> Waterfox does not collect ANY telemetry, meaning you don't have to worry about any tracking or usage information about what you do inside YOUR browser.
This is woefully uninformed or malicious. There's a lot of tracking that is out of your hands. Such as canvas fingerprinting. Even sending back 0's (like tor does) doesn't prevent fingerprinting. In either case I lost confidence for the browser just by reading what was on their landing page.
Either they don't know that tactics like this are common, which means that they likely aren't aware of other basic security flaws. Or they are aware and lying, which begs the question of how we can trust anything else.
In either case it doesn't build trust for a tool that is so highly dependent upon trust.
I think they are claiming "you don't have to worry about any tracking or usage information being sent to the Waterfox developers," but if so, they shouldn't say "you don't have to worry" (see also Lavabit and Protonmail's "you don't have to worry about government surveillance... well, not until the government decides to surveil you"). I agree it's weird for a web browser of all products to omit this clarity!
That's fair, but it is also very misleading. It also isn't hard to see how it is misleading, enough so that I'm sure I'm not the first to notice it and that I would assume it has been brought to their attention. If not, well... someone ping them.
I don't think it's misleading in the slightest.. When you disable telemetry in an application or operating system, you're disabling that application's collection and transmission of metrics to its developers.
Disabling telemetry in Windows doesn't prevent programs from collecting metrics, it disables the transmission of Windows metrics to Microsoft. Can you give an example of the kind of 'disable telemetry' option you describe which prevents third parties from fingerprinting or transmitting data?
Sure! On an iPhone, Settings | Privacy | Analytics | Share with App Developers (there's an option "Share iPhone Analytics" right before it that has explanatory text that says it's specifically about sharing with Apple) and Settings | Privacy | Advertising | Limit Ad Tracking.
On the browser side, options about camera access, microphone access, location sharing, etc. are about sharing it with websites, who are not entitled to make their own permission prompts. Options about third-party cookies affect third-party cookies from websites, not from third parties who work with the browser developer.
I'm sorry, but this is a somewhat uncharitable analysis given the audience this browser is aimed at.
I took their statement in good faith to mean that their software doesn't actively send telemetry to all and sundry without you knowing.
Anyone concerned about privacy would already be aware of tracking that occurs once traffic has left the browser which is clearly difficult to influence.
It's not worded precisely, but I believe what they have in mind is tracking performed without prior consent by the browser author. Obviously if you don't block tracking scripts that doesn't protect you from websites that want to track you, but that's not the point of the statement.
> It's not worded precisely, but I believe what they have in mind is tracking performed without prior consent by the browser author.
That was my interpretation. If I tell someone "I'm not collecting any data on you, so you don't have to worry about being tracked", it would be odd for them to accuse me of lying or being incompetent since obviously the government is tracking them.
No, it's not obvious. If you don't have any idea how it works, it's easy to read in that statement that not including telemetry in the browser prevents all tracking, including by sites.
This seems more like people having different ideas of what the word 'telemetry' means than a malicious statement meant to mislead users. Telemetry metrics were used before the digital age in diving equipment, rockets, airplanes, factory equipment, etc. Traditionally, they are used exclusively to better understand and improve the performance of the device collecting them (and nothing else).
Recent unethical practices of either using true telemetry metrics for advertising purposes or collecting data not used to improve the software under the guise of 'telemetry' have muddied the meaning of the term. I agree that the author could change the phrasing in that blurb to use a different word which has not shifted meanings in the last decade.
Sorry maybe I worded it badly? But I thought the context of the sentence made it clear that Waterfox itself does not collect any telemetry or usage information.
This sentence has nothing to do with websites themselves.
I'll try and make the sentence a bit more obvious to avoid confusion :-)
Awesome! I think it makes sense to most people on HN, because we know about these things, but I doubt to anyone not on here (and I'm willing to bet more people than we'd suspect here).
I think there could be a simple fix that specifies that Watermark is not doing the tracking.
> Waterfox does not collect ANY telemetry, meaning you don't have to worry about us tracking or using information about what you do inside YOUR browser.
I think this sentence is still compelling and I don't find misleading.
> Or they are aware and lying, which begs the question of how we can trust anything else.
It raises the question [...].
I'd also say that while your points are valid, its perhaps a bit too black/white to completely distrust them based on such a statement. On the other hand, who's behind this browser exactly? With Mozilla Firefox, Mozilla is behind it, and development is in the open.
For Mozilla Firefox I can recommend CanvasBlocker [1] to mitigate the technique you described. However, it comes at a price: you'll have a harder time with captcha's.
This is like saying that a given browser is malicious, because it sends HTTP requests, accepts cookies and uses JS. It's a fork of Firefox (or distribution?), so you're barking up the wrong tree.
This is woefully uninformed or malicious. There's a lot of tracking that is out of your hands. Such as canvas fingerprinting. Even sending back 0's (like tor does) doesn't prevent fingerprinting. In either case I lost confidence for the browser just by reading what was on their landing page.
Either they don't know that tactics like this are common, which means that they likely aren't aware of other basic security flaws. Or they are aware and lying, which begs the question of how we can trust anything else.
In either case it doesn't build trust for a tool that is so highly dependent upon trust.