Dated March 17th 2022
Each Firefox download has a unique identifier
<https://www.ghacks.net/2022/03/17/each-firefox-download-has-a-unique-identifier/>

This data will allow us to correlate telemetry IDs with download tokens and
Google Analytics IDs. This will allow us to track which installs result from
which downloads to determine the answers to questions like, "Why do we see
so many installs per day, but not that many downloads per day?"

According to Mozilla's description, the identifier is used to analyze
downloading and installation trends among other things.

The feature is powered by Telemetry in Firefox and it applies to all Firefox
channels.

On 3/19/22 13:49, this is what Andy Burnelli wrote:
> Dated March 17th 2022
> Each Firefox download has a unique identifier
> <https://www.ghacks.net/2022/03/17/each-firefox-download-has-a-unique-identifier/>
>
> This data will allow us to correlate telemetry IDs with download tokens and
> Google Analytics IDs. This will allow us to track which installs result from
> which downloads to determine the answers to questions like, "Why do we see
> so many installs per day, but not that many downloads per day?"
>
> According to Mozilla's description, the identifier is used to analyze
> downloading and installation trends among other things.
>
> The feature is powered by Telemetry in Firefox and it applies to all Firefox
> channels.
So one download to a thumb drive and then 5 installs on 5 computers screws up the statistics huh!??!

On Sat, 19 Mar 2022 17:49:32 +0000
Andy Burnelli <spam@nospam.com> wrote:

> Dated March 17th 2022
> Each Firefox download has a unique identifier
> <https://www.ghacks.net/2022/03/17/each-firefox-download-has-a-unique-identifier/>
>
> This data will allow us to correlate telemetry IDs with download
> tokens and Google Analytics IDs. This will allow us to track which
> installs result from which downloads to determine the answers to
> questions like, "Why do we see so many installs per day, but not that
> many downloads per day?"
>
> According to Mozilla's description, the identifier is used to analyze
> downloading and installation trends among other things.
>
> The feature is powered by Telemetry in Firefox and it applies to all
> Firefox channels.

That's why I use Waterfox, it sends no telemetry to Mozilla.

On 3/19/2022 1:52 PM, Big Al wrote:
> On 3/19/22 13:49, this is what Andy Burnelli wrote:
>> Dated March 17th 2022
>> Each Firefox download has a unique identifier
>> <https://www.ghacks.net/2022/03/17/each-firefox-download-has-a-unique-identifier/>
>>
>> This data will allow us to correlate telemetry IDs with download tokens and
>> Google Analytics IDs. This will allow us to track which installs result from
>> which downloads to determine the answers to questions like, "Why do we see
>> so many installs per day, but not that many downloads per day?"
>>
>> According to Mozilla's description, the identifier is used to analyze
>> downloading and installation trends among other things.
>>
>> The feature is powered by Telemetry in Firefox and it applies to all Firefox
>> channels.
> So one download to a thumb drive and then 5 installs on 5 computers screws up the statistics huh!??!

Since I quite often use the release server, I'm not too concerned
for the moment.

If you're a paranoid personality, the Firefox infrastructure supported
by Google, such as lists of URLs to avoid, the act of connecting
and updating your list, there is a unique identifier generated from
the first visit. And you might be tracked by that (you contact
Google once a day to update your list and a cookie is used to correlate
you with other adword cookies or something).

If you want better quality browsers, you need ones where someone
has gone through and stripped all that cruft out.

But as far as I'm concerned, the terrorists have won. The number
of machines times installs times browsers, means I won't be sitting
around picking the wings off flies for amusement.

The browser people, are like a certain "APT" in malware parlance.
The APT in question, was known for being prolific. If a competitor
made just one really good malware, that APT would make fifty
weak-sauce malwares, in effect spray painting the audience. What
they lacked in finesse, they more than made up for in volume.
And that group is still in business, and successful, even if
they aren't noted for being clever.

And that's how we get our cookie-alternatives on browsers. Put
in fifty innocuous subsystems (um "System Workers"), every
second release, "hide the potato" in a different compartment.
It's not like when these things are reported, it's an "accident"
or a "mistake by a noob on our team".

