One minute, please sit down, everyone.
I'll start.
Whenever you're ready.
Okay, team.
You started?
Hello, everyone. Welcome to our third call, where we have Vincent.
Vincent Turu is a UI engineer on Mozilla Privacy and Security Products Team,
working on tools like Firefox Relay and Firefox Monitor.
And he's going to talk about over a decade of anti-tracking work at Mozilla.
Yeah, thank you, Francesca. That was actually the first sentence of my presentation just gone now.
Yeah, so I worked on the Privacy and Security Products Team.
Yeah, and so I want to start this presentation with a bit of a personal anecdote.
My open source journey started with the release of Firefox 1.0.
It was my first interaction with open source software.
Later started using Linux, started contributing.
First with translations, later I became a software engineer.
But I only joined Mozilla as an employee about a year and a half ago.
So for this presentation, where I'm going to discuss a little over a decade of anti-tracking work at Mozilla,
I'm going to be leaning a lot on the experience of my coworkers,
specifically Luke Crouch and Max Crawford, other engineers on the Privacy and Security Products Team.
They wrote this blog post, so most of the content of this presentation is also in that blog post.
So if you want to have a quick high-level recap, you can read that afterwards.
It's also linked on the FOSTEM side, I think.
But Luke has been at Mozilla for basically forever.
Mozilla went through and through lots of institutional knowledge,
so lots of the content is by him.
Max did most of the illustrations, so that's credits where credit is due.
So tracking. It can be beneficial.
I want to do one short scary slide and then the rest will be more positive.
But I want to take a bit of a moment to discuss the risk of tracking.
Why are we actually trying to minimize the harmful effects of tracking?
So tracking is a personal risk.
You can fall victim to phishing attacks, for example, or the people around you can fall victim to it.
So if more of your data is known, or if your data leaks,
it can be used to impersonate you and get, for example, people around you
to transfer large sums of money or whatever.
So, for example, if someone contacts my father and says,
hey, it's your son, could you please wire me 5,000 euros?
You know, it's a lot less believable than if they were to say, hey, it's Vincent.
I just got fired from Mozilla. Hopefully, it never happens.
But, you know, could you wire me 5,000 euros because I'm in money trouble or whatever?
That's a lot more convincing.
So data can be abused, but it's also more of a societal risk.
So ransomware has been in the news a lot recently.
It costs a lot of money.
It can even be used to convince people not to vote
if they are aligned with a certain political party or et cetera.
So there's risks involved with tracking.
The rest of my presentation should be more positive.
I'm going to discuss what we're doing to minimize those harmful effects
to allow you to confidently use the internet carefree.
So there's a variety of ways to track you.
Historically, a lot of attention both inside of Mozilla
and outside of Mozilla has been given to tracking cookies.
So I'll start my presentation with an overview of what we've been doing there.
And then I'll go over these other forms as well.
So cookies and a bunch of related technologies that all call cookies.
There are bits of data that websites can store on your computer,
which can be useful.
So if you load a website and the website sees a bit of data that proves that you are you,
it can decide to give you your shopping cart or your private messages
or whatever and not show someone else's.
So that's a good thing.
But it can also be used to track you if you don't want that.
So every website you visit can set cookies.
But not just that website.
Websites can also embed other websites.
So for example, a website could contain a YouTube video
and then YouTube can set cookies as well.
It can contain ads.
And then those are often also served by a third-party website.
It can also set cookies.
Websites can even embed other websites without just seeing them.
So for example, with the goal of tracking you, so those can also set cookies.
So we've been clamping down on that primarily through Firefox.
So I'll start my overview with Firefox Private Browsing introduced in 2008
after Chrome was released, which had an incognito window.
But a private browsing window is basically a window that as soon as you close it,
forgets everything you did in there, forgets the cookies that were stored as well.
It's often jokingly referred to as porn mode,
but it's definitely also an anti-tracking tool.
So for example, my girlfriend used it as such.
She's a kind of ridiculous Harry Potter fan,
like participates in international pub quizzes about Harry Potter level.
