diff --git a/Ghostery.md b/Ghostery.md index 6b44a07..350b45f 100644 --- a/Ghostery.md +++ b/Ghostery.md @@ -3,16 +3,24 @@ Ghostery helps you browse smarter by giving you control over ads and tracking technologies to speed up page loads, eliminate clutter, and protect your data. # FAQ -1. Why would I use Ghostery over uBlock Origin? -2. -3. -4. -5. -6. Opt In / Opt Out -7. -8. -9. -10. +## Ghostery vs. uBlock Origin: Which is better? +1.1 Why would I use Ghostery over uBlock Origin? +1.2 Ghostery with uBlock Origin + +## Ghostery & Privacy Badger +2.1 Do I still need Privacy Badger? + +## Rewards Program +3.1 Ghostery Rewards +3.2 I'd rather just pay you for your software, and then we can have mutual trust. +3.3 So if one opts out of the "Rewards" system, no data is collected or stored, neither locally or anywhere else? Or is this data still collected in case user would have a change of mind and turn "Rewards" back on? + +## Human Web +4.1 What is Human Web? + +## Cliqz +5.1 Who is Cliqz? +5.2 I heard Cliqz has shut down. Does that mean Ghostery has too? ### Why would I use Ghostery over uBlock Origin? [uBlock Origin](http://https://ublockorigin.com) is an amazing extension, no question. There are still differences with Ghostery, though, which would make people use one or the other. Putting the UI aside (some people really like the Ghostery UI and the way it allows to gain insight about what was blocked for example), there are differences in the privacy protection built-in. @@ -36,23 +44,21 @@ Of course it depends on how you setup uBlock Origin, the more you block the bett On top of the part actively protecting privacy like anti-tracking and content blocking, there are other features to clear cookies from tracker domains to keep a "clean slate", etc. (A bit like what [Safari](https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/) and [Firefox](https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Privacy/Redirect_tracking_protection) have implemented). For example, Ghostery clears **cookies from tracking domains that you did not visit as first parties** after an hour or so, hardening the protection further. [^1] ### But I've heard that Ghostery couldn't be trusted... -You might be referring to the pre-2017 era where Ghostery belonged to a company named [Evidon](https://www.ghostery.com/faqs/who-is-evidon/) (which had a business model of collecting and selling data to other companies). It was then acquired by Cliqz (which builds a private and independent search engine as well as privacy-focused browsers). Since then the business model has been dropped, code has been [open-sourced](https://github.com/ghostery/ghostery-extension/) and Ghostery is now exploring ways to monetize through [paid products](https://www.ghostery.com/insights/), as well as client-side offers targeting called [rewards](https://www.ghostery.com/faqs/what-is-ghostery-rewards/). [^2] +You might be referring to the pre-2017 era where Ghostery belonged to a company named [Evidon](https://www.ghostery.com/faqs/who-is-evidon/) (which had a business model of collecting and selling data to other companies). It was then acquired by Cliqz (which builds a private and independent search engine as well as privacy-focused browsers). Since then the business model has been dropped, code has been [open-sourced](https://github.com/ghostery/ghostery-extension/) and Ghostery is now exploring ways to monetize through [paid products](https://www.ghostery.com/insights/), as well as client-side offers targeting called [rewards](https://www.ghostery.com/faqs/what-is-ghostery-rewards/). [^2] ### Does Ghostery collect and sell my data? -Ghostery neither collects nor sells data about users or trackers. In fact, we even open the insights we have about the tracking landscape via https://whotracks.me/, so that everyone can benefit from it. [^3] +Ghostery neither collects nor sells data about users or trackers. In fact, we even open the insights we have about the tracking landscape via https://whotracks.me/, so that everyone can benefit from it. [^3] ### "Ghostery does not have much customization or fine-grained controls (dynamic filtering, medium mode, element picker etc.)." - This is an interesting point and I think it is worst pointing out that Ghostery is aiming at providing the best privacy protection out of the box. This also means that IMO there is less of a need for dynamic filtering and medium mode, which are (I think), mostly needed because of the limitations of content blocking (e.g. not all requests can be blocked otherwise websites are broken, so there needs to be a way to fine-tune the behavior manually). On the other hand, in Ghostery we introduced (alongside the traditional content blocker or adblocker), an [anti-tracking feature](https://0x65.dev/blog/2019-12-19/blocking-tracking-without-blocking-trackers.html) which is not based on blocklists, and is able to remove unsafe datapoints (e.g. fingerprints, third-party cookies, unique identifiers, etc.) from requests without having to block them, drastically reducing breakage. It's great to offer customization options, but this does not automatically translate into better privacy (and there are other ways to increase the privacy protection and reduce breakage). In the end these features are targeted at power users, but I would argue that they are not necessarily