Paul

On 3/19/22 18:49, Andy Burnelli wrote:
> Dated March 17th 2022
> Each Firefox download has a unique identifier
> <https://www.ghacks.net/2022/03/17/each-firefox-download-has-a-unique-identifier/>
>
>
> This data will allow us to correlate telemetry IDs with download tokens and
> Google Analytics IDs. This will allow us to track which installs result
> from
> which downloads to determine the answers to questions like, "Why do we see
> so many installs per day, but not that many downloads per day?"
>
> According to Mozilla's description, the identifier is used to analyze
> downloading and installation trends among other things.
>
> The feature is powered by Telemetry in Firefox and it applies to all
> Firefox
> channels.

FUD, try reproducing the ghacks "investigation", you'll be amazed.

dillinger wrote:

> FUD, try reproducing the ghacks "investigation", you'll be amazed.

I've always used the ghacks jason files for Firefox and found them complete.
(Almost too complete, in fact, as they covered just about everything.)

Do others on this ng concur with "dillinger" that ghacks are FUD spreaders?
Or do others who are like I am, usually find ghacks to have reliable data?

On 19/03/2022 23:24, Andy Burnelli wrote:

>
> Do others on this ng concur with "dillinger" that ghacks are FUD spreaders?

Yes I concur with dillinger that ghacks are FUD spreaders.

It's not just ghacks that says every Firefox is unique.

Even Mozilla says so.
https://support.mozilla.org/gl/questions/979250
"A unique browser ID is sent to Mozilla along with an IP Address
every time the browser checks for updates"

So does everyone else.
https://forum.devtalk.com/t/each-firefox-download-has-a-unique-identifier/45564
https://malwaretips.com/threads/each-firefox-download-has-a-unique-identifier.112869/#post-979572
https://news.ycombinator.com/item?id=30715163
https://www.reddit.com/r/technology/comments/thf6l1/each_firefox_download_has_a_unique_identifier/
https://www.askwoody.com/forums/topic/each-firefox-download-has-a-unique-identifier/
https://forum.endeavouros.com/t/each-firefox-download-has-a-unique-identifier/25135
https://www.dslreports.com/forum/r33358722-Firefox-Each-Firefox-download-has-a-unique-identifier
etc.

On 2022-03-19, Big Al <Bears@invalid.com> wrote:
> So one download to a thumb drive and then 5 installs on 5 computers screws up the statistics huh!??!

Ditto if you a utility to block Google analytics.

--
------------------------------------------------------------------------------
18 Reasons I won't be vaccinated -- https://tinyurl.com/ebty2dx3
Covid vaccines: experimental biology -- https://tinyurl.com/57mncfm5
The fraud of "Climate Change" -- https://RealClimateScience.com
There is no "climate crisis" -- https://climatedepot.com
Don't talk to cops! -- https://DontTalkToCops.com
------------------------------------------------------------------------------

On 3/20/22 01:43, Andy Burnelli wrote:
> It's not just ghacks that says every Firefox is unique.
>
> Even Mozilla says so.
> https://support.mozilla.org/gl/questions/979250
> "A unique browser ID is sent to Mozilla along with an IP Address
>  every time the browser checks for updates"
>
> So does everyone else.
> https://forum.devtalk.com/t/each-firefox-download-has-a-unique-identifier/45564
>
> https://malwaretips.com/threads/each-firefox-download-has-a-unique-identifier.112869/#post-979572
>
> https://news.ycombinator.com/item?id=30715163
> https://www.reddit.com/r/technology/comments/thf6l1/each_firefox_download_has_a_unique_identifier/
>
> https://www.askwoody.com/forums/topic/each-firefox-download-has-a-unique-identifier/
>
> https://forum.endeavouros.com/t/each-firefox-download-has-a-unique-identifier/25135
>
> https://www.dslreports.com/forum/r33358722-Firefox-Each-Firefox-download-has-a-unique-identifier
>
> etc.
Don't take my word for it, try it yourself.
There are a zillion ways to track you, this is not one of them.

dillinger wrote:

> There are a zillion ways to track you, this is not one of them.

