I can also highly recommend reading: Touching Lives: The Little Known Triumphs of the Indian Space Programme, by SK Das (2007).
Excerpt:
Touching Lives is not merely a chronicle of the community outreach of the Indian Space Research Organisation (ISRO). It is the story of journeys to far corners of India meeting people whose lives have been transformed by technology.
Big Big fan of mitmproxy. This is a wonderful tool, and with scripting functionality it helps achieve so much more.
I have been introducing this tool to so many developers and quality assessment teams, to not just improve day to day things but also perform privacy assessments w.r.t GDPR etc.
Thank you so much for your work. What is the best way to donate to your project?
The price difference are huge, even when you compare from Germany, however, it’s important to note that iMessage and FaceTime are most likely disabled on iPhones bought from UAE. At least that was the case back in the time.
I have been testing Edge on iOS for Privacy practices. I think there are lot of things to improve. Also, it would be great for Edge to make it easier way to report and have discussions. Currently it’s a black box.
On the similar topic, some more interesting RFCs / Drafts from IETF on OAuth:
- OAuth 2.0 Threat Model and Security Considerations
https://tools.ietf.org/html/rfc6819
Thank you for taking the time to read the article and sharing your feedback.
Noise is added for what is called plausible deniability. Note that messages themselves do not contain any user-identifier. We take extra measures to strip request headers not needed by the server to avoid extra information that could be used for implicitly linking messages[1]. Possibility of linking messages based on network fingerprinting (ex: IP - which we do not log) still exists and is an open concern which we will solve in the next version. This at most makes it possible for us to learn that these 3 domains are visited by the same person, again - given that the list of domains are from shortlisted top-news domains, it is safe to assume that they do not contain any PII.
That said, it is not the strongest model we apply -- due to resource-constrains we have not updated to strongest models like we do on more sensitive data - via HumanWeb[2]. We will soon do the changes on a couple of dimensions: a) each domain as separate message, right now this introduces un-wanted spatial correlations, and b) send the domain through the proxy network HPN[3].
Would be really interesting to know your concerns with FoxyProxy.FoxyProxy is legally bound to not log the IP or share it.
From the HPN protocol's perspective, data can be routed via any trusted party - in our case it's FoxyProxy.
Right now, there is no way to configure this in the Browser, but should be doable.
It's actually one of the motivations to move to the newer version of HPN[1].
We do agree that sending data through Tor network is the gold standard for anonymity.
- We did a lot of work on getting Tor running in Cliqz
browsers. It's a hard problem but definitely do-able, something we might pursue again in future[2].
- We also have experimented with WebAssembly version of Tor client to make it compatible for web extension[3].
Having the ability to use the Tor network in Cliqz products is also good, because we can actually leverage the anonymity guarantees by sending data via .onion services.
You can also check more details under evaluation section of the paper[4].
In case you wish to check the network traffic you can also check the debugging section[5].
Thank you for bringing this up. Although, this is not relevant in the context of the blog post, we are on that list by mistake. We do NOT collect any personal data in our browser: (more details e.g., here: https://0x65.dev/blog/2019-12-02/is-data-collection-evil.htm... and https://0x65.dev/blog/2019-12-03/human-web-collecting-data-i...) and we go a long way to make sure not even implicit indentifiers go through. We believe we ended up on that list for a bad Firefox experiment and we will reach out to the maintainers, make our case.
First, let's check if you can open another domain on .dev TLD, like web.dev, if not then:
Seems like you have some mapping for .dev TLD.
Assuming based on your mention of Safari, that you are using Mac.
Could you check if you have some setting in your /etc/resolver for dev TLD, or if you are using some service like dnsmasq which is trying to resolve .dev to a non-existent location.
It is true that there needs to be a way to store the aggregate queries "per user". In the current approach of collection this place happens to be on Server, but aggregation per user can easily be done on client-side by leveraging Browser storage.
Approaches like k-anonymity or L-diversity are good but they tackle the problem from a different perspective - making sensitive data available for querying without revealing actual content. The approach suggested in this article talks about methodology which removes the need to collect such data in the first place.
We will talk in detail about this methodology- Human Web and how we use to collect data for our search, without compromising users privacy and based on client-side aggregation.
Thank you the questions, we are always looking for constructive feedback on and off HN.
1. These random values are used for grouping partial queries together, and they reset when you press enter or start a new query.
Source code on how it's generated: https://github.com/cliqz-oss/browser-core/blob/master/module...
We actually take one additional precaution of using crypto random and not plain Math.random(), which could potentially be used to link multiple sessions together.
2. There is no feature to disable auto-suggest. But I will pass your feedback to the team.
3. No there is no shared ownership, we don't have access to their servers. We also do additional encryption with bucketing on the payload sizes that we route through foxyProxy, so that the proxy provider cannot learn anything about the content of the message. We will have a blogpost explaining this on Wednesday - 4th December. Also, we are looking to add an option, where user can choose their own proxy provider too.
4. There are two parts:
a. You can select the option from Control Center (Q menu) icon in the toolbar -> search -> search via proxy. (Now the calls should go through FoxyProxy)
b. All calls to api.cliqz.com go through proxy when in private mode.
The only reason it's not default is latency. As to what goes through FoxyProxy by default is: all Human Web data.
Once again, we appreciate you looking into details, and please keep digging, we would be happy to answer, improve our documentation and if there are bugs specially related to privacy and security they are on our uttermost priority.
We are aware of this and it's unfortunate, although the lists are not the main ones from community like Easylist, uBlock Origin etc. Cliqz does need to collect data to build it's search engine and other features. Even though we do with by privacy-by-design in mind and without collecting any PII (we will be sharing more details on the process on data collection in the blogposts scheduled for Monday, Tuesday and Wednesday),still we do end up getting on such lists.
Of course, you don't need to trust what we say, all the code used for collecting data is open-source for transparency and auditing. Additionally, also happy to help setup network debugging incase you want check what exactly goes out. - https://github.com/cliqz-oss/browser-core
We are also willing to discuss with the maintainers of the list and explaining what and how data collection is done.