increasing the privacy offered by the extension (e.g., Ghostery anti-tracking does not require any customization but still allows to remove unsafe data points from all requests with lower breakage rate than content blockers). -To summarize, I agree that uBlock Origin gives more customization options, but I don't think this is necessarily the most relevant metric to compare extensions. I would rather focus on the privacy protection offered (especially out of the box, since most users will likely not change the settings). [^4] +To summarize, I agree that uBlock Origin gives more customization options, but I don't think this is necessarily the most relevant metric to compare extensions. I would rather focus on the privacy protection offered (especially out of the box, since most users will likely not change the settings). [^4] ### Ghostery with uBlock Origin - How do you define a tracker? How can you be sure that all trackers are blocked by static lists? How long does it take to create a filter when a new tracker domain is created? As far as I can see, there are a lot of exception filters to unbreak sites, what happens if these request send unsafe datapoints which can track users? Take some random domains and look for cases of requests containing unsafe data being sent while having uBlock Origin enabled (default settings). Check lesnumeriques.com, visit a few pages and look for ultimedia.com: it tries to set a tracking cookie. Same for economist.com (check tinypass, not blocked but sets a tracking cookie, Ghostery removes the cookie from request), same on msn.com, visit a few pages and check platform.twitter, tries to send tracking cookie (blocked by Ghostery but not uBlock Origin), etc. Of course you could arbitrarily harden the settings of your content blocker, block third-party cookies, etc. but this comes with breakage, and unless you block everything, you will never be sure that all trackers are blocked. @@ -60,7 +66,7 @@ Take some random domains and look for cases of requests containing unsafe data b My point is not that uBlock Origin is doing a bad job; in fact, I think that this is an amazing content blocker. But there are some fundamental limitations to content blocking which prevent it from being able to perfectly protect privacy, for few reasons: * Not all requests can be blocked (or you break websites, login workflows, etc.), so you need to create exceptions and whitelist requests, which leaves privacy of users at risk. * It can take time for maintainers to create rules for new trackers. For some less known websites, rules might not even exist (yet). -* It is not necessarily possible to identify what a tracker even is by just looking at requests, without having a way to know if the values sent (e.g. cookies, query params, etc.) are unique to a specific users or shared by many. [^5] +* It is not necessarily possible to identify what a tracker even is by just looking at requests, without having a way to know if the values sent (e.g. cookies, query params, etc.) are unique to a specific users or shared by many. [^5] ### Do I still need Privacy Badger? Privacy Badger is, to the best of my knowledge, the only other popular extension which uses some kind of heuristics to block tracking. There are some fundamental differences in how Privacy Badger and Ghostery work, though. @@ -78,7 +84,7 @@ We do identify potential user-identifiers (i.e. any value which would allow to i Also, as explained in my original answer, all messages are anonymized and no record linkage can be done on the server side (we have no way to know if two messages come from the same users). We wrote extensively how this is possible in our two blog posts about Human Web and our anonymization network layer. Of course, this means that there is no unique identifier attached to messages. -Last but not least, yes the data you mention is useful for building features that are yet to come. For example, we needed data before we could launch the tracking protection feature few years back. There is a chicken and egg problem. Some seem to be very focused on the data part, without attempting to evaluate if that data compromises the privacy of the users in any way. Sorry, but it is not always the case that data implies lack of privacy, we wrote about it [here](https://0x65.dev/blog/2019-12-02/is-data-collection-evil.html). [^6] +Last but not least, yes the data you mention is useful for building features that are yet to come. For example, we needed data before we could launch the tracking protection feature few years back. There is a chicken and egg problem. Some seem to be very focused on the data part, without attempting to evaluate if that data compromises the privacy of the users in any way. Sorry, but it is not always the case that data implies lack of privacy, we wrote about it [here](https://0x65.dev/blog/2019-12-02/is-data-collection-evil.html). [^6] ### Ghostery Rewards @@ -94,16 +100,15 @@ Lastly, I'd like to challenge the idea that Rewards are juts like ads on the Web 3. The location where Rewards are shown is always the same and very predictable (top right of the screen, close to Ghostery menu), this also helps reduce the distraction when compared to ads on website which are usually placed they can capture your attention best (and is also where they are potentially the most annoying for users). -And of