Privacy Not Included
foundation.mozilla.orgI wanted to give everyone a heads up here, this is genuinely a terrible site. I like the things mozilla does more generally. But this site...
These product listings are USER RATED! And they're sorted based on users ratings.
General users will vote for anything positive to indicate they like it, and anything negative to indicate they hate it. "Is this product good value?" "Yes." "Is this a luxury product?" "Yes." "Is this product affordable?" "Yes." All stand in's for good. So if you ask a general user if something is creepy, the answer you will get back is either "It's good" or "It's bad".
These aren't products that meet rigorous privacy guidelines, or are open source, or products from companies that go out of their way to keep their services zero-knowledge. This is a popularity contest page. This is not the place to get advice on privacy respecting products.
Take note on what guidelines Mozilla here seems to establish, one of them is hilariously: "Privacy Policy. Yes they have one"
Also, you have to vote on a product to see its "creepiness" rating breakdown? I would supposedly be using this site before purchasing a product, how would I know how "creepy" it is? This site seems more akin to a Buzzfeed quiz than a Mozilla project.
That said I think this idea has a lot of potential, but this is perhaps not the best form for it to take.
I feel infantalized after looking at that site, maybe I'm not the target audience but the people that this is targeting I would imagine feel like that too.
It makes sense if you consider it as a piece of content marketing designed to generate tech blog articles that mention “Mozilla” and “privacy” in the same sentence. It’s not an earnest attempt to offer a useful resource.
It's a great start - I see a lot of potential in how it has "dumbed down" the topic of consumer privacy.
I see all the flaws you're talking about, but the one thing I was looking for, and this simple delivered, is to relay the message
"Ring and Nest are bad, like really bad"
There's some potential here. Not every Joe Shmoe knows or even cares about privacy so dumbing it down to "Product A: Good" and "Product B: Bad" is a start at least.
It could backfire, people might perceive the complexity of the content is a reflection of how dumb a company thinks its viewers are.
Mozilla hasn't seemed at that concerned with digital privacy for a while now.
Sure they _say_ they're for it but their actions and products have been leaning the opposite way lately.
Does anything not have a privacy policy?
Education insights policy seems to only apply to the site, not the product https://foundation.mozilla.org/en/privacynotincluded/product...
I could just makea policy that you have zero privacy and I'm going to sell all of the data: great now I can be on this page!
This is a good resource, but the presentation needs work. The big emoji smiley face on top implies that all the products listed below are "good," but you have to actually click through on the product to see the actual rating (like Amazon's Ring Doorbell is rated by users as "Super Creepy").
The explanation of their Minimum Security Standards is pretty helpful and reasonable though: https://foundation.mozilla.org/en/privacynotincluded/about/m...
This reminds me of Mozilla's Observatory project (https://observatory.mozilla.org/) in a more consumer-focused package. I just wish they'd make it less confusing.
The smiley face actually changes as you scroll down. It’s kind of confusing
Only if you have JavaScript enabled, which people who care about privacy are less likely to do. And even then it's not clear which products it applies to.
Another issue - there's no way to see user votes without actually voting, which encourages people to leave the vote in the "neutral" state and click through if they just want to see the results.
In almost every case I saw, perfect Neutral was skewed very highly so this UX is clearly polluting the results.
Seemed intuitive to me. It's a descending listing of least creepy to most creepy - the emoji changes as you scroll to denote this. If you leave the page and return the emoji will show as a smile until you scroll again, regardless of location on the page, but otherwise I don't see your first point.
The UI is quite bizarre. The "not creepy" face changes based on scroll position, not what you point at. It's unclear which products it's even referring to.
I don't understand why they didn't display an ordinary table with checkboxes for each security feature.
Not only that, but several of the "Very Creepy" items have a star with a laurel wreath around it, like it's won some sort of award for being not creepy on the site. WTF?
That's exactly what it means. The award is Meets Our Minimum Security Standards: Encryption, Security updates, Strong password, Manages vulnerabilities, Privacy policy
https://assets.mofoprod.net/static/_images/buyers-guide/badg...
Yeah, the UI isn't great. The fact the face got out of your way and animated made its changes non-obvious.
Am I the only person who dislikes the word "creepy"? It is of unclear meaning, and is based on emotion (even prejudice) rather than reasoned judgement.
My concerns for my own privacy are not grounded in some emotional dislike of "creepiness", they are grounded in reasonable apprehension of the potential negative real world consequences.
Security ≠ Privacy. Several of their "minimum standards" seem odd to me.
> Does it have a privacy policy?
I don't really care about a product's privacy policy; I care about what's in the policy!
> Do you have to create a strong password?
