Slashdot Mirror
Mozilla's 'Privacy Not Included' Gift Report Highlights Security Concerns (wired.com)
Mozilla has released its second annual "Privacy Not Included" guide that rates 70 products to help give you an idea as to how secure or insecure they are. "We want to provide people information about how to make informed decisions when shopping for gifts that are connected to the internet," says Ashley Boyd, vice president of advocacy at Mozilla. "These products are becoming really popular. And in some cases, it's easy to forget that they're even connected to the internet." Wired reports: Among the important signifiers of a trustworthy stocking stuffer, according to Mozilla's rubric: the use of encryption, pushing automatic software security updates, strong password hygiene, a way to deal with vulnerabilities should they arise, and a privacy policy that doesn't take a PhD to parse. The most surprising result of Mozilla's testing may be how many products actually earned its seal of approval. Thirty-three of the 70 items in the "Privacy Not Included" guide passed muster; fans of the Nintendo Switch, Google Home, and Harry Potter Kano Coding Kit can sleep a little easier.
On the other end of the scale, Mozilla highlighted seven products that may not hit the mark -- yes, including the sous vide wand, the Anova Precision Cooker. Also scoring low marks in Mozilla's accounting: the DJI Spark Selfie Drone (no encryption, does not require users to change the default password), the Parrot Bebop 2 drone (no encryption, complex privacy policy), and unsurprisingly, at least one baby monitor. The remaining 30 items on the list all exist somewhere in the murky middle, usually because Mozilla was unable to confirm at least one attribute. Which may be the real takeaway from the report: Typically, you have no reasonable way to find out if a given internet-connected device is secure. "If you can't tell, that says that there's a problem of communication between manufacturers and consumers," says Boyd. "We would love for makers of these products to be more clear and more transparent about what they're doing and not doing. That's a big place we think change is needed."
On the other end of the scale, Mozilla highlighted seven products that may not hit the mark -- yes, including the sous vide wand, the Anova Precision Cooker. Also scoring low marks in Mozilla's accounting: the DJI Spark Selfie Drone (no encryption, does not require users to change the default password), the Parrot Bebop 2 drone (no encryption, complex privacy policy), and unsurprisingly, at least one baby monitor. The remaining 30 items on the list all exist somewhere in the murky middle, usually because Mozilla was unable to confirm at least one attribute. Which may be the real takeaway from the report: Typically, you have no reasonable way to find out if a given internet-connected device is secure. "If you can't tell, that says that there's a problem of communication between manufacturers and consumers," says Boyd. "We would love for makers of these products to be more clear and more transparent about what they're doing and not doing. That's a big place we think change is needed."
What does mozilla know of "privacy"? They're not even that good at their core business, "FOSS". Or what was the argument to include closed-source "pocket" and make it hard or impossible to install again?
Considering they don't honor hosts files blocking Facebook. Fuck Firefox, fake privacy bullshit. Fuck outta here!
Sure, nobody's perfect. But Mozilla clearly tries to work for the users not against. That makes them unique in their field(s).
I bought a DJI Spark last year. It does not need an active internet connection to fly. It also does not upload your flight records, photos, or videos to DJI's servers without manual intervention. The pictures/videos are stored on a standard MicroSD card. Mozilla is also incorrect in claiming it has a microphone - it does not (if it had one, all it would record would be the noise from the motors/propellers).
Yes, the drone doesn't require you to change the default WiFi password, but that's because a unique password is already printed on each drone. While people have hacked control of these things under laboratory conditions, the extremely short battery life (approximately 14 minutes of actual time in the air) means you'll have landed and be long gone before anyone could "hack" your drone. All of that is assuming a malicious actor even knows your drone is in the air in the first place. At 400' up, the Spark is incredibly hard to see and nearly inaudible.
The real reasons you wouldn't want to buy one of these things is that they're banned almost everywhere you'd really want to use one, and they're still kind of pricey for what is essentially a flying cell phone camera with extremely short battery life. As far as privacy risks go, again, it's a (flying) camera that geotags your photos/footage, which can lead to exactly the same privacy concerns as the camera which is already built into your smartphone.
---
DRM is like antifreeze, to the MPAA/RIAA it's sweet, to the consumers it's poison.
What a terrible web site. They only have photos of the items, no text descriptions of alt tags so you can't even identify some of them. And the good/bad icons are tiny and grey on white.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Actual link https://foundation.mozilla.org/en/privacynotincluded/
when I am trying to work on Mozilla, I am facing Linksys Login issue. I have visited https://routerguide.org/how-to... for solution, didn't get the satisfying solution. Can anyone tell me the best solution?
For what it's worth I highly recommend getting a Sous vide wand, online or otherwise.
Even if the term Sous vide is as goddamn idiotic as calling pan frying "sur le fer". A better name is "non gradient cooking" and it is fantastic.
While some might view that as a good thing, I see it as an unwanted invasion, and rather dangerous.
There are already stories posted about how "good" apps have turned "bad" when the ownership of an app changed hands, and the new owners pushed an "update" with a behaviour more beneficial to them.
