Orfox: New Firefox-based Android Private/Secure Browser(lists.mayfirst.org)
lists.mayfirst.org
Orfox: New Firefox-based Android Private/Secure Browser
https://lists.mayfirst.org/pipermail/guardian-dev/2014-August/003717.html
1 comments
Whenever someone asks about the consumer demand for privacy, I have to ask "what kind of privacy?"
Almost everyone says they value privacy, but that means different things for different people. Most teenagers don't care at all about government surveillance but care a lot about what their parents see. Spouses may care about the history log in their browsers. Employees care about what their employers see.
In addition, our desire for privacy is also contingent upon the effects of losing that privacy, which may vary based on factors that aren't strictly related to privacy. For example, people may regard their e-mail address or phone number as "private", but what those people (or at least some of them) really care about is spam. In the absence of spam (e.g. thanks to really good filtering), certain individuals might not regard an e-mail address as private.
If we analogize privacy to security, we might say that different people have different threat models, and that in turn determines how much convenience they're willing to give up for more security and the corresponding "market" for products or services that enhance that type of security.
Almost everyone says they value privacy, but that means different things for different people. Most teenagers don't care at all about government surveillance but care a lot about what their parents see. Spouses may care about the history log in their browsers. Employees care about what their employers see.
In addition, our desire for privacy is also contingent upon the effects of losing that privacy, which may vary based on factors that aren't strictly related to privacy. For example, people may regard their e-mail address or phone number as "private", but what those people (or at least some of them) really care about is spam. In the absence of spam (e.g. thanks to really good filtering), certain individuals might not regard an e-mail address as private.
If we analogize privacy to security, we might say that different people have different threat models, and that in turn determines how much convenience they're willing to give up for more security and the corresponding "market" for products or services that enhance that type of security.
Many in our industry believe that consumers don't understand technology or its implications, don't know what they want, and if you base your product design on consumers' stated desires you are substituting the offhand ideas of ignorant amateurs (I don't mean that pejoratively; they have their own jobs to do) for the hard-won, carefully thought-out ideas of expert visionaries.
Then why, regarding security issues, do so many in our field say 'consumers don't want that'? Very few consumers understand security technology (try asking one for their password, perhaps the simplest security tech) and even fewer understand the potential implications of threats to their confidentiality (for a simple example, how many think metadata is not a threat -- of the few who know what metadata is).
Few people in IT really understand the implications, because it requires understanding political, historical, and social issues. Many in IT know as much about those implications as typical end-users know about metadata, but we are deciding those issues for the world.
Then why, regarding security issues, do so many in our field say 'consumers don't want that'? Very few consumers understand security technology (try asking one for their password, perhaps the simplest security tech) and even fewer understand the potential implications of threats to their confidentiality (for a simple example, how many think metadata is not a threat -- of the few who know what metadata is).
Few people in IT really understand the implications, because it requires understanding political, historical, and social issues. Many in IT know as much about those implications as typical end-users know about metadata, but we are deciding those issues for the world.
> Then why, regarding security issues, do so many in our field say 'consumers don't want that'?
You answered your own question. Consumers actually do say they want privacy and security all the time. It's (some) folks in our industry who think they really don't. Or think that "privacy" or "security" in the abstract are pretty meaningless terms.
I fall in that latter category. Consumers say they want "privacy," but what they really want is something that addresses a particular threat model at minimum cost. Take Snapchat for instance. For its target demographic of teenagers, the primary threats are parents. Snapchat won't protect you from a technologically savvy opponent, but for most of its users, that's fine. Snapchat COULD build in two-factor auth, end-to-end encryption, and a whole slew of other privacy measures, but if it makes the app slower and harder to use, it's probably not a good value proposition given what Snapchat knows about its users.
Now, what I think what you're implying is that Snapchat should do more, regardless of what its users care about. Although Snapchat's users might not care about the security of their pictures outside of their parents, there are larger "political, historical, and social issues" surrounding the fact that a single entity has access to so many of those pictures in the first place. That well be so. You could argue that Snapchat should take greater care of those photos in order to be a good citizen of the world. But that's a different argument than "there's a growing market for privacy".
You answered your own question. Consumers actually do say they want privacy and security all the time. It's (some) folks in our industry who think they really don't. Or think that "privacy" or "security" in the abstract are pretty meaningless terms.
