this post was submitted on 09 Jan 2024

70 points (96.1% liked)

Privacy

32003 readers

732 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
Don't promote proprietary software
Try to keep things on topic
If you have a question, please try searching for previous discussions, maybe it has already been answered
Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
Be nice :)

Related communities

Chat rooms

[Matrix/Element]Dead
Discord

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago

MODERATORS

How good/bad is Firefox sync. (programming.dev)

submitted 10 months ago by itsaj26744@programming.dev to c/privacy@lemmy.ml

39 comments fedilink hide all child comments

Basically I am using mull on android and librewolf on linux.I want to use firefox sync or something line that for syncing.So how good Firefox sync is, in privacy point on view. I am not anonymity paranoid I just want privacy so basically what do they collect and for what?

all 43 comments

sorted by: hot top controversial new old

[–] LWD@lemm.ee 40 points 10 months ago* (last edited 10 months ago) (1 children)

deleted

[–] itsaj26744@programming.dev 11 points 10 months ago

Thanks, Looks like gonna use it

[–] lemann@lemmy.dbzer0.com 27 points 10 months ago (3 children)

Basically I am using mull on android and librewolf on linux

You may prefer to skip Mozilla entirely and self host your own Firefox Sync: https://github.com/mozilla-services/syncstorage-rs

Otherwise, i've been using Firefox Sync for years and haven't had a single issue with it.

Regarding data sharing, do note that your Firefox Account email address is shared with Troy Hunt (haveibeenpwned) via the Firefox Monitor service, so Firefox can warn you if you have suffered a data breach. Deleting your account is the only way to opt out of that. https://support.mozilla.org/en-US/kb/how-do-i-opt-out-firefox-monitor

I personally have no issue with it as he's a well known security consultant - BUT the caveat being that he's a Microsoft regional director, you couldn't know if that data is being shared any further.

[–] kratoz29@lemm.ee 7 points 10 months ago

You may prefer to skip Mozilla entirely and self host your own Firefox Sync: https://github.com/mozilla-services/syncstorage-rs

Bruh, I didn't know about this, I swear we can self host almost anything, can we self host the Internet?

[–] MonkderZweite@feddit.ch 3 points 10 months ago* (last edited 10 months ago)

As far as i know it's barely possible to really host it yourself. I don't know the details anymore but i looked into it half a year ago and quickly gave up. Think it was severely outdated and depedency issues, not sure anymore.

[–] shortwavesurfer@lemmy.zip 15 points 10 months ago (1 children)

I use it for bookmarks, but that's it. All my passwords and stuff are in my password manager, and I do not trust browsers with that data.

[–] itsaj26744@programming.dev 4 points 10 months ago

Ya I use bitwarden, was asking about data collection.

[–] azdle@news.idlestate.org 9 points 10 months ago* (last edited 10 months ago) (1 children)

As others have said, it's quite good on privacy. For the truly paranoid, IIRC you can even self-host the sync server.

From the security perspective of privacy, do make sure to use a good password for the Mozilla account, the account password is also the encryption key for the E2E encryption.

[–] Matt@lemdro.id 8 points 10 months ago (2 children)

Firefox Sync is end-to-end encrypted and open source, so your data is secure.

[–] Zerush@lemmy.ml 4 points 10 months ago* (last edited 10 months ago) (1 children)

Your syc data is secure, yes, but not so your account data, because is also known by Google, amon yor IP other. Enough to track you through every page with Google APIs (most) also your email, whichi is an unique identificator in the web. Don't trust any web or service which share data to third parties, less in US webs or services. This is one of the reason because I always prefer EU soft, webs and services. They are also not perfect respect privacy, but lightyears better as those from US companies, where something like privacy laws, GDPR and user protection don't exist or only in very deficient manner.

[–] digdilem@lemmy.ml 2 points 10 months ago* (last edited 10 months ago)

Technical point: US companies still need to abide by the GDPR when the user is in the EU or UK.

(But yes, I accept your main point - that protection is not shared to US citizens of those same companies who operate two very different levels of distinction. European originating software/services usually operate at the higher level of protection across all users. )

[–] itsaj26744@programming.dev 2 points 10 months ago

Private? And do they track lot of things If I sign in ?

[–] Zerush@lemmy.ml 5 points 10 months ago (1 children)

All companies that have to pay for infrastructure, servers, employees and invoices naturally need income, as is logical and legitimate. Some use contextual ads, that is, tool ads on a DIY page. This may be annoying, but it does not put privacy at risk, but if it does, when the ads are based on the user's history and data (surveillance advertising), this is what is massively used by US companies.

That there are other models to create income, for example what Proton does, with its Freemium services. The free Proton products (all of which are OpenSource, by the way), naturally have limited functions, but they do not require trafficking in user data, because they are financed through Premium services.

Andisearch, the first search engine on the market that used AI with its own language model, is strictly anonymous, no tracking or logging with sandboxed results, it is 100% free and private, for the future they plan to create a premium model for companies with specific functions for collaboration and special business functionalities, to finance the free version.

