@@ -183,31 +183,7 @@ In addition to the above design requirements, the technology decisions about the
...
@@ -183,31 +183,7 @@ In addition to the above design requirements, the technology decisions about the
Browser or extension features which affect privacy MUST be kept in lock-step with the browser version maximize user privacy.
Browser or extension features which affect privacy MUST be kept in lock-step with the browser version maximize user privacy.
Out-of-band updates affecting such functionality MUST not be enabled.
Out-of-band updates affecting such functionality MUST not be enabled.
4.**~No filters~**
4.**Stay Current**
~Site-specific or filter-based addons such as [AdBlock Plus](https://addons.mozilla.org/en-US/firefox/addon/adblock-plus/), [Request Policy](https://requestpolicy.com/), [Ghostery](https://www.ghostery.com/about-ghostery/), [Priv3](http://priv3.icsi.berkeley.edu/), and [Sharemenot](https://sharemenot.cs.washington.edu/) are to be avoided.
We believe that these addons do not add any real privacy to a proper [implementation](#4-implementation) of the above [privacy requirements](#22-privacy-requirements), and that development efforts should be focused on general solutions that prevent tracking by all third parties, rather than a list of specific URLs or hosts.~
~Implementing filter-based blocking directly into the browser, such as done with [Firefox' Tracking Protection](https://ieee-security.org/TC/SPW2015/W2SP/papers/W2SP_2015_submission_32.pdf), does not alleviate the concerns mentioned in the previous paragraph.
There is still just a list containing specific URLs and hosts which, in this case, are [assembled](https://services.disconnect.me/disconnect-plaintext.json) by [Disconnect](https://disconnect.me/trackerprotection) and adapted by [Mozilla](https://github.com/mozilla-services/shavar-list-exceptions).~
~Trying to resort to [filter methods based on machine learning](https://jonathanmayer.org/papers_data/bau13.pdf) does not solve the problem either: they don't provide a general solution to the tracking problem as they are working probabilistically.
Even with a precision rate at 99% and a false positive rate at 0.1% trackers would be missed and sites would be wrongly blocked.~
~Filter-based solutions in general can also introduce strange breakage and cause usability nightmares.
For instance, there is a trend to observe that websites start [detecting filer extensions and block access to content](https://petsymposium.org/2017/papers/issue3/paper25-2017-3-source.pdf) on them.
Coping with this fallout easily leads to just [allow-listing](https://github.com/mozilla-services/shavar-list-exceptions) the affected domains, hoping that this helps, defeating the purpose of the filter in the first place.
Filters will also fail to do their job if an adversary simply registers a new domain or [creates a new URL path](https://ieee-security.org/TC/SPW2015/W2SP/papers/W2SP_2015_submission_24.pdf).
Worse still, the unique filter sets that each user creates or installs will provide a wealth of fingerprinting targets.~
~As a general matter, we are also generally opposed to shipping an always-on Ad blocker with the browser.
We feel that this would damage our credibility in terms of demonstrating that we are providing privacy through a sound design alone, as well as damage the acceptance of Tor users by sites that support themselves through advertising revenue.~
~Users are free to install these addons if they wish, but doing so is not recommended, as it will alter the browser request fingerprint.~
`TODO: this whole section can probably be removed entirely since we're seriously considering adding uBlock-origin support`
5.**Stay Current**
We believe that if we do not stay current with the support of new web technologies, we cannot hope to substantially influence or be involved in their proper deployment or privacy realization.
We believe that if we do not stay current with the support of new web technologies, we cannot hope to substantially influence or be involved in their proper deployment or privacy realization.
However, we will likely disable high-risk features pending analysis, audit, and mitigation.
However, we will likely disable high-risk features pending analysis, audit, and mitigation.