And yes, although its always talking about "just security updates, we promiss" there is nothing stopping anyone from renegating on it, if the incentive (or stupidity) is large enough. [1]
In short, as long as the device is for my personal use I tend to disable *all* phoning home, no matter how beign it might look at that moment.
Ofcourse, it does not help that most "security" (or any other for that matter) updates are pushed without a good roll-back mechanism in place in case the change breaks something (including the customers usage of certain features). Or that those changes are seldom well documented (MS even *removed* such info). Or that they come in an all-or-nothing package.
[1] Further examples: FireFox with its "Mr Robot" advertising, MS pushing W7 updates forcing W10 to be installed, Philips "smart lamps" which regulary have updates that kick third party ones off. Phones which suddenly behave differently because of "must want" stuff like throttling to account for "old" (even though less than a year old) batteries. Etc, etc, etc.
Mozilla is full on SJW now as well. Fuck them.
On the Oregon Cost born and raised, On the beach is where I spent most of my days
...but why have I never heard of Mycroft before? That looks interesting.
Couldn't just link to the guide, could you? 25,000 thumbs down
Maybe instead of criticizing others they should concentrate on their massive market share loss and why they are at 5.02% when they were once around 30%?
Firefox turned to junk after whatever came next from FF 52.
It's a bad scenario if the person cooking my food thinks that overcooking is the worst-case scenario.
Legionnaires' disease
Lots of sous-vide recipes specify less than 140 degrees F. This is already in the wheel house of one strain of bacteria, with a 10% human fatality rate once contracted.
This is why sous-vide cookers go the extra mile to ensure precise thermal regulation.
Not too many bacteria in food will actually kill you (yet) if only undercooked by a small amount. But as they say in antibiotics and cipher breaking, your adversary's attacks and defenses only ever improve.
Interesting bits on the website: Privacy policy reading level and letting people vote on creepiness/will I buy one.
I think this is a decent first stab at rating products - I'm sure with some feedback they will make it better.
If we could get to a point where there's a standard that you must meet before getting some sticker on the side of the box, that would be a big help for people when purchasing products.
On top of that, Mozilla Foundation doesn't understand why javascript (ecmascript) should be an interpreted language and instead they compile javascript strait to exploitable machine code for performance. (Like everyone else, Chrome / Google do the same thing and that's pretty much the whole browser market right there.)
Mozilla is not who I'd be taking security advice from.
Erm, as others pointed out, mozilla is a non-profit organisation which does more than just create the Firefox browser.
And yes, Firefox does absolutely obey the hosts file, that's how I'm blocking countless google spyware.
Perhaps you're mistaking Firefox with Windows 10?
With regards to privacy, they do what they can to the extent possible without getting under the skin of their funders, thus the reason for including 'tracking blocker' by default. i.e. you can't cut the hand that feeds you!
Who else will donate money - you?!
Firefox is the only browser of hope left!
If they didn't go down the route of compiling JS code, most people wouldn't be using Firefox as their browser in this day and age!
Don't blame Mozilla/Firefox for the problems caused by hipster web devs creating a new damned JS framework every month which manages to consume twice the processing power and cause massive browser bloat!
I don't use Windows. Are you sure you're actually blocking the Google stuff? I had both Facebook and Doubleclick blocked in my hosts, but when I tried switching to Firefox suddenly Facebook isn't blocked and Doubleclick ads are everywhere. I thought they must be using domains, but when I went to add them to the hosts I realized they were already in there! I tried all the "about:config" options that come up when you search for solutions to this egregious security failing, but it did not work. Can't trust it; only option was to uninistall.
I will not use a Chrome-based browser because of Google, so this rules out Chrome, Vivaldi, even Chromium, Brave. All of them call home to Google for at the very least safe browsing. Firefox is now a bloated mess on Linux and worse on Windows. I may just start using uzbl-tabbed. I already run a Pi-hole, so I'm blocking heaps of beacons, trackers, and ads at the DNS level, which makes life on a network livable. If I go uzbl, I'll have to tweak my hosts file in Arch to do a few things.
Yes, this whole Mozilla effort, as useful and important as it could have been, falls completely flat for me. The parent's observation makes this site a prime example of mystery meat; and webpagesthatsuck.com has been documenting such bad web design for many years. One of the responses suggests trying to click on the product photos; that's just yet more click-bait design. The best I could do was to enable "display URL on hover" in my favorite browser, and hope that the URLs were at least somewhat self-identifying. Given the site's target audience, that's not helpful.
And now about the reviews themselves. Mozilla's "minimum security standards" bar seems pretty darned low. Just look at all of their "thumbs-up" products that on further inspection say "Yes" to the all-important factor "Shares your information with 3rd parties for unexpected reasons". In fact many "thumbs-up" reviews have 2 out of 3 sad faces in the "What does it know about me" category. How is the target audience supposed to have any confidence in these reviews?
And though there are some tablets in the list, where are the smartphones?
Hah! Yet another meaningless title for a 'useless human'. Mozilla should fire all the useless humans, & get back into the web browser business.
Humms, sadly, you're right... Firefox isn't blocking domains based on hosts file :/
I'm using OpenDNS for blocking various domains too, so didn't notice.
Just checked and it appears both IE11 as well as latest Google's Chrome browser are honouring the hosts file.
Shocking.