But she's also a high school teacher.
And so sometimes she'll need to show, I know,
a video of something that happened in the news recently.
And she'll go to YouTube, share her screen, and show a YouTube video to her class.
And she doesn't necessarily want her entire private life,
which is entirely Harry Potter, shown in the YouTube recommendations.
So what she does is at home, when she's, I don't know,
listening to YouTube, to Harry Potter music or ASMR or podcast or whatever on YouTube,
she'll open a private browsing window and do that thing in there.
And then if she closes it, then YouTube can't correlate those two sessions.
So won't show Harry Potter recommendations when she's sharing something with her class.
Another reason why I'm starting my overview with this private browsing window
is that we interpret, if someone uses a private browsing window,
we interpret that as a signal that someone wants less tracking
and is willing to accept some more breakage.
And so unfortunately, often when we're trying to block tracking,
websites assume that they can track you and then build their functionality on that.
So there's a risk if you combat that, that you break the website.
So whenever we want to introduce new measures to combat tracking,
we'll first introduce it in private browsing, see how much it breaks there,
and then later we can try to port it over to your regular browsing window.
So that's why I mentioned private browsing first.
In 2013, we introduced more granular cookie control,
so you could make that trade of yourself as a user.
You could choose, for example, to not use cookies at all.
Lots of breakage. You wouldn't even be able to log into websites anymore,
but also remove that tracking vector.
You could also choose to, for example, not the third party cookie.
So if you visit a website, then that YouTube video that's in there
might not be able to set cookies.
Less breakage, but still quite a bit.
So it gave you that control, which is helpful,
but it's also kind of out of the way you have to know of these options.
You have to understand what they do, understand their risks,
and just making that trade between breakage and less tracking
isn't a great one in the first place.
So later on, we also introduced a block list,
so that it's basically a list of cookies that we know are just used to track you.
Don't provide any functionality for you as a user,
and we allowed you to block those cookies.
So less breakage doesn't prevent all tracking, but helps there.
And then not too long ago, 2021, that's really state-of-the-art
anti-tracking cookie work.
We introduced what we call total cookie protection,
so that doesn't actually block cookies,
but for example, if you visit youtube.com,
and then later visit a different website that also includes a YouTube video,
they'll both have cookies, but they'll be different cookie jars.
So YouTube will still not be able to correlate those two sessions.
So that helps prevent that tracking vector
without actually breaking it, because from YouTube's point of view,
they still have cookies.
So that's the work so far.
Obviously, the timeline here stops at 2021.
We're in 2023 now, but they're still the future,
so we're always working on more things to come with that.
But that's my overview of cookies so far.
With that, let's move on to IP addresses.
So IP addresses are basically addresses for every device
that's connected to the internet.
They are relatively stable.
They can change, but most of the time,
most devices have the same address.
And this is a pretty strong identifier.
Like, for example, I'm the only one that uses this phone,
often has the same IP address,
so everything you can link to that IP address is quite sure to be me.
Same goes for this laptop, for example.
And they're not just able tools to link you,
but they're also often correlated to your geographical location.
So it's not super specific, but when I'm at home,
you can deduce from my IP address which city I am.
I'm in.
So, yeah, that's the risk of IP addresses,
so whatever we've been doing there.
Well, like cookies, oh, I forgot this.
So the thing with IP addresses,
it's inherently if two devices connect to each other
via the internet, they can see each other's IP addresses.
And so that means by virtue of connecting to a website,
that website will be able to see your IP address.
And again, websites can embed other websites,
so those embedded websites can also see your IP address.
So just like we did for cookie protection,
we introduced a block list of IP addresses
that are known to track you and not provide other functionality.
As I mentioned, first in private browsing later,
also gave you that option in your regular browser window.
Which is good if you never even connect to a tracking server
or to an answer or whatever, it can't track you,
it can't see your IP address.
But obviously, we can only do this for connections
that don't provide any functionality.
We can't start blocking YouTube.com
because you won't be able to view that video anymore.
