in an attempt to improve privacy for users of its private browsing mode. From a report: When you click a link in your browser to navigate to a new site, the site you go on to visit receives the address of the site you came from, via the so-called "referrer value." While this helps websites understand where visitors are coming from, it can also leak data about the individual browsing, because it tells the site the exact page you were looking at when you clicked the link, said Mozilla. Browsers also send a referrer value when requesting other details like ads, or other social media snippets integrated in a modern website, which means these embedded content features also know exactly what page you're visiting.
The headline implies this change will prevent sites from knowing what site you linked from. That's incorrect. From the article:
To prevent this type of data leakage, from Firefox 59, the private browsing option will remove path information from referrer values sent to third parties, effectively stripping out additional data and only leaving the web domain.
If you RTFA (I know, I know; I must be new around here), you'll see this is only for Private Mode, and leaves the domain portion intact. You can still see if they loaded from your domain.
This will ruin my fun of constantly going to pornhub then moving right to the Christian Coalition site to fill their logs up with porn referrals
Sent from my TARDIS
Meh, in private browsing mode they really should kill the referrer from any top level page. If it's an <img>, <iframe> or <video> tag it's cool... but if I go from foo.com to bar.com via an <a href> it shouldn't secretly tell bar.com I came from foo.com. Transparency in what information you're exposing is essential to security and most people aren't aware it's happening.
Live today, because you never know what tomorrow brings
You probably meant interstitial, as inter-terrestrial could be somewhat delayed.
Every time I look at a post like this, I wonder when Slashdot will get with the times and support unicode?
Jumpstart the tartan drive.
I'm glad they haven't. There's very little real use for it, and those messed-up comments give useful information for judging clueless commenters.
Unlike many people, I've actually read Firefox's privacy policy.
It turns out that Firefox's privacy policy is quite disturbing, especially when considering how often we're told that Firefox supposedly "cares" about our privacy.
The Firefox privacy policy dated September 28, 2017 makes it clear that Firefox user data can be collected by Firefox and can be sent to various third parties, including Google, some "Adjust" company, some "Leanplum" company, and SalesForce.
For example, there are very worrying sections like (emphasis has been added):
and:
and:
and:
and:
Some people will foolishly claim that privacy violations like these are "acceptable" because they can supposedly be "disabled".
No, they're not acceptable at all!
Intrusive data collection/transmission like this shouldn't have to be disabled; the code implementing this data collection and transmission shouldn't even exist in the first place! There should be nothing to disable because Firefox should not be able to collect this data, and it should not be able to transmit it anywhere.
Reading Firefox's privacy policy has made me very distrustful of Firefox and Mozilla, and especially of the people who wrongly claim that Firefox somehow "respects its users' privacy".
You beat me to the reply. According to the horse itself, this is in fact precisely what they are doing:
Starting with Firefox 59, Private Browsing will remove path information from referrer values sent to third parties (i.e. technically, setting a Referrer Policy of strict-origin-when-cross-origin).
I agree that it should be the default, and (I discovered today), you can set it be in Firefox's about:config by setting network.http.referer.userControlPolicy to 2.
The fact that mozilla tried to really list all the data that it takes and where to send it is good and your post looks like scary, but all of those items have a reasons:
> Google’s SafeBrowsing service
duh! if you want to know if the site/file is in a blacklist, you do need to sent it to some place to be checked. It can be disabled, but of course most people want this enabled
>Location data to Google's geolocation service
duh again, if you see a pop-up from firefox asking that the site wants to see your location, if you press "allow", your IP is sent to some place to map the IP to a location... you can press "not allow" and you will not share anything
>On iOS and Android: Firefox by default sends mobile campaign data to Adjust, our analytics vendor
"Adjust" tracks firefox installs and usage platforms, so firefox can see what works and not works (tables vs cheap phones vs expensive phones, or country, or mobile OS preference)... it is not for tracking what people do online.
Yes, that "Google advertising ID" is scary, but thats the way tracking in mobile works, specially if related with other marking campaigns... and this is for mozilla data analyzes, not to be shared to google. Think this as a newrelic, but instead of performance and errors, place mozilla campaign Id, so they know what campaign pays the most and where/in what devices
>On iOS and Android: Firefox by default sends data about what features you use in Firefox to Leanplum, our mobile marketing vendor, ... again, not for tracking you, but to track features usage or lack of usage
"Leanplum" looks its like Adjust/Newrelic, but for the internal firefox features. probably tells how many people uses webgl, pocket, add-ons, movies, audio, so they can understand better how differently people uses the mobile vs the desktop
>Your email address is sent to our email vendor, SalesForce Marketing Cloud,
"SalesForce Marketing Cloud" is their email provider for the marketing and email announcements... so it basically sends email... and yes, any email server will see your email! most companies do not even list this in their "privacy policy"... because its is the way email works! If you disable email notifications, they probably do not even share your email with then.
All this telemetry is there to help mozilla develop the browser, not to track you. Without it, how they would know if people use many tabs or few tabs? if after releasing a new feature, the memory usage increased everywhere and that they should try to track some leak? if people still use flash and how important is is (ads or the full site in flash). All those "privacy problems" you listed are really needed
When one reads the privacy policy, ones needs to try to understand how and why it is used, not simply cry "wolf" and start spreading FUD
Higuita