I fall in that latter category. Consumers say they want "privacy," but what they really want is something that addresses a particular threat model at minimum cost. Take Snapchat for instance. For its target demographic of teenagers, the primary threats are parents. Snapchat won't protect you from a technologically savvy opponent, but for most of its users, that's fine. Snapchat COULD build in two-factor auth, end-to-end encryption, and a whole slew of other privacy measures, but if it makes the app slower and harder to use, it's probably not a good value proposition given what Snapchat knows about its users.
Now, what I think what you're implying is that Snapchat should do more, regardless of what its users care about. Although Snapchat's users might not care about the security of their pictures outside of their parents, there are larger "political, historical, and social issues" surrounding the fact that a single entity has access to so many of those pictures in the first place. That well be so. You could argue that Snapchat should take greater care of those photos in order to be a good citizen of the world. But that's a different argument than "there's a growing market for privacy".
> it requires understanding political, historical, and social issues
A good primer on the social context of engineering is L. Sprague de Camp's "The Ancient Engineers", https://news.ycombinator.com/item?id=8158385
"The first engineers were irrigators, architects, and military engineers. The same man was usually expected to be an expert at all three kinds of work. This was still the case thousands of years later, in the Renaissance, when Leonardo, Michelangelo, and Durer were not only all-round engineers but outstanding artists as well. Specialization within the engineering profession has developed only in the last two or three centuries."
A good primer on the social context of engineering is L. Sprague de Camp's "The Ancient Engineers", https://news.ycombinator.com/item?id=8158385
"The first engineers were irrigators, architects, and military engineers. The same man was usually expected to be an expert at all three kinds of work. This was still the case thousands of years later, in the Renaissance, when Leonardo, Michelangelo, and Durer were not only all-round engineers but outstanding artists as well. Specialization within the engineering profession has developed only in the last two or three centuries."
"There is a growing market for privacy (confidentiality), in my amateur opinion; at least it seems that many consumers choose privacy when given the option and they dislike surveillance."
I think this is mostly a myth when it comes to consumer software. People say they like privacy/confidentiality/security but they are not willing to make any compromises to get it even if those compromises are very small in comparison to the privacy/security wins.
I think this is mostly a myth when it comes to consumer software. People say they like privacy/confidentiality/security but they are not willing to make any compromises to get it even if those compromises are very small in comparison to the privacy/security wins.
Asa: Thanks for the input though of course I hope you are wrong. :) Is there research on that? Your experience at Mozilla?
I do know a a few data points: (EDIT: walterbell provides a very good data point below, and one that should have been obvious to me!)
* Some vendors of confidentiality services report increased demand, especially since the Snowden revelations. (Sorry, I don't remember who reported it.)
* Facebook and others now are emphasizing privacy, suggesting that they see demand for it.
* A recent consumer survey said confidentiality concerns were impacting purchases on mobile devices.
* Also I read in an advertising industry publication that when a retail store chain posted signs saying they were tracking customer activities (via wifi/bluetooth on mobile devices), they got many complaints and saw an impact.
* Their solution of course was to take down the signs, which raises another point: If consumers/citizens don't care about surveillance, then why are businesses and government secretive about it?
I do know a a few data points: (EDIT: walterbell provides a very good data point below, and one that should have been obvious to me!)
* Some vendors of confidentiality services report increased demand, especially since the Snowden revelations. (Sorry, I don't remember who reported it.)
* Facebook and others now are emphasizing privacy, suggesting that they see demand for it.
* A recent consumer survey said confidentiality concerns were impacting purchases on mobile devices.
* Also I read in an advertising industry publication that when a retail store chain posted signs saying they were tracking customer activities (via wifi/bluetooth on mobile devices), they got many complaints and saw an impact.
* Their solution of course was to take down the signs, which raises another point: If consumers/citizens don't care about surveillance, then why are businesses and government secretive about it?
Privacy is a factor, it's just not the factor that drives most decisions around consumer software (at least mass market adoption). It's true that Facebook and others have emphasized privacy, but they have not compromised the user experience. Projects like this are challenging because you're forcing some behavioral changes for additional security.
> I think this is mostly a myth when it comes to consumer software. People say they like privacy/confidentiality/security but they are not willing to make any compromises to get it even if those compromises are very small in comparison to the privacy/security wins.