It makes little sense to avoid a product because they let you set a four character password. Just use a longer password! (If they have a maximum length or some such, that's of course a different story.)
> Does it get regular software/firmware updates?
Updates can be a good sign, I guess, but as with the privacy policy, doesn't it matter more what's in those updates? Zoom gets regular updates, but that doesn't make more confident in the software—at all.
This is great and helpful, thank you Mozilla!
If anyone that worked on this reads this, a suggestion: Please rank products based on Mozilla's rating and not user supplied sentiment.
For example, it's hard to make sense of products that are "very creepy" or "somewhat creepy" yet have 4/5 or 5/5 overall security rating from Mozilla.
It's not clear unless you really look that creepiness rating is not from Mozilla.
Also, the "creepy-ness" face only works with JavaScript enabled... I scrolled down the page and thought all these devices were "Not creepy!" because the face was smiling at me. It was only when seeing Ring Doorbell endorsed by Mozilla as "not creepy" did I twig that something was wrong.
Creepy is from users while Mozilla is the X/5. Basically stuff like google home people find creepy but Mozilla views it as 5/5 as good of security as you can get.
This page wasn't immediately clear to me. I have a lot of third party requests blocked when most pages load. Looking at this a first the fact they're organized from less creepy to most creepy was lost. The page just appeared to be seals of mozila approval and a smiling face above products. see https://imgur.com/a/48a8QmX
I had to enable a script hosted on mofoprod.com to get the smiling face to indicate that products were voted as creepy. Also voiting options did show.
Text explaining that users are rating products and they are ordered by creppy rating could be helpful.
I'm feeling this is well-meaning but really misguided, in multiple ways.
Mostly context-free. I'm guessing they're targeting mostly non-technical, retail consumers. Which is fine, but raises a number of other questions. Like, why is Mozilla especially well-positioned to review consumer electronics? And why are random consumers going to trust Mozilla?
Related, but this reinforces several bad messages about security:
- That it is an objective, scalar property of a thing,
- That "one size fits all",
- That infosec is a shopping exercise, not a process the user has to participate in.
Also, just, why? Who really thinks there's a Mozilla-shaped hole in the shopping-guide world?
Facebook Portal meets your "strict" privacy standards? GTFO Mozilla, stick to web browsers
HAHA! What an absolutely trash service, in that page it says:
> Facebook says that it does not listen to, view or keep the contents of any video or audio calls on your Portal.
No mentions about on their servers though, which we know they do!
How do I report articles on HN for misleading trash? This needs to be deleted from the internet.
How dare they give 5* to a fucking FB property.
Maybe a good start, but I don't think it's too useful. Creepiness is not just security, it's both: privacy and security.
A while ago I got Tile, though it was a good idea. Returned the same day, because in order to add a device I needed to create an account. The device is in my hand, the phone is in my hand, Bluetooth is the protocol. I don't need a server to arbiter a pretty straight-forward interactions between them. There is absolutely no need to require account creation, until I request cloud dependent features. Should be functional offline without any data sent to server.
Same with GoPro, they app required you to signup before you can use it.
On the other hand, I can pair and update my Bose headphones without having an account. I can do it without an app by plugging in a cable. I don't need to bother about their cloud security or privacy policy, because they simply don't have PI they can loose or misuse. I only need to be concerned about security of Bluetooth and Updates delivery.
Because it is hard not to use various services and you can't possibly asses security and privacy policies easily, the first question is: What information it collects and does it really need it to function or merely for marketing et al? If it does need, then you need to worry about security and privacy.
I thought with Tile they could use your bluetooth to find other people's tiles. So its all cloud-based.
This is a secondary function, as far as I remember you would need to explicitly mark you item as lost and it can only connect to app running, not really a mesh network of tiles. In any case, I think I should be able to use it locally, if I want to opt in for network, then signing up makes sense.
Your proposed use-case won't overcome their business model. Their business model (theoretically) makes their company more valuable the more users they get (users that cave).
As a technical user I like the emoji and think it's creative. Just wanted to add some positivity to a sea of negative comments.
I opted out of the Firefox/Android data collection setting. Then I was recently updated to the new Firefox Beta: https://snipboard.io/139WEH.jpg Privacy not included.
Looks like you were one of the unlucky 10%: https://firefox-source-docs.mozilla.org/mobile/android/mma.h...
It seems they've been using Leanplum for some time; I'm surprised I hadn't heard anything about it. It looks like they're not using it for advertising purposes, at least.
I'm surprised they wouldn't at least restrict it to only users who had enabled usage data (i.e., not enable it for users who had clearly already expressed a preference for privacy).