Vivaldi in new installations offers a selection of search engines (DDG, Ecosia, Startpage, etc.) and bookmarks, which pay a commission when the user uses them, if not, no, they are free to delete them, apart from a store with merch, upon insistence. from the users themselves sometime ago they also accept donations, probably also receive commissions from VAG, Mercedes, Polestar and Renault to include Vivaldi Automotive in their vehicles. All without trafficking in user data and without external investors so as not to lose independence, the mistake that Mozillla made when accepting Google as an investor. This is independent of having Google as the default search engine, since Google pays Mozilla and finances them, whether the user searches with Google or not.

It's the surveillance policy, selling user data, which is the risk and will destroy the free internet if we don't avoid it The ethics of a company respect to the user is the most important feature today, something that the big US companies don't have.

[–] XTornado@lemmy.ml 5 points 10 months ago

Man... Don't reply if you don't have an answer no need to put a dump of text.

[–] MonkderZweite@feddit.ch 3 points 10 months ago (1 children)

It doesn't sync addons and about:config, so there's that.

[–] LWD@lemm.ee 11 points 10 months ago* (last edited 10 months ago) (1 children)

deleted

[–] MonkderZweite@feddit.ch 2 points 10 months ago (1 children)

Man, and it's only half a year back i looked this stuff up...

[–] LWD@lemm.ee 3 points 10 months ago* (last edited 10 months ago)

deleted

[–] Dehydrated@lemmy.world 2 points 10 months ago

mull on android and librewolf on linux

Great setup btw

Regarding your question: Firefox Sync is end to end encrypted, so you don't have to worry about it. It's far better than Google's browser sync, as it's encrypted at all (only in transit, but this is standard and it means that Google can still see all of your data)

[–] Ephera@lemmy.ml 1 points 10 months ago

You can find a detailed description about Firefox Sync's design in regards to privacy here: https://hacks.mozilla.org/2018/11/firefox-sync-privacy/

[+] Zerush@lemmy.ml -7 points 10 months ago (2 children)

As long as Mozilla has a contract with Google, it will continue to share data with Alphabet Inc. Firefox or forks are OK, but only if you use it without the sync function, or use another provider that doesn't share the data with others. Although Mozilla encrypts the synced data, the necessary account data is shared and used by Google to track those.

[–] utopiah@lemmy.ml 7 points 10 months ago (1 children)

Are you saying Firefox shares data to Alphabet beyond Google as the default search engine? If so and if it applies to Sync (as if the question from OP here) can you please share sources for that?

[–] Zerush@lemmy.ml 2 points 10 months ago (2 children)

Firefox don't share data, well, if you don't use the default Google search, but Mozilla does, sharing your account data. I hope that they finish the contract with Google, as they said, this Year.

Webkoll analytics

Blacklight analytics

[–] rhymepurple@lemmy.ml 4 points 10 months ago (1 children)

I'm not disputing the results, but this appears to be checking calls made by Firefox's website (https://www.mozilla.org/en-US/Firefox/) and not Firefox, the web browser application. Just because an application's website uses Google Analytics does not mean that the application shares user data with Google.

[–] Zerush@lemmy.ml -2 points 10 months ago (1 children)

What do you think what googleanalytics and googletagmanager do and who logs this datas? Only Mozilla? And yes, as said before, Firefox is OK, but not so with an Mozilla account, with which Google said "come to Daddy". I hope that Mozilla, as promised, can end this year the contract with Google.

[–] rhymepurple@lemmy.ml 7 points 10 months ago (1 children)

I don't understand what point you are trying to make. Mozilla has several privacy policies that cover its various products and services which all seem to follow Mozilla's Privacy Principles and Mozilla's overarching Privacy Policy. Mozilla also has documentation regarding data collection.

The analytics trackers that you mentioned would fall under Mozilla's Websites Privacy Policy, which does state that it uses Google Analytics and can be easily verified a number of ways such as the services you previously listed.

However, Firefox sync uses https://accounts.firefox.com/ which has its own Privacy Policy. There is some confusion around "Firefox Accounts" as it was rebranded to "Mozilla Accounts", which again has its own Privacy Policy. There is no indication that data covered by those policies are shared with Google. If Google Analytics trackers on Mozilla's website are still a concern for these services, you can verify that the Firefox Accounts and Mozilla Accounts URLs do not contain any Google Analytics trackers.

Firefox has a Privacy Policy as well. Firefox's Privacy Policy has sections for both Mozilla Accounts and Sync. Neither of which indicate that data is shared with Google. Additionally, the data stored via the Sync service is encrypted. However, there is some telemetry data that Mozilla collects regarding Sync and more information about it can be found on Mozilla's documentation about telemetry for Sync.

The only thing that I could find about Firefox, Sync, or Firefox Accounts/Mozilla Accounts sharing data with Google was for location services within Firefox. While it would be nice for Firefox not to use Google's geolocation services, it is a reasonable concession and can be disabled.

Mozilla is most definitely not a perfect company, even when it comes to privacy. Even Firefox has been caught with some privacy issues relatively recently with the unique installation ID.

Again, I'm not saying that Mozilla is doing nothing wrong. I am saying that your "evidence" that Mozilla is sharing Firefox, Sync, or Firefox Accounts/Mozilla Accounts data with Google because of Google Analytics trackers on some of Mozilla's websites is coincidental at best. Without additional evidence, it is misleading or flat out wrong.