course this feature can be disabled, either during the onboarding described above or in the Ghostery settings at any point of time (menu "Opt In / Out"). +And of course this feature can be disabled, either during the onboarding described above or in the Ghostery settings at any point of time (menu "Opt In / Out"). [^7] ### I'd rather just pay you for your software, and then we can have mutual trust. - This is great to hear, but you are unfortunately part of a tiny minority of users who would like to pay for a privacy-extension or browser. Our past experience shows that most users are not willing to do so, and this is why Reward became a thing. For everyone else, we invest heavily on paid products such as [Ghostery Midnight](https://www.ghostery.com/midnight/) and [Ghostery Insights](https://www.ghostery.com/insights/) so that people who are willing to pay to support us can do so. This is definitely the cleanest and most transparent way to support Ghostery, and we would love if more and more people would pick it. -We will continue to work hard to improve the communication and transparency in the future and your feedback is very helpful in this regard. +We will continue to work hard to improve the communication and transparency in the future and your feedback is very helpful in this regard. [^8] ### So if one opts out of the "Rewards" system, no data is collected or stored, neither locally or anywhere else? Or is this data still collected in case user would have a change of mind and turn "Rewards" back on? -This is correct, when opted-out, the Rewards module is completely disabled and no data whatsoever is kept-track-of. The source code does not even run in fact. [^7] +This is correct. When opted-out, the Rewards module is completely disabled and no data whatsoever is kept-track-of. The source code does not even run, in fact. [^9] ### What is Human Web? * [Human Web — Collecting data in a socially responsible manner](https://0x65.dev/blog/2019-12-03/human-web-collecting-data-in-a-socially-responsible-manner.html) @@ -117,21 +122,46 @@ The anonymous data is always collected in such a way that it is specific to a us Detailing the anti-tracking use case a bit more, these anonymous statistics are used to learn about trackers throughout the Web and allow to protect all users in real time. It allows us to go beyond the usual blocklist approach (used by all adblockers) which requires humans to look at websites and create new rules (this can take days, putting privacy at risk); in contrast, our anti-tracking can detect new trackers in real time thanks to Ghostery users monitoring the internet and reporting new threats. We also open up these statistics to power https://whotracks.me/ so that anyone can learn about the tracking landscape (this is possible because the data is only about the trackers, not the users). -Of course, all of this can be turned-off if desired, but we make sure that there is no negative privacy side-effect if you don't. In fact, this helps protect the privacy of users (e.g. such as with anti-tracking described above which is made more powerful thanks to statistics contributed by users). -source https://www.reddit.com/r/privacytoolsIO/comments/f1bn8s/i_did_a_test_on_panopticlick_to_see_how_anonymous/fheg1x9 -https://www.reddit.com/r/degoogle/comments/eshkp0/microg_android_almost_without_google_our/ffpzv9x +Of course, all of this can be turned-off if desired, but we make sure that there is no negative privacy side-effect if you don't. In fact, this helps protect the privacy of users (e.g. such as with anti-tracking described above which is made more powerful thanks to statistics contributed by users). [^10] ### Who is Cliqz? -Cliqz GmbH is a German company owned by Hubert Burda Media who has acquired the popular Ghostery brand and consumer products, including the anti-tracking browser extensions and mobile apps, from Evidon, Inc. Cliqz is a provider of innovative, privacy-focused browser technologies with integrated quick-search functionality. By combining algorithmic and blocklist anti-tracking approaches, Cliqz and Ghostery will together raise the benchmark in privacy protection. The acquisition of Ghostery’s 10 million active users around the globe will spur Cliqz’s international growth. [^ ] -https://www.ghostery.com/faqs/who-is-cliqz/ +Cliqz GmbH is a German company owned by Hubert Burda Media who has acquired the popular Ghostery brand and consumer products, including the anti-tracking browser extensions and mobile apps, from Evidon, Inc. Cliqz is a provider of innovative, privacy-focused browser technologies with integrated quick-search functionality. By combining algorithmic and blocklist anti-tracking approaches, Cliqz and Ghostery will together raise the benchmark in privacy protection. The acquisition of Ghostery’s 10 million active users around the globe will spur Cliqz’s international growth. [^11] + +### Cliqz experiment with Mozilla +Regarding the experiment, I think it would be more correct to say "Mozilla's experiment with Cliqz" than the other way around, as the idea was for them to explore new ways to provide a more private search experience by default in Firefox (compared to default Google with query suggestions enabled), as well as a potential different way of generating revenue in a private way. Cliqz is just one way they experimented