So to battle that, in 2019,
we introduced Firefox Private Network,
which is in between your browser
and the website you're connecting to.
And so instead of connecting directly to that website,
you'll connect to Firefox Private Network
and then Firefox Private Network connects to the website
you're trying to view.
And then from the point of view of that website,
it will see the IP address of Firefox Private Network.
And so in 2020, we expanded that to your entire device
with Mozilla VPN, which protects not just your browser traffic
but everything on your device.
And you can also use it on multiple devices.
Yeah, so that's our IP protection so far.
Yeah, then I'll move on to email addresses,
which is the fun part because I work specifically
on Firefox Relay, a product here
that I'll discuss in a second.
But first, there's a question that blew my mind
when Luke first mentioned it.
But email addresses, they feel like you can easily create
a new email address, right?
You go to g1.com, enter a username and a password,
and you've got a new email address.
So they feel like they're easy to change.
But in practice, you've probably changed your house address
more often than you've changed your email address.
I've moved a lot, I don't know,
six times in the past 10 years, maybe,
but all the time I've been reachable
via the same email address.
So if you have that on file, there's so much history
about me that you know via that email address.
So it's a pretty stable identifier,
and it's cool if you block all your third-party tracking cookies
and you hide your IP address,
but if you then go on and sign in with your email address,
they can just correlate that back together.
And this happens, for example,
you go to an online store and you buy clothes or whatever,
and you sign in with your email address,
and then have the clothes delivered.
From the point of view from that store,
you're a very attractive customer.
Like, compared to some random other street,
you're far more likely to make another purchase there
than some random person is, right?
So what that store then does is they go to Instagram
or whatever, and they're like,
hey, here's an advertising campaign.
Here's also a list of all the email addresses
of our customers.
Could you please show those ads to those customers?
And so from the point of view of that store,
that's great news.
They can advertise to you, you're a high-potential customer,
but from the point of view of Instagram
or Facebook, Meta, whatever owns it,
it's even better because they have not just your activity
on Instagram and Facebook and WhatsApp, et cetera,
they also know, hey, you're a customer of that store
and of any other stores that have done the same.
So lots of ways to track you,
and that's the voluntary part,
voluntary data sharing by third parties.
But in 2018, I believe, we introduced Firefox Monitor,
which basically keeps track of data leaks that happen.
And if you sign up for Firefox Monitor,
it will warn you if your data was found in the data leak,
if there was a hack or whatever,
to remind you, hey, maybe you want to change your password.
But what we saw is that many people use the same email address
at different services.
So if there's data leaks in different services
with the same email address, you can link the two data leaks,
the data in the two data leaks,
you can link them together and know that they're about the same person.
And many people even, probably not all of you,
but other people also use the same password
across different websites.
So even if there's not a data leak in a different website,
by using your email address and your password,
they're still able to extract data from those other websites.
So that's obviously not great.
So in 2020, we introduced Firefox Relay.
And what basically Firefox Relay does
is it provides you with a unique email address per service.
So if you have a sign-up form, you need to leave your email address,
you hit the Relay button, and it will generate a new email address.
So I know ZQF40 at Mozmail.com, for example.
And it will forward all email that goes to that email address
to your true email address.
So the store will still be able to communicate with you,
send your emails at that address,
but that won't have your actual email address on file.
And so if there's a data leak there,
your data can't be linked to your data elsewhere
because you have two different email addresses there.
So that's Firefox Relay.
Yeah.
Oh, actually, I'm doing well on time.
You're welcome, Francesca.
So then lastly, phone numbers.
So kind of similar thread, right?
It was super annoying when I started to use Relay,
and cool, you can leave your email address,
and I'm like, I've got my Firefox Relay address,
you can catch me, and then they're like,
can you give your phone number, too?
Bit of a shame.
So what we did is late last year,
we introduced phone masking for Firefox Relay,
added this graphic to our website,
but it worked similar to email masking.
You get a phone number mask,
so a new phone number, and all the text messages,
all the phone calls that go to that phone number
will be forwarded to your true number
without having to share your true phone number.