I ran a test today to see if the hash was different with each download.
<https://download.mozilla.org/?product=firefox-latest&os=win&lang=en-US>

Name: Firefox Setup 98.0.1.exe
Size: 53527184 bytes (51 MiB)
SHA256: 77171D5A795B6EE9CAFB4ACF0B3289C8DEA8D29EBFCA34EC85FEA62539F88BCC

On 3/20/22 02:58, Andy Burnelli wrote:

> dillinger wrote:
>
>> There are a zillion ways to track you, this is not one of them.
>
> I ran a test today to see if the hash was different with each download.
> <https://download.mozilla.org/?product=firefox-latest&os=win&lang=en-US>
>
> Name: Firefox Setup 98.0.1.exe
> Size: 53527184 bytes (51 MiB)
> SHA256: 77171D5A795B6EE9CAFB4ACF0B3289C8DEA8D29EBFCA34EC85FEA62539F88BCC

Which is exactly what I get:

77171d5a795b6ee9cafb4acf0b3289c8dea8d29ebfca34ec85fea62539f88bcc
Firefox Setup 98.0.1 (1).exe

Interestingly, another download link gives another result, however still
always the same:

https://download.mozilla.org/?product=firefox-latest-ssl&os=win64&lang=en-US

340b13d52f3987ebb1c01b66cd389d26d5fa13db225f6dc135c3b4a8cca781b1
Firefox Setup 98.0.1.exe

So, the download link can be identified, but not you or me or ghacks.

dillinger wrote:

> So, the download link can be identified, but not you or me

Thanks for also running the test.
What matters appears to be _how_ you download it.

The web installer is what most people use.
That's the one that creates the unique link according to the reports.
Plus automatic updates do the same thing according to the reports.

Me?
I don't use any web installer for any product.

And I disable the auto-update on every product that allows that option.
{"policies": {
"DisableAppUpdate": true,
"DisableFirefoxStudies": true,
"DisableSystemAddonUpdate": true,
"DisableTelemetry": true
}
}
--
Every thread on Usenet is to help others out of the goodness of my heart.

On 3/19/2022 7:39 PM, Arlen Holder wrote:
> On 19/03/2022 23:24, Andy Burnelli wrote:
>
>>
>> Do others on this ng concur with "dillinger" that ghacks are FUD spreaders?
>
> Yes I concur with dillinger that ghacks are FUD spreaders.

The guy who runs ghacks, also operates sevenforums, eightforums,
tenforums, elevenforums.com as well. He writes a significant number
of the Tutorials filed on the sites. And amends them as the OS
version changes.

*******

Opened 1 year ago Closed 1 year ago
[Win] No attribution or dltoken data on a clean environment when downloading from https://www-demo3.allizom.org/en-US/firefox

https://bugzilla.mozilla.org/show_bug.cgi?id=1689596

PMAC and HMAC implies encryption. In their worked example,
they decrypt the token (using their internal tool) to the
underlying URL used for delivery.

( https://en.wikipedia.org/wiki/HMAC )

So they were working on tracking on their commercial site.

*******

On the Mozilla site, if you elect to download Firefox, you
are given a stub installer.

Name: Firefox Installer.exe
Size: 333,912 bytes (326 KiB)
SHA256: 662BA6649E5670DF57F43BE9F778B61BD0F06146A716F39320734D9F653E29D1

If you unpack the stub installer, there are such notable DLLs
as the following:

CityHash.dll

UserInfo.dll calls GetUserNameW

Now, if that isn't innocent looking fun, what is ?

In addition, how much "residue" from the stub installer
did you find (like %temp%) ? Did you run Recuva ? Neat, nothing there.

The stub installer seems "overly clever". It's going to be
hard to determine how custom an install you're getting,
with the stub installer. Maybe someone with idle time on
their hands, can track it with ProcMon.

Oh, by the way, here is a picture of the resulting "dltoken".

[Picture] If frame is empty, right-click and select "Reload"

https://i.postimg.cc/Pr28VPp5/my-dltoken.gif

Paul

Paul wrote:

> Oh, by the way, here is a picture of the resulting "dltoken".
>
> [Picture] If frame is empty, right-click and select "Reload"
>
> https://i.postimg.cc/Pr28VPp5/my-dltoken.gif

Thank you for confirming the unique token from the web install.

