from Hacker News

When it comes to privacy, default settings matter

by nachtigall on 6/4/19, 3:23 PM with 127 comments

  • by dantiberian on 6/4/19, 5:57 PM

    Mozilla didn't mention this in the article, but the study they referenced had an astounding statistic proving their point about default settings.

    > Chrome and Safari are the two most prevalent browsers in our data, with Chrome being associated to about 43% of the ad transactions and Safari to about 38%. About 73% of the ads shown on a Safari browser do not have a cookie associated, whereas on Chrome this is the case about 17% of the time.

    > The difference is probably due to different default tracking settings across the two browsers, with Safari impeding, by default, third-party tracking cookies being set on the user’s machine (the user has to explicitly allow the usage of third-party cookies)

    https://weis2019.econinfosec.org/wp-content/uploads/sites/6/...

  • by cromwellian on 6/4/19, 10:23 PM

    [Googler, but this is just my own musing] Here's a theoretical question, if all third party tracking cookies were blocked, wouldn't that strengthen Google's position in the ad market and weaken all of the third party ad networks?

    Google gets most of it's revenue (~70%) from it's first party sites, and stuff like AdSense could be made to work without cookies, and given Google's size in the market, people would switch to whatever ad embedding format they required.

    But smaller ad networks won't have that power, and don't have huge first party sites either. So in a way, if Google jumps onboard this bandwagon in Chrome, they could be accused of doing it to strengthen their own position, the same way adopting Apple's extension/ad blocking restrictions in Chrome, led people to accuse them they're trying to sabotage ad blockers, instead of trying to reign in a toxic hell stew malware from overly permissive extensions.

  • by Tepix on 6/4/19, 4:30 PM

    This step is overdue and i applaud Mozilla for doing it. But:

    Why doesn‘t Firefox block all 3rd party cookies by default? That would be a huge win for privacy. Yes, some sites would break. But if Apple can do it with Safari, Mozilla can do it with Firefox.

    Be brave! Do it!

  • by stemuk on 6/4/19, 5:05 PM

    When it comes to the greater public, default settings might as well be the only available setting. Apart from a few 'techies' most people will never even touch the default settings out of the naive belief that "the default setting is what's best for me".

    As an alternative approach I would suggest empty settings to begin with, forcing the user to think about their preferences on first use.

  • by rolph on 6/4/19, 4:44 PM

    "Today marks an important milestone in the history of Firefox and the web. As of today, for NEW USERS who download and install Firefox for the FIRST TIME, Enhanced Tracking Protection will automatically be set on by default, protecting our users from the pervasive tracking and collection of personal data by ad networks and tech companies."

    this gives me the impression that Mozilla is trying to pull in a bunch of new recruits, also does this mean upgrades or repetitive DLs will not have this ~privacy by default?

  • by sciurus on 6/4/19, 5:25 PM

    There's some discussion of how this ties into Mozilla's mission at https://blog.mozilla.org/blog/2019/06/04/the-web-the-world-n...
  • by basscomm on 6/4/19, 4:56 PM

    > In fact, nearly 25% of web page loads in Firefox take place in a Private Browsing window.

    If Mozilla knows that, then Private Browsing Mode isn't as private as it could be.

  • by blitmap on 6/4/19, 6:49 PM

    The thing that absolutely pisses me off is how I try to be actively aware of what settings I disagree with and disable things I don't like - and then an unseen update resets things to default.

    HOW MANY TIMES MUST I UNCHECK WHAT TO SYNC TO MY ACCOUNT? YOU WOULD THINK THAT IS SAVED PERSISTENTLY.

    I think my qualify of life on Firefox would be improved greatly if a notice popped up saying some of my settings were reset to defaults because of breaking changes (or minor). Like they give a crap.

  • by AsusFan on 6/4/19, 5:05 PM

    The irony is strong with this one.

    By default, Firefox:

    - Collects a bunch of telemetry data via several mechanisms and ships them to Mozilla HQ

    - Provides Mozilla with remote code execution privileges on your machine via the shield (or normandy, or whatever they are calling it these days) mechanism, which can install and uninstall extensions and certificates, change browser settings, etc

    - Uses Google as the default search engine, and search suggestions leak private data to Google

    - Uses Google Location Services for their geolocation thingy, which - unsurprisingly - phones home to Google

    - Ships closed source third party add-ons

    - Comes with a bunch of "about:config" settings configured in sub-optimal ways, privacy wise - battery API enabled by default, accept all cookies by default and so on

    Sure, Chrome is worse, but bringing that up that is like arguing that your pile of manure is better because it doesn't smell as bad: in the end, you are still arguing about shit.

  • by lotu on 6/4/19, 9:26 PM

    WARNING advertising SWE insider

    I don't like how the opening line of article exploits the fact the average person does not know cost of average online ad to make it appear like tracking has basically no value.

    >... data about you was transmitted to dozens or even hundreds of companies, all so that the website could earn an additional $0.00008 per ad.

    For the reader to be able to accurately understand how much money this is they need to know the percentages.

    Very roughly (this varies widely based on the country and websitem) the average online ad only costs ~$0.0005, so that insignificant $0.00008 is around 10-20%. If the article had presented the exact same information but instead framed it in the form of revenue available to pay employees at an online company dependent on advertising, this would sound very different while really conveying the same concept.

    Edit: I read the linked study and the data they used had an average cost per add of $0.001 putting the difference around 4%. This is smaller than I would have predicted. I would still rather they have lead with this number.

  • by anordal on 6/5/19, 7:15 AM

    When it comes to everything, default settings matter.
  • by Despegar on 6/4/19, 9:03 PM

    I'm amused by this because when I called Mozilla out a few days ago, I got a bunch of downvotes [1]. Plus one of the top comments was a subtweet of mine.

    [1] https://news.ycombinator.com/item?id=20055322