with, since we were building an independent search as well as privacy protection in our browsers already. Before the experiment our technologies were thoroughly audited for security and privacy (on top of the audits that we run regularly). Eventually the experiment ended and Mozilla decided to not proceed, but not because of security of privacy concerns; sadly, the communication about that was fairly bad. + +We [wrote more about this](https://0x65.dev/blog/2019-12-11/the-pivot-that-excited-mozilla-and-google.html) on our tech blog recently if you are interested. [^12] + +### I'm not really comfortable with the supposedly anonymous data being collected from user +Totally fair, not everyone has to be. This is also a tricky matter for us because we have to get some data in order to build a competitive search engine [1]. But we really do not want to collect any personal information at all about users. For this reason, we spent years coming up with a system to achieve this goal: Human Web. We wrote at length about its implementation on our tech blog [2] as well as the network anonymization layer that we built to ensure anonymity at the network level [3] (HPN). [^13] + +[1]: https://0x65.dev/blog/2019-12-02/is-data-collection-evil.html + +[2]: https://0x65.dev/blog/2019-12-03/human-web-collecting-data-in-a-socially-responsible-manner.html + +[3]: https://0x65.dev/blog/2019-12-04/human-web-proxy-network-hpn.html ### I heard Cliqz has shut down. Does that mean Ghostery has too? The Ghostery extension is alive and well. +### Hubert Burda Media has a majority share in the company and old German media companies have a history of getting internet related things wrong - should we not be worried about their influence on the company? +First of all, I think it is healthy to be skeptical about any company or community developing a privacy-centric product, in general. I too often see people in "privacy communities" who blindly accept advice about which extension to use/not use, etc. without spending a bit of time to check the facts. It requires time, but scrutiny is pretty important. + +That being said, Cliqz has a majority share holder: Hubert Burda Media. To start build a truly independent search engine (own search index with no reliance on another's search engine API; like Bing) with privacy built-in, requires initial funding. Cliqz has been working on it for years, as well as on privacy-preserving technologies (e.g. Anti-tracking) and browsers. I do not personally see Burda starting to ask us to do things which would put our users at risk, or go against our values: I would expect most people working at Cliqz to oppose strong resistance to that. + +But, even if something like that would happen, we built our technologies from the ground up to be harmless to our users, even if we turned evil. As an example, if you look at the way Human Web and HPN were built (from the blog articles I shared in my previous answer), any data collected is basically useless for any other use case than the one it was initially intended for; this also means that we cannot track back who sent which data . This non-reusability is primordial, as it means that we know just enough to do what we want to do (e.g. improve our search index or run our anti-tracking technology); but it would be impossible to repurpose the same data for anything else. This also implies that we have no way to know which user sent which data, thanks to the very strict checks implemented client-side to prevent record linkage (see Human Web) and our network anonymization layer (see HPN). [^14] + [^1]:https://www.reddit.com/r/technology/comments/f98tjg/firefox_turns_encrypted_dns_on_by_default_to/fir7npi/ -[^2]:https://www.reddit.com/r/AskReddit/comments/f298x0/what_chrome_extensions_make_the_internet_100x/fheeoco -[^3]:https://www.reddit.com/r/news/comments/g565bs/disney_to_stop_paying_100000_workers_but_is_still/fo2ossl -[^4]:https://www.reddit.com/r/firefox/comments/fa4twz/no_tracking_here_no_thank_you/fizyrow +[^2]:https://www.reddit.com/r/AskReddit/comments/f298x0/what_chrome_extensions_make_the_internet_100x/fheeoco/ +[^3]:https://www.reddit.com/r/news/comments/g565bs/disney_to_stop_paying_100000_workers_but_is_still/fo2ossl/ +[^4]:https://www.reddit.com/r/firefox/comments/fa4twz/no_tracking_here_no_thank_you/fizyrow/ [^5]:https://www.reddit.com/r/firefox/comments/fbb9wo/please_rethink_giving_the_extension_ghostery_the/fj71o66/ [^6]:https://www.reddit.com/r/firefox/comments/fbb9wo/please_rethink_giving_the_extension_ghostery_the/fj44vf5/ -[^7]:https://www.reddit.com/r/firefox/comments/f87xks/do_tracking_cookies_still_get_blocked_by_ff_if_i/fik2yfh \ No newline at end of file +[^7]:https://www.reddit.com/r/firefox/comments/f87xks/do_tracking_cookies_still_get_blocked_by_ff_if_i/fik2yfh/ +[^8]: https://www.reddit.com/r/firefox/comments/f87xks/do_tracking_cookies_still_get_blocked_by_ff_if_i/fik2yfh/ +[^9]: https://www.reddit.com/r/firefox/comments/f87xks/do_tracking_cookies_still_get_blocked_by_ff_if_i/fikjq62/ +[^10]:https://www.reddit.com/r/privacytoolsIO/comments/f1bn8s/i_did_a_test_on_panopticlick_to_see_how_anonymous/fheg1x9/ +[^11]:https://www.ghostery.com/faqs/who-is-cliqz/ +[^12]: missing +[^13]: missing +[^14]:https://www.reddit.com/r/degoogle/comments/eshkp0/microg_android_almost_without_google_our/ffpzv9x/ \ No newline at end of file