From what you've shown, it seems that perhaps there are two situations:
a. Web install (and from auto-update) ==> you are uniquely identified
b. Full network install ==> you are not

Does that seem to you like a reliable assessment?

On 3/20/2022 9:34 AM, Andy Burnelli wrote:
> Paul wrote:
>
>> Oh, by the way, here is a picture of the resulting "dltoken".
>>
>>     [Picture]  If frame is empty, right-click and select "Reload"
>>
>>     https://i.postimg.cc/Pr28VPp5/my-dltoken.gif
>
> Thank you for confirming the unique token from the web install.
>
> From what you've shown, it seems that perhaps there are two situations:
> a. Web install (and from auto-update) ==> you are uniquely identified
> b. Full network install ==> you are not
>
> Does that seem to you like a reliable assessment?

That seems likely, that the naive users are getting tagged.
Because they used the web install.

*******

It's up to Mozilla to decide whether there are any imaginary
firewalls between all their telemetry wells.

That token is a kind of GUID, which should map, somewhere, to
the information that was really collected. So presumably the
details uploaded during the install. And future references
just use the GUID.

Paul

Paul wrote:

> That seems likely, that the naive users are getting tagged.
> Because they used the web install.

That makes sense that they might want to care about the naive users even
more than the experienced ones (or at least in a different way).

They said so themselves, almost, when they said they were trying to figure
out why there are x number of installs but fewer-than-x number of downloads.

They do seem to be adding the unique id to the web "updates" (which is
different from the installs) but at least we can (supposedly) turn all that
telemetry stuff off once it's _already_ installed.

Johnny wrote:

> That's why I use Waterfox, it sends no telemetry to Mozilla.

You tempted me to investigate waterfox, unfortunately the first tab it opened
crashed instantly ... on reloading, it immediately closed again (without
actually crashing) only on the third attempt it did manage to show a home tab,
then it crashed when I went into Settings ... not a good impression!

Andy Burns wrote:

>> That's why I use Waterfox, it sends no telemetry to Mozilla.
>
> You tempted me to investigate waterfox, unfortunately the first tab it opened
> crashed instantly ... on reloading, it immediately closed again (without
> actually crashing) only on the third attempt it did manage to show a home tab,
> then it crashed when I went into Settings ... not a good impression!

I have Waterfox on my Win10 box (as I test _all_ free ad-free web browsers).
It does not crash - but I don't update it so let me check the version.
G2.2.5 (64-bit) based on Gecko 78.13.0 Waterfox is up to date

Hmmmmmmnnmmmmmm.... "up to date?"

In Waterfox Settings > General > Waterfox Updates, it says
(_) Automatically install updates (recommended)
(o) Check for updates but let you choose to install them

In Waterfox Settings > General > Updates > Show History, it says
Waterfox G3.2.6 (20210915125841)Details
Installed on: January 7, 2022, 2:01:37 PM
Status: Update server not found (check your internet connection)

Waterfox G3.2.5 (20210811084759)Details
Installed on: September 2, 2021, 12:42:56 AM
Status: The Update was successfully installed

From which I infer
a. Waterfox isn't updated all that frequently perhaps?
b. It tried to contact the mothership on install but I install offline
c. I must have manually updated it on September 2nd for some reason

I looked around for the typical "telemetry" settings but didn't see any.

Although I never know what to set when the web browser asks

Certificates
When a server requests your personal certificate
(?) Select one automatically
(?) Ask you every time
(?) Query OCSP responder servers to confirm the current validity

I don't even know what it is asking me.
Do you?

Andy Burnelli wrote:

> I have Waterfox on my Win10 box (as I test _all_ free ad-free web browsers).
> It does not crash - but I don't update it so let me check the version.
> G2.2.5 (64-bit) based on Gecko 78.13.0 Waterfox is up to date

My download was G4.0.8 which I think uses gecko 91.x

given that I didn't ask it to import any settings from another browser, it truly
was the worst out of the box experience I've had with any software for years.