I know almost nothing about marketing consumer software, but if Mozilla/Firefox established itself now as the leaders in privacy, they may have an insurmountable lead in consumers' minds when/if the market moves that way.
(I realize the same could be said about any product/feature for which there currently is little demand: 'If Mozilla/Firefox started providing free cheezy-poofs with their browser now, they'd have an insurmountable lead when the market moved that way.')
I know almost nothing about marketing consumer software, but if Mozilla/Firefox established itself now as the leaders in privacy, they may have an insurmountable lead in consumers' minds when/if the market moves that way.
(I realize the same could be said about any product/feature for which there currently is little demand: 'If Mozilla/Firefox started providing free cheezy-poofs with their browser now, they'd have an insurmountable lead when the market moved that way.')
> People say they like privacy/confidentiality/security but they are not willing to make any compromises to get it even if those compromises are very small in comparison to the privacy/security wins.
That's a design & engineering problem which can solved for specific use cases. Snapchat's user base & 10 billion dollar valuation is one example.
That's a design & engineering problem which can solved for specific use cases. Snapchat's user base & 10 billion dollar valuation is one example.
Snapchat is neither private or secure.
It creates the illusion of it but its illusion is extraordinarily thin.
Please don't perpetuate the myth they are private or secure.
http://www.informationweek.com/software/social/5-ways-snapch...
http://www.nbcnews.com/tech/security/oh-snap-snapchat-fixes-...
http://gibsonsec.org/snapchat/fulldisclosure/
http://money.cnn.com/2012/12/28/technology/security/snapchat...
etc.
It creates the illusion of it but its illusion is extraordinarily thin.
Please don't perpetuate the myth they are private or secure.
http://www.informationweek.com/software/social/5-ways-snapch...
http://www.nbcnews.com/tech/security/oh-snap-snapchat-fixes-...
http://gibsonsec.org/snapchat/fulldisclosure/
http://money.cnn.com/2012/12/28/technology/security/snapchat...
etc.
I'm well aware they are technically neither private nor secure. But for users who don't want their parents / school / employers to have an easily accessible record of their communication, Snapchat is an improvement on Facebook (see http://www.danah.org/itscomplicated/), if one defines a security failure as "parent asks question about facebook post".
User perception of relative privacy has lead Snapchat to the point of having a large user base and significant funding, i.e. it demonstrates user demand for privacy. The quality of Snapchat's product is another matter, but they now have the resources to be private and secure, if they so choose.
TextSecure is doing good work in private messaging, hopefully their iOS version will raise the bar for everyone.
User perception of relative privacy has lead Snapchat to the point of having a large user base and significant funding, i.e. it demonstrates user demand for privacy. The quality of Snapchat's product is another matter, but they now have the resources to be private and secure, if they so choose.
TextSecure is doing good work in private messaging, hopefully their iOS version will raise the bar for everyone.
If you define security failure as "keeping things from your parents", ya I suppose that might qualify.
However, when all it takes is someone deciding they want to copy the picture and spread it...I think it results in a dangerous situation where the "customer" thinks its secure/safe but the reality is it isn't. I've seen so much damage caused by that sort of event that I take the idea that people consider such things "secure" or "private" offensive.
However, when all it takes is someone deciding they want to copy the picture and spread it...I think it results in a dangerous situation where the "customer" thinks its secure/safe but the reality is it isn't. I've seen so much damage caused by that sort of event that I take the idea that people consider such things "secure" or "private" offensive.
It is absolutely dangerous. As is crossing the road.
The security community is culpable for failing to find meaningful middle grounds that are acceptable to customers and which generate the revenue that can fund the development of strong security. As a result, non-infosec people build "good enough for naive users", get traction and fix only when forced by a breach or failure.
There are two ways to find (in the Steve Blank customer discovery / product management sense) a profitable middle ground: (1) start out with a weak security posture until public breaches force improvements to a stronger "good enough" (2) start out with strong architecture and consciously weaken to find a "good enough" point that is usable by a mass audience.
What alternative do Snapchat customers have today? TextSecure is subsidized by Twitter, let's hope Twitter has a long future. VC-backed Wickr is going after the financial sector. We need more security people who are not offended by scenario #2, because their distaste for the option makes them most qualified to make difficult compromises and disclose the associated risks so that customers can make informed choices.
