Monday, November 10, 2014

Tracking Protection in Firefox


On Monday a project that I've been working on was officially announced as part of a larger privacy initiative called Polaris. In case you missed it, there is an experimental tracking protection feature in Firefox Nightly that allows people to avoid being tracked by not communicating with known tracking domains, especially those that do not respect DNT. Our initial blocklist is from Disconnect. As a side effect, blocking resources from tracking domains speeds up page load times on average by 20%. Privacy features rarely coincide with performance benefits, so that's exciting.

Currently, tracking protection is available by turning on browser.polaris.enabled in about:config. If you care about privacy in Firefox and are running Nightly, please give it a try. Requiring about:config changes is quite onerous, but we need your feedback to improve tracking protection. You can read official instructions on how to turn on tracking protection or see the animated gif below (original slide deck here for people who like to advance manually).

Many thanks to everyone who helped get this landed, especially my awesome intern, Georgios Kontaxis, and the team at Disconnect for open sourcing their blocklist.

14 comments:

  1. Does this include 1st party blocking also?

    ReplyDelete
    Replies
    1. No, it does not. It only blocks included content from 3rd party domains.

      Delete
  2. If its enabled by default, can extensions like adblock disable it to avoid interference?

    ReplyDelete
  3. Before doing stuff like Polaris, shouldn't you block 3rd party cookies by default instead?

    For me, Mozilla has lost its credibility regarding privacy.

    ReplyDelete
    Replies
    1. I believe we tried this back in 2007 (https://bugzilla.mozilla.org/show_bug.cgi?id=324397). It failed for usability reasons. Rather than trying something that already didn't work the first time, we should look for different solutions.

      Delete
  4. How do we submit feedback about Tracking Protection? Is there a "Report problem with this site" feature, or at least planned? I need to disable it e.g. for livejournal photo blogs, so that images in articles are displayed...

    ReplyDelete
    Replies
    1. Hi Thomas,

      You should be able to disable it per-site by clicking on the shield to the left of the location bar and selecting "Disable for this site". For feedback, you can fill out a bug at bugzilla.mozilla.org under Core::DOM::Security or visit trackingprotection.info. Thanks.

      Delete
  5. Exciting! Thanks, Monica.

    ReplyDelete
  6. Hi,

    I understand Firefox's new builtin tracking protection offers certain optimization opportunities that extensions cannot or do not, among other benefits. What I would like to know, however, is how the tracker coverage compares to the extensions offerings, such as Ghostery. Could you provide some commentary on that?

    By the way, I had to disable tracking protection to be able to fill out the comment form. That's doesn't necessarily there is something wrong with tracking protection, of course: it could be the commenting service used.

    Thanks!

    ReplyDelete
  7. > how the tracker coverage compares to the extensions offerings, such as Ghostery

    I haven't run these experiments, since the Ghostery EULA is quite restrictive. I'd be interested in seeing results if anyone knows, though.

    We have a paper coming out in W2SP in May that describes coverage relative to Adblock Plus that I will share after the workshop.

    ReplyDelete
  8. Monica, if you hadn't seen it, http://www.areweprivateyet.com/ seems like a good start for coverage info. It seems they have included the sources needed to do your own tests, and I presume they could be easily modified to also test firefox' new tracking protection.

    ReplyDelete
  9. I really like Internet Explorer's implementation of the Personalized List that doesn't necessarily require a downloaded/hardcoded blocklist.

    Yes, they do have the ability to add popular 3rd party TPL's but if you go to Manage Add-ons, Tracking Protection and enable Your Personal List, then go into its settings and set it to automatically block content that shows up on X number of sites it is a lightweight, no maintenance way of doing blocking versus relying on a maintained list.

    ReplyDelete

Note: Only a member of this blog may post a comment.