Andy Burns wrote:

>> G2.2.5 (64-bit) based on Gecko 78.13.0 Waterfox is up to date
>
> My download was G4.0.8 which I think uses gecko 91.x

Thanks for that information where I was trying to help you but you seem to
have found a bug in the code since my Waterfox says it is up to date.
<https://i.postimg.cc/XNdPgMbQ/waterfox01.jpg> about:preferences#general

I definitely hit the "check for updates" button and I was on the net.
There must either be a bug or a difference in our respective setups.
Is your Waterfox 32 bit or 64 bit? (Mine is 64-bit for example.)

> given that I didn't ask it to import any settings from another browser, it truly
> was the worst out of the box experience I've had with any software for years.

To try to figure out why yours is newer version I went to my old link:
<https://www.waterfoxproject.org/en-US/waterfox/new/>
Which is no longer a valid URL so I went to my installer log files.

I originally installed Waterfox for testing in 8/2020 based on my logs.
<https://cdn.waterfox.net/releases/win64/installer/Waterfox%20Current%202020.07.2.1%20Setup.exe>
Date: 20200818
Name: Waterfox Current 2020.07.2.1 Setup.exe
Size: 50005152 bytes (47 MiB)
SHA256: 4AD44E410906F4B4AE28988BBC9FB6E8057D8D2FCCFC3E329F57CD0F5FEA2A1C

Based on that download URL, this URL is still valid as of today:
<https://cdn.waterfox.net/releases/win64/installer/>

Looking at that long list, maybe "Waterfox current" is different from
"Waterfox G#" - so maybe that's why my Waterfox thinks it's up to date.

Downloading the latest "G#" manually from that site I get this:
<https://cdn.waterfox.net/releases/win64/installer/Waterfox%20G4.0.8%20Setup.exe>
Date: 20220321
Name: Waterfox G4.0.8 Setup.exe
Size: 66868640 bytes (63 MiB)
SHA256: 76B964ECCED62345E831AA6F3BFCA1C92CF8E792D2E2779EDC8BDCB6C92DFD95

Hitting my software killswitch and running that installer to select "custom"
it wants to go in "C:\Program Files\Waterfox\" but I put it where it belongs
(which was on top of the old waterfox) where the installer said it would
"upgrade" the existing Waterfox installation & it had a "Launch Waterfox"
option at the end of the installation wizard steps.

Lo and behold, Waterfox G4.0.8 did _not_ launch.
Neither did it launch when I doubleclicked the desktop shortcut.
In fact, it seems to have _deleted_ but not replaced the old Waterfox!
<https://i.postimg.cc/4x17HqSQ/waterfox02.jpg>

Hmmmmmmnnn.mmmmnn...nnnmmm So I re-installed it and this time it installed.
<https://i.postimg.cc/HxH7DTTd/waterfox03.jpg>

But it still didn't come up when I allowed it to "Launch Waterfox" nor when
I doubleclicked on the "Waterfox" desktop shortcut the installer created.

It's not showing up in the process explorer tool either, even after
doubleclicking a half dozen times on that desktop shortcut.

Maybe the "G#" stuff is alpha code?

Andy Burnelli wrote:

> It's not showing up in the process explorer tool either, even after
> doubleclicking a half dozen times on that desktop shortcut.

I tried the penultimate WaterFox installer dated 14-Feb-2022 11:44
<https://cdn.waterfox.net/releases/win64/installer/>
<https://cdn.waterfox.net/releases/win64/installer/Waterfox%20G4.0.7%20Setup.exe>
Name: Waterfox G4.0.7 Setup.exe
Size: 67049208 bytes (63 MiB)
SHA256: 4E8B32FDEBFF4AF284C20D2EED58BFBB61C88C34B7F3895F887EB2E32218AB72
Same thing. No matter how many times I doubleclicked, it wouldn't launch.