The security community is culpable for failing to find meaningful middle grounds that are acceptable to customers and which generate the revenue that can fund the development of strong security. As a result, non-infosec people build "good enough for naive users", get traction and fix only when forced by a breach or failure.
There are two ways to find (in the Steve Blank customer discovery / product management sense) a profitable middle ground: (1) start out with a weak security posture until public breaches force improvements to a stronger "good enough" (2) start out with strong architecture and consciously weaken to find a "good enough" point that is usable by a mass audience.
What alternative do Snapchat customers have today? TextSecure is subsidized by Twitter, let's hope Twitter has a long future. VC-backed Wickr is going after the financial sector. We need more security people who are not offended by scenario #2, because their distaste for the option makes them most qualified to make difficult compromises and disclose the associated risks so that customers can make informed choices.
We need a business model for privacy, which means a business model for paid client-side software. Until people are willing to pay for a secure browser, Mozilla will remain dependent on search engine revenue, which in turn derives from advertising/surveillance.
> We need a business model for privacy, which means a business model for paid client-side software. Until people are willing to pay for a secure browser, Mozilla will remain dependent on search engine revenue, which in turn derives from advertising/surveillance.
A very good point. Isn't Mozilla working on that? See today's post on sponsored tiles on new tabs:
https://news.ycombinator.com/item?id=8237812
In earlier discussions regarding that feature (I don't know if it subsequently changed), Mozilla said they were developing a way for end-users to control their own tracking data (rather than have it controlled by a commercial vendor) and provide it as desired (and anonymize it?). If that solution could work successfully for Mozilla, it could be a model for one possible solution for everyone, and be proof of concept when legislators and others are looking for options that don't disrupt many large businesses.
A very good point. Isn't Mozilla working on that? See today's post on sponsored tiles on new tabs:
https://news.ycombinator.com/item?id=8237812
In earlier discussions regarding that feature (I don't know if it subsequently changed), Mozilla said they were developing a way for end-users to control their own tracking data (rather than have it controlled by a commercial vendor) and provide it as desired (and anonymize it?). If that solution could work successfully for Mozilla, it could be a model for one possible solution for everyone, and be proof of concept when legislators and others are looking for options that don't disrupt many large businesses.
Any revenue diversification is good, so let's hope this works. But this is trying to remove the search engine middleman by working directly with advertisers, i.e. Mozilla would still be in the advertising/surveillance business.
Here's a better option: partner with a (micro?)payments company to maintain a secure client-side database with dashboard for donations to open-source software and CC-licensed content. Make Mozilla the best browser for consuming, discovering and funding OSS and CC-licensed content.
Instead of showing "sponsored tiles", show project analytics for all the wonderful things that were done today by the projects to which I have donated. Make Mozilla the CRM user interface and payments broker for open content. This would have the side effect of funding new, open content.
In this possible future, Mozilla becomes a funnel of money to the commons (including itself), not a shopping cart or magazine. This future would not conflict with sponsored tiles -- let the user choose.
Edit: Mozilla could also modify the browser so it can perform "federated search" on the local device, trusted peers (via webrtc) or vertical search (e.g. HackerNews, StackOverflow, Wikipedia) before querying a public search engine. Enable a split-screen mode where private/federated search results are in one half of the screen, and public search results are in the other half of the screen. This will route traffic & revenue to community sites and will promote search privacy, i.e. always hit the local & community cache before querying the broader web.
Here's a better option: partner with a (micro?)payments company to maintain a secure client-side database with dashboard for donations to open-source software and CC-licensed content. Make Mozilla the best browser for consuming, discovering and funding OSS and CC-licensed content.
Instead of showing "sponsored tiles", show project analytics for all the wonderful things that were done today by the projects to which I have donated. Make Mozilla the CRM user interface and payments broker for open content. This would have the side effect of funding new, open content.
In this possible future, Mozilla becomes a funnel of money to the commons (including itself), not a shopping cart or magazine. This future would not conflict with sponsored tiles -- let the user choose.
Edit: Mozilla could also modify the browser so it can perform "federated search" on the local device, trusted peers (via webrtc) or vertical search (e.g. HackerNews, StackOverflow, Wikipedia) before querying a public search engine. Enable a split-screen mode where private/federated search results are in one half of the screen, and public search results are in the other half of the screen. This will route traffic & revenue to community sites and will promote search privacy, i.e. always hit the local & community cache before querying the broader web.
