Firefox and Fastly take another step toward a privacy upgrade for the internet
Fastly and Mozilla are taking another important step toward a more secure and private internet with Firefox’s adoption of Fastly as an Oblivious HTTP (OHTTP) Relay in order to guarantee more privacy for Firefox users. We are thrilled to work in partnership with Firefox and Mozilla, who have a proven track record of investing in technologies that protect their users and working to improve the internet. How does Oblivious HTTP (OHTTP) work?
OHTTP is a spec and service architecture that engineers can use to enable more private communications between two parties by splitting the information about the requester from the information of the request being made. You can read more about OHTTP here, but the basic idea is that it is “double-blind” in the sense that the spec is designed so that there is never a single party who has all of the information about who is making a request, and what the request is. When OHTTP is not in use all of that data is mixed together, which leaves room for abuse or misuse, and also means that a malicious attack could gain access to that data. With OHTTP a new level of privacy is guaranteed. firefox blog image 2
Fastly serves as the OHTTP Relay, receiving a request from the OHTTP client (in this case it would be in the browser), that includes metadata about the requester which Fastly can read and strip away, as well as an encapsulated and encrypted request that is passed along through the relay as designed. Fastly never knows what information is in the request itself, and Mozilla never knows any of the metadata about the requester. Browsers are the beginning
The double blind communication enabled by a new generation of private-by-design technologies are impossible with HTTP alone. We believe that OHTTP, MASQUE*, and DAP** represent the beginning of a more private and secure future for all communications on the internet. Browsers occupy an important position, sitting between users and a great deal of their activity on the internet. When Firefox and other browsers adopt new technologies like this it sends an important signal that this level of privacy-by-design should be table-stakes going forward. Working toward a more private internet
This technology is still relatively complicated to implement, being adopted by larger organizations like the most popular browsers, but we are getting a glimpse of a future where more is possible. We have seen this before with the adoption of HTTPS, which is now expected and the default – not just for business and large organizations, but even for small personal websites.
Fastly views the work to bring OHTTP and other privacy protecting technologies to browsers and apps as a fundamental, necessary first step. Connected/smart device manufacturers, network hardware companies, and the consumer electronics industry at large are becoming more serious about compliance and privacy. And with the help of organizations like Mozilla, we are laying the groundwork for a future where applications – even smaller ones without the resources of an Apple, Google, Microsoft, or Mozilla, will be able to access OHTTP simply. We won’t arrive at this state tomorrow, but we are starting to have options for how to get there.
Our goal is to create a future where all internet communications are private through the democratization of these private-by-design technologies. We must start with specific use cases and particular protocols with organizations like Mozilla who share this vision, and are ready to be early adopters. Over time the aim is to broaden the use of the technology as the private communication pathways are more universally available and easy to use. We expect this to be pushed forward in at least a couple ways – first, by continued regulatory moves and privacy legislation that forces adoption of these kinds of technologies. Second, we expect it to evolve to be a standard that users expect, like the lock in their URL bar for HTTPS connections. This is the commoditization of privacy in a great way, where improved privacy becomes cheap to the point that it is only a negligible cost to adopt an improved standard, and a reputational cost if you don’t adopt it.
Fastly will not be the only option for providing a relay for this type of feature, but we do intend to be the best option. We intend to be the change we want to see in the internet and move all of us toward a future of complete privacy in internet traffic.
*MASQUE = Multiplexed Application Substrate over QUIC Encryption
**DAP = Distributed Aggregation Protocol (for privacy preserving measurement)
Here you go:
Fastly a CDN, yet another honeypot for user tracking, and Mozilla, the company that is very well known for adding unique IDs to each installer downloaded from their website are taking another important step towards intercepting internet traffic with Firefox’s adoption of Fastly as an Oblivious HTTP (OHTTP).
Interesting. You’re probably the first person in years I’ve seen critical of firefox from a privacy standpoint. You really think they’re that bad? Genuinely asking.
Firefox is better than most, no double there, but still how can one be okay the unique ID thing? https://www.ghacks.net/2022/03/17/each-firefox-download-has-a-unique-identifier/
We also all know that CDNs and/or Google Fonts have been, since always, just a very clever way to track users so this move doesn’t inspire much confidence.
Another thing about Firefox that people should do is launch Wireshark alongside it and see how much calling home and even calling 3rd parties it does. I know all others do it, except for Ungoogled and because of that reason I’m sticking with Ungoogled. I would like to avoid programs that need no snitch whenever you open them.
I mean what would you use instead? I just don’t think there is a single, reasonably functional browser out there with privacy as good as FF’s. If there is I truly am all ears. I run little snitch mini a ton and FF doesn’t seem to trip it off, but I’m sure some stuff happens I haven’t caught. Always good to scrutinize these things though.
Little Snitch most likely has rules in place that allow tons of requests to still happen. Get Wireshark, disable LS for a bit, launch Firefox and observe. From basic ocsp requests to calling Firefox servers and a 3rd party company that does analytics they do it all, even after disabling most stuff in Settings and config.
ungoogled-chromium + ublock origin + decentraleyes + clearurls and a few others.
I use Proton VPN + uBO so anymore extensions are at best redundant, at worst memory hogs and conflicting with each other. I found decentraleyes to be pretty worthless personally.
It is probably time I set up wireshark yes
These are absolutely reasonable criticisms.
But Mozilla is better that the big G in this respect, and fastly is at least attempting to do something. So for that, I give them kudos. Especially on the heels of the Encrypted Hello announcement.