And so if you get, for example, a text message saying,
hey, it's your bank, could you please
change your password and go to this website and change it,
that's an additional signal where you can see,
well, this is not actually my true phone number,
which my bank has, so this is probably a scammer.
This is a pretty new addition,
so unfortunately for probably most of you,
also for myself, especially given that I work on it,
it's not available outside the US and Canada yet,
but hopefully soon.
But yeah, so the point there is lots of this work
is like the broadening of the scope
beyond just tracking cookies.
That's all quite recent works.
You should saw like 2018 onwards,
we started to broaden our focus.
That's also when the security and privacy products team
around then started.
So yeah, we're not done yet, obviously.
This is the overview of the timeline so far.
And yeah, if you have any ideas of what we can do,
do leave them on Mozilla Connect.
And that's, I think, everything I had.
Damn, my practice was so much slower.
Thank you very much.
And so does anyone have any questions?
So especially with the IP and email protection,
it really seems like you are a single part of Pavia.
What do you do to mitigate any resistance?
So the question was if, especially for Mozilla VPN
and Firefox Relay,
Mozilla is kind of the single point of failure there.
And yeah, that's true.
So the point of failure here is,
for example, for Firefox Relay,
if you're, imagine we're doing everything to prevent it,
but imagine there's a data leak at Firefox Relay.
What then happens is your email address still gets public,
which is annoying, obviously.
You're basically back at where you were before, right?
But there's just one place where you could fill,
i.e. Firefox Relay, rather than all those places
that store your other email address.
So yeah, it's annoying.
Ideally, we'd have, I'm not sure,
I'm sure Luke has probably a couple of ideas
around minimizing that that we might look at at some point.
It looks like you have an idea.
Because especially if you like the central place where you store everything,
you become a very attractive target.
Yeah, that's true.
So yeah, if we're a central place that has lots of email address,
obviously we become a bigger target.
That is true.
I wouldn't say right now, Firefox Relay and VPN as well
aren't that big compared to there's far bigger data faults.
So that's definitely something we're aware of
and want to minimize.
I think right now, at least for me personally,
for me personally, it's still worth it, right?
The risk is smaller for using Firefox Relay.
If I want to order a ticket, for example, like a concert ticket,
I'll give them a relay address.
They'll forward me the ticket and I'm done with them
and I never need that again.
If you're interacting with your bank, for example,
I would use your actual email address.
So yeah, there's definitely a risk calculation to make there.
All these products are not a perfect solution.
I think that's basically the threat in all this.
It's all about trying to find that balance,
trying to block cookies, for example.
It's all trying to find this balance,
how much tracking do we want to allow
and how much breakage do we want to allow
and there's always tracking that we can't prevent
and there's always downsides of our anti-tracking measures
that we can't prevent.
So yeah, I wish I had a better answer, but that's it.
We have a question also in Matrix.
It currently doesn't work with Chalk.
Ah, okay.
So Danny on our Matrix is asking that,
yeah, so he's asking about five folks
relay phone number masks,
not working with a bunch of tools.
That is something we're aware of and working to fix
for those who are familiar with phone number masking.
Yeah.
So my question is, is it correct to state
that at the moment none of the services
have been demonstrated to actually treat our data
end-to-end as an end-to-end encryption
so that you can't see our data?
And the following question to this question
is do you have any plans to implement
end-to-end protection?
Is it even realistic in this case?
So the question is, do we end-to-end
and crit the data we're handling?
Obviously not applicable to everything,
like cookie, et cetera, not.
For emails that's basically not possible,
because we need to know your email address
to actually be able to forward email.
We don't store the emails we forward,
so we get them for them to you and forget about them.
So...
Damn it.
VPN, actually I'm not sure.
Maybe you're biased the way I am.
Is that encrypted?
I think your connection via VPN is encrypted, right?
So, yeah.
VPN works in a way that you generate like...
We're using one.
Sorry for putting you on the spot, but...
Hi.