Very interesting -- for my prior post, I had written another few paragraphs on the need for a public micropayments clearinghouse and how well it would support free-as-in-speech software and media, but then deleted them as veering too far off-topic. (I'm glad you posted yours.)
Why limit the clearinghouse to free content and techy interests? Why couldn't other publishers use it, especially those whose products are too cheap per unit to charge for them one at a time such as newspaper articles?
I see your ideas on that and on search (a very interesting idea) as ways Mozilla can leverage their very valuable asset, user trust. Essentially Firefox would morph into a client for many services. But we are getting very far ahead of reality ...
Why limit the clearinghouse to free content and techy interests? Why couldn't other publishers use it, especially those whose products are too cheap per unit to charge for them one at a time such as newspaper articles?
I see your ideas on that and on search (a very interesting idea) as ways Mozilla can leverage their very valuable asset, user trust. Essentially Firefox would morph into a client for many services. But we are getting very far ahead of reality ...
> Why limit the clearinghouse to free content and techy interests?
Good point. There would be less need for donation analytics in that scenario. If it was expanded to "everyone", there would be many more stakeholders at the table, e.g. every payment company. It would be easier to prove the concepts in the underserved market of "free" software & content.
> But we are getting very far ahead of reality ...
It could be prototyped with a Firefox extension that bridges between the browser and a local (Py)QT WebKit app. Xapian does local search on Linux.
Good point. There would be less need for donation analytics in that scenario. If it was expanded to "everyone", there would be many more stakeholders at the table, e.g. every payment company. It would be easier to prove the concepts in the underserved market of "free" software & content.
> But we are getting very far ahead of reality ...
It could be prototyped with a Firefox extension that bridges between the browser and a local (Py)QT WebKit app. Xapian does local search on Linux.
In regards to giving data control to users, MIT media lab is worling on the openPDS (personal data store) system:
http://openpds.media.mit.edu/
Honestly kinda surprised mozilla doesnt have their hands on that as a partner, but hey, they can't do everything :)
http://openpds.media.mit.edu/
Honestly kinda surprised mozilla doesnt have their hands on that as a partner, but hey, they can't do everything :)
OpenPDS is the reference implementation for http://www.whitehouse.gov/sites/default/files/rss_viewer/NST...
Alternatively, we could collectively fund the development of high-quality non-profit software. Via taxation or crowdfunding or some other means.
Yes, the browser is in a unique position to simplify the donation process. But if everyone starts making lots of small donations, they are going to need an analytics console to track their donations and the performance of the receiving projects, i.e. should they donate again? Mozilla could lead the way in standardizing the datastore and payment APIs, allowing competition among client-side extensions that perform analytics.
Only tangentially related, but your "business model for privacy" comment made me think of TorCoin, in case anyone wants to look it up.
Why doesn't Mozilla heavily promote Firefox as the 'private' browser, and why not focus on enhancing those features, instead of leaving it to others to make the 'private' browsers by modifying Firefox?
1) Otherwise browsers are functionally the same for consumers, ignoring trendiness and user familiarity. Some browsers may do certain things milliseconds faster, or more often be perceived to perform faster, but there is little practical difference besides confidentiality. (I realize this may be controversial to some, but I doubt choice of browser impacts most people's productivity beyond confidentiality issues.)
2) Other browser vendors could not easily compete with Mozilla in the area of confidentiality: Their business models often include tracking consumer behavior, and their brands are not as trusted to put users first as a public interest organization is (and it depends on trust; consumers can't verify these things themselves).
3) Other browser vendors would be forced to try to compete regardless and improve confidentiality, and awareness of and demand for confidentiality would be increased, furthering Mozilla's missions. I think demand for confidentiality often is overlooked because consumers rarely have the opportunity to express it -- it's hardly ever an option.
Regarding the features: Not all confidentiality features are suited for general use (e.g., NoScript), but many are and some could be options for more advanced users. For example, why isn't there a Tor button or pref in Mozilla's official Firefox releases, which connects to Tor and routes all traffic through it? IME, it works fine, though a little more slowly, for most purposes.
EDIT: A few additions and clarifications.