[–] Zerush@lemmy.ml -1 points 10 months ago (1 children)

Don't get me wrong, Mozilla does a lot for user privacy and is certainly one of the most reliable alternatives for a user among the existing browsers. I'm just seeing that Mozilla has unfortunately made a contract with the Devil that prevents it from having the full freedom of protection that it would like. Mozilla deserves the independence of this company, which, at the moment, it does not have, which is why I said that I wish it could end this contract.

I use several browsers, but the list of existing ones with certain capabilities and functionalities is getting small.

Edge is technically a good browser, but certainly not recommended for those who appreciate privacy,
Chrome users could ask Google to write their resume directly,
Opera is perhaps the worst, using trackers that distribute your data to half the internet,
Safari It is not much better either and it is also becoming the new IE with its desire to stay with an engine that is becoming obsolete,
Brave is unreliable due to its business with shady crypto companies and the intentional redirections to them and excluding investors from the protections against trackers, Facebook among them,
Otter is an alternative, but fighting for its survival, which makes it not very reliable in the long term,
the same with some Gecko and Chromium marginal forks, which either lack sufficient equipment for sufficient maintenance, They are directly outdated or lack a consistent support community, - Mullvad browser is very private, yes, but it completely lacks the minimum functions for customization or modification, practically a Firefox left in its bones with 4 sections in the settings.
SSuite Netsurf, very fast and beautiful, but not very configurable, it does not even allow you to change the Groot search engine, which on the other hand is good and private, it also does not have extensions, only an Adblocker that it incorporates and it is also only for Windows, the only plus its extraordinary speed and that it works even on very old Windows (>XP) with few resources.

Well, there's not much left, Firefox, Vivaldi, maybe Otter (if you want speed) and Mullvad, to choose from. The big companies are really destroying a free internet in their greed to control everything and using the user as raw material and merchandise for this. Tough times if we don't manage to stop them. More than 70 browsers have already fallen by the wayside, discontinued and abandoned in this "browser war"

[–] rhymepurple@lemmy.ml 2 points 10 months ago* (last edited 10 months ago) (1 children)

I'm still not sure what point you are trying to make. Your initial claim was:

Although Mozilla encrypts the synced data, the necessary account data is shared and used by Google to track those.

@utopiah@lemmy.ml asked:

Are you saying Firefox shares data to Alphabet beyond Google as the default search engine? If so and if it applies to Sync (as if the question from OP here) can you please share sources for that?

You stated:

Mozilla does, sharing your account data

You also provided evidence that Mozilla uses Google Analytics trackers on the Firefox's product information website. I mentioned that it's not sufficient evidence of your claim as the trackers are independent of Firefox the browser and Sync. Additionally, the use of trackers for websites is clearly identified on Mozilla's Privacy Policies and there is not much else mentioned on the Privacy Policies outside of those trackers and Google's geolocation services in Firefox.

You've also mentioned Google's contract with Mozilla, which is controversial for many people, but isn't evidence of Mozilla providing user data to Google even in conjunction with the previously mentioned trackers. You then discussed various other browsers, but I'm not sure how that is relevant to your initial claim.

While it seems we can both agree that Mozilla and it's products are far from perfect, it is looking like your initial claim was baseless as you have yet to provide any evidence of your initial claim. Do you have any evidence through things like code reviews or packet inspections of Firefox or Sync that hints Mozilla is sharing additional information to Google? At this point, I would even accept a user(s) providing evidence of some weird behavior like the recent issue where google.com wouldn't load in Firefox on Android if someone could find a way to connect the weird behavior to Mozilla sharing data with Google.

[–] utopiah@lemmy.ml 1 points 10 months ago

Indeed, thanks for the mention because I wanted to go back on this. I wouldn't quality any of this as evidence of Sync sharing usage data. Everything else is still correct, i.e defaulting to Google as search engine, some analytics, etc but it's still unrelated to Sync. I don't see how other browsers are relevant. It looks like they and OP are trying to show that Mozilla is not perfect, that they make money and share some private data and thus assume that any data used on any Mozilla product is shared with 3rd parties, including Alphabet, without providing any evidence for that. I'm not sure arguing more will help.

[–] Ephera@lemmy.ml 3 points 10 months ago

Mozilla pays for a premium subscription to Google Analytics, which allows them to opt out of data usage by Google. So, obviously Google still aggregates the data, but only for providing reports to Mozilla. Google may not use the data for their own user analysis/tracking, as they would do without the premium subscription. Otherwise, Google would be in breach of contract, which would be an easy lawsuit with high punishment for Google.

https://bugzilla.mozilla.org/show_bug.cgi?id=697436#c14

[–] itsaj26744@programming.dev 0 points 10 months ago (1 children)

Dont know why so many dislikes for truth.

[–] Ephera@lemmy.ml 3 points 10 months ago (1 children)

Because it's not true. Account data is not shared with Google.

[–] itsaj26744@programming.dev 0 points 10 months ago

Ohh, And other tracking infos?