I'm also surprised they didn't do this in-house. Sending data to a third party, no matter how trustworthy that party seems, is not good a good look for a product that is advertised as privacy preserving.
Lovely. Thanks.
Right.
Automatic updates would seem to be a negative for privacy. They imply a backdoor to force changes on a device. Automatic update features have often been used to reduce consumer rights.
It's not even clear they're a win for security. If you shipped some simple device with so much attack surface it needs security fixes, you're doing it wrong.
Wait what? You think security fixes are a sign that software was built 'wrong'? Every piece of software has security bugs - it's the ones that never have any security fixes that I would be scared of.
You think security fixes are a sign that software was built 'wrong'?
Of course. If it needs a fix, it was built wrong. We've become too accepting of low-security software. There's no excuse for this in embedded devices that don't do much.
This page is a real bummer. Of all the products I looked at they all collect your data by default. Thats creepy, and yet merely having a privacy policy, not having a good one, earns the product a little award wreath. This is utter nonsense and has not highlighted privacy-respecting products. It's simply false. So dissapointed that this is mozilla.
A thread from 2018: https://news.ycombinator.com/item?id=18453550
Is this based on votes?
I've seen many submission reach front page that had roughly 1 vote/min in the first 2 hours.
I'm talking about the "creepiness rating". It seems like it might be based on what other people have voted.
If you open one of the product pages, you'll see that yes, and you can vote too.
Is Mozilla's new browser on Android not included on that list?
It contains 3 trackers [1]:
Adjust
Google Firebase Analytics
LeanPlum
It also has telemetry selected by default and is NOT opt-in. So yeah, whether it's hardware or software, you're being spied on any time you use an internet connected device.
[1]: https://reports.exodus-privacy.eu.org/en/reports/org.mozilla...
Yeah it seems incredibly hypocritical to not put their own products on here.
I think I'll go live in a cave if I hear privacy debated once more!
I'm too inundated with this stuff!
An updated list of minimum security iot things is a good start. Those get shady fast.
It would be a much shorter list if they just do "privacy included"
At the very bottom is the Facebook Portal. How did that get on this list?
It's worth noting that Mozilla is not a very good privacy advocate since they are a puppet to Google, a surveillance capitalist.
This fancy looking site is pretty unhelpful, and also has sinister tracking analytics which does not help their 'privacy cause'.
My assessment is that I would highly not recommend this site.
What is Mozilla doing? They are endorsing the 'Google Home'? The 'Ring Doorbell'? Products from Nest? I guess it makes sense, with the amount of money they get from Google- they have to.
While these devices might have encryption, security updates, etc, many of the devices listed ABUSE user privacy. Many of the devices here ARE creepy!
I could provide 10 links as proof, but it's not even worth the time. You can go ahead and 'Google' the proof.
This is horrible.
Edit- want some proof? Listen to these: https://www.wfmu.org/playlists/TD
You didn't look very closely at the website and just jumped to conclusions, didn't you?
They rank all the ones you mentioned as "Super creepy".
To a normal internet user, they make it look like they endorse the product.
The 'meets our minimum security standards' seal is still next to the product.
To you, who may be a normal internet user, it makes it seem like they endorse the product. I didn't see that at all. (Plus, a "normal internet user" has no idea how Mozilla makes money.)
But they are endorsing the products the creepy is the user rating not Mozilla's.
The "creepy" factor is a user-rating, Mozilla IS saying these are endorsed (hence the "wreath").
This site is a hot garbage of "yes but no but yes actually no"...
This webcam[0] with a doggy treat dispenser attached to it gets the wreath, but when you scroll further down they tell you what's bad with it. On 2nd reading the wreath means "It meets our minimum security standard!". Woah, that's like giving a crown to someone finishing a 5K run 4 hours behind the leader, because "Reaching the finish means you're special!".
And it's enough for the manufacturer to promise shit in writing ("Yeah we have a privacy policy, and we have a button that says 'Delete my data'.") to "meet their minimum security standards".
It smells to me like the foundation is using their reputation for a money/favors grab ("That's a nice product you got, it would be bad if it didn't get our wreath.") -- maybe that's not their motivation, but that's what I'm smelling. The whole thing stinks it makes me wonder if I should uninstall Firefox...
[0] https://foundation.mozilla.org/en/privacynotincluded/product...
Other way around Mozilla is endorsing google home as 5/5 "Overall Security Rating". Users going to this site have rated google home as creepy. Mozilla is not the one saying it's creepy they are giving it the 5/5.
Should Mozilla lie and say that the Google Home is insecure?
"Insecure" and "Creepy" are not the same thing.
We generally call not making your intention clear--making one impression more obvious than a detailed inspection--"Dark Patterns".