810434 - Do not submit health report requests when in private browsing mode

Status: RESOLVED WONTFIX

(Firefox Health Report Graveyard :: Client: Desktop, defect)

Description

[Gregory Szorc [:gps]]

Apparently we have a requirement to not submit health report data when in private browsing mode.

Comment 1

[Gregory Szorc [:gps]]

Tom: Can you clarify the requirements around private browsing? First, none of the data we currently collect reflects browsing habits. This *will* change, but not for the initial release. Keep that in mind.

1) Should uploading of data be disabled when in private browsing mode
2) Should deletion of server data be disabled when in private browsing mode
3) How does this play into per-window private browsing mode? Is one window in private browsing enough to potentially disable things? Or, must all windows be in private browsing mode?

Comment 2

[(no longer active)]

Note that we should think about per-window private browsing as well.

What does this report contain exactly?

Comment 3

[Gregory Szorc [:gps]]

(In reply to Ehsan Akhgari [:ehsan] from comment #2)
> What does this report contain exactly?

For now it is essentially nsIXULAppInfo. See https://bug799552.bugzilla.mozilla.org/attachment.cgi?id=673300 for the kinds of data it will eventually have.

Comment 4

[Mark Reid [:mreid]]

The intention of the handling of private browsing in the old code was primarily to prevent data *collection* during private browsing mode.  I think this should continue to be the case, though per-window private browsing would definitely have an impact on the mechanics there.

Preventing data *submission* during private browsing was a case of making sure to err on the side of caution.  Strictly speaking, and without considering per-window private browsing for a moment, submission while in private mode would expose an "I exist" signal from an otherwise "invisible" user.

Extending that argument to per-window private browsing, it would require all windows to be private before the "I exist" signal would actually be exposing anything potentially sensitive, since a single non-private window would render that signal acceptable.

Comment 5

[(no longer active)]

(In reply to comment #4)
> The intention of the handling of private browsing in the old code was primarily
> to prevent data *collection* during private browsing mode.  I think this should
> continue to be the case, though per-window private browsing would definitely
> have an impact on the mechanics there.
> 
> Preventing data *submission* during private browsing was a case of making sure
> to err on the side of caution.  Strictly speaking, and without considering
> per-window private browsing for a moment, submission while in private mode
> would expose an "I exist" signal from an otherwise "invisible" user.

Why do you think those users are invisible?  We already send update check pings, etc. in PB mode.

> Extending that argument to per-window private browsing, it would require all
> windows to be private before the "I exist" signal would actually be exposing
> anything potentially sensitive, since a single non-private window would render
> that signal acceptable.

I don't think so.

Private browsing is about keeping traces of user's browsing habits private.  I don't see anything in the data that is being submitted which would undermine that, so I'm not sure if we need to do anything here.

Comment 6

[Mark Reid [:mreid]]

(In reply to Ehsan Akhgari [:ehsan] from comment #5)
> > Preventing data *submission* during private browsing was a case of making sure
> > to err on the side of caution.  Strictly speaking, and without considering
> > per-window private browsing for a moment, submission while in private mode
> > would expose an "I exist" signal from an otherwise "invisible" user.
> 
> Why do you think those users are invisible?  We already send update check
> pings, etc. in PB mode.

Sorry, I should have been clear that I was talking about invisibility specifically from the perspective of FHR.

> Private browsing is about keeping traces of user's browsing habits private. 
> I don't see anything in the data that is being submitted which would
> undermine that, so I'm not sure if we need to do anything here.

Are you talking just about submission here, or about collection as well?

Comment 7

[Gregory Szorc [:gps]]

With all due respect, the answers for this come from the Privacy Team. I think we should wait to hear what Tom says.

Comment 8

[(no longer active)]

(In reply to comment #6)
> (In reply to Ehsan Akhgari [:ehsan] from comment #5)
> > > Preventing data *submission* during private browsing was a case of making sure
> > > to err on the side of caution.  Strictly speaking, and without considering
> > > per-window private browsing for a moment, submission while in private mode
> > > would expose an "I exist" signal from an otherwise "invisible" user.
> > 
> > Why do you think those users are invisible?  We already send update check
> > pings, etc. in PB mode.
> 
> Sorry, I should have been clear that I was talking about invisibility
> specifically from the perspective of FHR.

OK.  But what I'm trying to say is that users using PB are not invisible.  unless I'm missing something...

> > Private browsing is about keeping traces of user's browsing habits private. 
> > I don't see anything in the data that is being submitted which would
> > undermine that, so I'm not sure if we need to do anything here.
> 
> Are you talking just about submission here, or about collection as well?

Both.

Comment 9

[Tom Lowenthal]

Sorry about the delay. This wound up in the pessimal situation of needinfo-ing me hours before I got on a plane. I'm back now, though, so no need to fret!

Fundamentally, I think that there's a fair bit of confusion when it comes to private browsing. My understanding of private browsing mode is that after you leave private browsing mode, a casual observer using your Firefox profile should never stumble upon traces of what you were up to. This seems to be supported by <https://support.mozilla.org/kb/private-browsing-browse-web-without-saving-info> and other design decisions.

With that in mind, I don't think that we need to take any special action or behave differently in private browsing mode. As :eshan points out in comment 5, private browsing mode doesn't switch off any other mechanisms which need to talk to Mozilla or others.

The threat model for private browsing remains a privacy engineering matter so I want to double-check with  Sid that we're on the right lines here.

Comment 10

[Sid Stamm [:geekboy or :sstamm]]

I pretty much agree with Tom. One thing to keep in mind is "local traces".  I should be able to view the local health report data in Firefox.  I'd be concerned if my activities while in private mode are reflected in that local report data after I leave private mode.

For telemetry, we suspend probe accumulation during private mode and resume when leaving private mode (I think).  The main thing is that when I leave private mode the effects of my browsing should probably be rolled back as if I did nothing while in private mode.

But this depends on what's in the health report.  If someone cannot discern my in-private activities from the health report data, this point is irrelevant and private mode shouldn't affect the health report.

There's no reason to avoid sending reports during private browsing mode.

Comment 11

[Gregory Szorc [:gps]]

So, this bug is for *submitting* health report while in private browsing mode. We have people from Privacy and Security both agreeing that this is OK.

So, this bug gets WONTFIX.

There will be providers that will need to stop collecting during private browsing mode (e.g. search counts). These will be addressed on a per-provider level and aren't pertinent to this bug.