Yeah, so the Mozilla VPN works
using the WAGA protocol.
So on the client, you generate your own private key
and you only upload the public key
to the Mozilla VPN network.
And then during the server handshake with a partner,
you generate the session key.
So essentially, even if your public key gets leaked,
we can't see anything.
Yeah, so VPN is end-to-end encrypted.
We can't see what you pass through there.
Hey, I wonder how does Firefox Relay prevent spam?
What kind of mechanism does it use to catch spam?
So there's a basic spam filter.
We make sure that if...
So if we forward our email and you mark it as spam
in your inbox, Firefox Relay gets a signal
and stops forwarding emails to that email address
to that spam.
You know, it's spam.
Does it use a spam assassin or R&B?
I wouldn't know.
So the question is, what service do we use to detect spam?
Come to our matrix and I'll find out for you.
Yeah, our backend engineers will know
that I'm not involved with that part of the implementation.
But we do have a number of anti-spam
and anti-abuse mechanisms in there
that we don't want to get blocked by other people as well.
Thank you for the talk.
It might sound like a stupid question.
You mentioned the three or four products like Relay, VPN,
and Monitor.
Are they free, including the VPN?
No, so the VPN is paid.
I would also recommend you not to use a free VPN.
They're almost all shady.
Quite a few of the paid ones are also pretty shady, actually.
No, so the VPN is, I believe, if you pay annually,
I think five euros a month.
I see not, so that's good.
Firefox Relay has a free plan,
which gives you just five email addresses.
So that works, but then if you want to get every service
a unique email address, that's not great,
but it costs one euro a month.
And Monitor is free.
Yeah, and so part of this is also,
part of what we're doing at Mozilla
is building these privacy-protecting tools.
We're also trying to find ways to have those finances themselves.
So yeah, we're not trying to sell ad or anything.
You pay for it, you're the customer.
That's the idea there.
Last question.
So I think it's pretty obvious that the technologies
that are being used to track us now
kind of almost require us to have a sort of centralized entity
to sort of resolve it, whereas cookie protection
could be kind of done decentralized.
And that obviously makes Mozilla as an organization
kind of a target of critique, I guess,
because you become centralized to some sort of tracking.
Is there some sort of track or something that happens at Mozilla
to mitigate the risks of being a single entity
that could store too much information?
For instance, in terms of relays,
there is separate entity that, or an entrenched thing
that tries to ensure that you don't store too much data,
so that at least you can't kind of try to monetize it yourself.
Yeah, everyone can hear it, right?
So one strategy there that we have at Mozilla,
we have our lean data practices,
so that means collect as little data as possible.
That's one way to mitigate that.
And that's why Firefox Relay,
it's why we only store your email address,
we don't store the emails we forward.
You can choose, so you can choose to store
associations like which masks did I use on which website,
but you can also choose to have that stored locally
if you have the extension, or just not store it at all.
And yeah, in terms of,
it's definitely something we'd like.
I'm not sure of initiatives going on there,
and we do, not last my train of thought, but yeah.
Thank you very much.
Unfortunately, this last question we have time off.
Please put the rest in the matrix room.
Thank you.
Well done.
These are my notes.
All right.
I think we got 100% of them.
That's what this came to, like 100%.
Yeah.
It's like fraction, like, oh god,
I've been thinking to mom,
and she's going to make sure I'm raising my phone.
No, no.
Obviously you're live.
It connects.
You have an adapter?
Yeah.
Let's see me if it's on.
Why does it work?
Turn on your second screen.
It's not on, I think.
It's difficult.
So why does it not see it?
Basically, we're asking about
the current working part,
where thousands have been located
into that satisfied party.
So it's conducted where,
for example, ISPs aren't that trustworthy,
like you had probably the first one.
Well, it makes more sense,
whereas in Lebanon,
I think it would be very difficult.
Yes, I can see you made it through.
I get to try them all.
It's a different department.
I'm sorry, I'm loud,
but if I don't see them,
it's got to be there,
so it doesn't go through.
Yes, it's coming.
Yes.