Then I tried the one before that.
<https://cdn.waterfox.net/releases/win64/installer/Waterfox%20G4.0.6%20Setup.exe>
Name: Waterfox G4.0.7 Setup.exe
Size: 67049208 bytes (63 MiB)
SHA256: 4E8B32FDEBFF4AF284C20D2EED58BFBB61C88C34B7F3895F887EB2E32218AB72

Frustrated, I went to my USB stick software archives and pulled out
Date: 20200818
Name: Waterfox Current 2020.07.2.1 Setup.exe
Size: 50005152 bytes (47 MiB)
SHA256: 4AD44E410906F4B4AE28988BBC9FB6E8057D8D2FCCFC3E329F57CD0F5FEA2A1C

That came up with a warning:
"You've launched an older version of Firefox"
"Using an older version of Firefox can corrupt bookmarks and browsing
history already saved to an existing Firefox profile. To protect your
information, create a new profile for this installation of Waterfox."
And then it tried to phone home but I had the killswitch on so it couldn't
<https://www.waterfox.net/blog/waterfox-2020.07.2.1-release/?new>

At that point it wanted to update (of course) so I let it update.
Now it says it's "Waterfox G3.1.1.1 (64-bit) based on Gecko 78.8.0

And it went to this location: <https://www.waterfox.net/blog/>
Which says:
"An Update on Waterfox Classic, October 28, 2021
Since Waterfox Classic and Waterfox Current (now G4) diverged,
they have both have separate goals.

G4 has its eyes set to the future - a modern browser, focusing on
modern web compatibility without sacrificing speed, or the balance
of privacy and usability.

Classic has focused on keeping the tried but tested available.
Unfortunately, due to the rapid nature that the web is now expanding at,
keeping Classic up to date with that is difficult."

This is all so confusing but I can confirm this version of Waterfox works.
<https://i.postimg.cc/Nf43cDYX/waterfox04.jpg>

Andy Burnelli wrote:

> you seem to
> have found a bug in the code since my Waterfox says it is up to date.

I think they've deemed G4 is the "current" version and prior to that is now
"classic".

Andy Burnelli wrote:

> "An Update on Waterfox Classic, October 28, 2021
> Since Waterfox Classic and Waterfox Current (now G4) diverged, they have both
> have separate goals.
>
> G4 has its eyes set to the future - a modern browser, focusing on modern web
> compatibility without sacrificing speed, or the balance of privacy and usability.
>
> Classic has focused on keeping the tried but tested available.
> Unfortunately, due to the rapid nature that the web is now expanding at,
> keeping Classic up to date with that is difficult."

Yep, you'd think from that that G4 would be easiest to maintain, and would
actually *work* which you and I both seem to have found is not the case.

I'm not so interested in legacy browsers, certainkly I'm not going to install a
legacy browser that I haven't been using for years.

So I think waterfox is probably killing itself, but I have now remembered who
owns it ... it's no longer the small, independent browser ...

Andy Burns wrote:

> I think they've deemed G4 is the "current" version and prior to that is now
> "classic".

Thanks for pointing out that Waterfox split into two versions, classic & G4.

I've tested every free browser that I could find (where I have about a score
installed currently including all three Microsoft browsers working at the
same time); but I didn't realize Waterfox split into two different code
streams until you had pointed that out for me.

Together we've pretty much shown G4 isn't even rudimentarily tested on
Windows 10 (which is a pretty bad sign).

The "G3.1.1.1 (64-bit)" version is working, which I guess is the latest
"classic" version whose description is apparently here:
<https://github.com/WaterfoxCo/Waterfox-Classic>

Below is that description but notice the "removed startup profiling"
which was the topic earlier this week that Firefox does with the web stub.

The Waterfox source code is a specialised modification of the Mozilla
platform, designed for privacy and user choice in mind. You should be able
to install it and compile Waterfox without any issues. Other modifications
and patches that are more upstream have been implemented as well to fix any
compatibility/security issues that Mozilla may lag behind in implementing
(usually due to not being high priority). High request features removed by
Mozilla but wanted by users are retained (if they aren't removed due to
security).
Compiled with Clang-cl on Windows, Clang+LLVM on Linux
Disabled Encrypted Media Extensions (EME)
Disabled Web Runtime (deprecated as of 2015)
Removed Pocket
Removed Telemetry
Removed data collection
*Removed startup profiling*
Allow running of all 64-Bit NPAPI plugins
Allow running of unsigned extensions
Removal of Sponsored Tiles on New Tab Page
Addition of Duplicate Tab option
Locale selector in about:preferences > General