Firefox and Fastly take another step toward a privacy upgrade for the internet

Fastly and Mozilla are taking another important step toward a more secure and private internet with Firefox’s adoption of Fastly as an Oblivious HTTP (OHTTP) Relay in order to guarantee more privacy for Firefox users. We are thrilled to work in partnership with Firefox and Mozilla, who have a proven track record of investing in technologies that protect their users and working to improve the internet. How does Oblivious HTTP (OHTTP) work?

OHTTP is a spec and service architecture that engineers can use to enable more private communications between two parties by splitting the information about the requester from the information of the request being made. You can read more about OHTTP here, but the basic idea is that it is “double-blind” in the sense that the spec is designed so that there is never a single party who has all of the information about who is making a request, and what the request is. When OHTTP is not in use all of that data is mixed together, which leaves room for abuse or misuse, and also means that a malicious attack could gain access to that data. With OHTTP a new level of privacy is guaranteed. firefox blog image 2

Fastly serves as the OHTTP Relay, receiving a request from the OHTTP client (in this case it would be in the browser), that includes metadata about the requester which Fastly can read and strip away, as well as an encapsulated and encrypted request that is passed along through the relay as designed. Fastly never knows what information is in the request itself, and Mozilla never knows any of the metadata about the requester. Browsers are the beginning

The double blind communication enabled by a new generation of private-by-design technologies are impossible with HTTP alone. We believe that OHTTP, MASQUE*, and DAP** represent the beginning of a more private and secure future for all communications on the internet. Browsers occupy an important position, sitting between users and a great deal of their activity on the internet. When Firefox and other browsers adopt new technologies like this it sends an important signal that this level of privacy-by-design should be table-stakes going forward. Working toward a more private internet

This technology is still relatively complicated to implement, being adopted by larger organizations like the most popular browsers, but we are getting a glimpse of a future where more is possible. We have seen this before with the adoption of HTTPS, which is now expected and the default – not just for business and large organizations, but even for small personal websites.

Fastly views the work to bring OHTTP and other privacy protecting technologies to browsers and apps as a fundamental, necessary first step. Connected/smart device manufacturers, network hardware companies, and the consumer electronics industry at large are becoming more serious about compliance and privacy. And with the help of organizations like Mozilla, we are laying the groundwork for a future where applications – even smaller ones without the resources of an Apple, Google, Microsoft, or Mozilla, will be able to access OHTTP simply. We won’t arrive at this state tomorrow, but we are starting to have options for how to get there.

Our goal is to create a future where all internet communications are private through the democratization of these private-by-design technologies. We must start with specific use cases and particular protocols with organizations like Mozilla who share this vision, and are ready to be early adopters. Over time the aim is to broaden the use of the technology as the private communication pathways are more universally available and easy to use. We expect this to be pushed forward in at least a couple ways – first, by continued regulatory moves and privacy legislation that forces adoption of these kinds of technologies. Second, we expect it to evolve to be a standard that users expect, like the lock in their URL bar for HTTPS connections. This is the commoditization of privacy in a great way, where improved privacy becomes cheap to the point that it is only a negligible cost to adopt an improved standard, and a reputational cost if you don’t adopt it.

Fastly will not be the only option for providing a relay for this type of feature, but we do intend to be the best option. We intend to be the change we want to see in the internet and move all of us toward a future of complete privacy in internet traffic.

*MASQUE = Multiplexed Application Substrate over QUIC Encryption

**DAP = Distributed Aggregation Protocol (for privacy preserving measurement)

  • Em Adespoton@lemmy.ca
    link
    fedilink
    English
    arrow-up
    104
    ·
    edit-2
    1 year ago

    Good: this splits the data requests so that Mozilla and Fastly each hold only a part of the requests, and yet still stand in the way of leaking fingerprinting data from browser users to target websites.

    Bad: one more organization injected into the trust chain, one more point of both security and operational failure.

    • ButtDrugs@lemm.ee
      link
      fedilink
      arrow-up
      40
      ·
      1 year ago

      It seems like the will respect TLS, so in theory even if it failed and someone was able to intercept the request at the relay, they wouldn’t have access to the data. That being said"Harvest Now, Decrypt Later" is becoming more popular as people anticipate quantum computing may be able to crack these encryptions in bulk.

    • Melody Fwygon@lemmy.one
      link
      fedilink
      English
      arrow-up
      8
      arrow-down
      20
      ·
      edit-2
      1 year ago

      **DAP = Distributed Aggregation Protocol (for privacy preserving measurement)

      They’ve already screwed up. This is another way they’re trying to sneak unwanted bullshit into the fabric of the internet.

      Next I want you to look closely at this author.

      Jana Iyengar VP, Product, Infrastructure Services

      Uhuh. First problem is he’s a VP. This man’s job demands that what he sells makes MONEY first.

      Next let’s have a look at the mini bio. (Emphasis added)

      Jana Iyengar is VP of Product for Infrastructure Services at Fastly, where he is responsible for the core hardware, software, and networking systems that constitute Fastly’s platform. Prior to this, he was a Distinguished Engineer at Fastly, where he worked on transport and networking performance, building and deploying QUIC and HTTP/3, and serving as editor of the IETF’s QUIC specifications. He chairs the IRTF’s Internet Congestion Control Research Group (ICCRG). Prior to Fastly, he worked on QUIC and other networking projects at Google, before which he was an Associate Professor of Computer Science at Franklin & Marshall College.”

      It’s easy to miss because they LITERALLY gloss right over it. This dude is an ex-Googler.

      Hell. To. The. No. No. No. No. No!

      This is Telemetry, analytic and tracking crap BUILT RIGHT IN AT THE FUCKING PROTOCOL LEVEL

      NOPE! NOPE! NOPE! FUCK NOPE!

      Today’s unreadable hashes are tomorrow’s GUUIDs with Quantum Computing right around the fucking corner.

      What is confirmed as cryptographically sound for now, may not be for even the remainder of the decade.

  • Chaos@lemmy.world
    link
    fedilink
    arrow-up
    55
    arrow-down
    5
    ·
    edit-2
    1 year ago

    Fire fox is living up to it’s name as they are on fire. Everytime I see a tech update from any of the major players it’s always bad, except Firefox. Keep being real. I luv u

  • Vexz@kbin.social
    link
    fedilink
    arrow-up
    12
    ·
    edit-2
    1 year ago

    Sounds nice and all but Google won’t adopt this for sure and many other big tech companies that have much power on the internet, like Cloudflare.

    Edit:
    Guess I was wrong.

    • icedterminal@lemmy.world
      link
      fedilink
      English
      arrow-up
      21
      ·
      1 year ago

      I doubt that Cloudflare won’t adopt it. They’re actually pretty privacy focused. What’s funny about your comment, is at the time of viewing, the comment above yours in this thread links to the authoring of the draft. Which lists an employee from Mozilla and an employee from Cloudflare. Repo for the source draft is here. If you view the commits you can see authors. Click the names to view their profiles

  • No Face@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    5
    arrow-down
    1
    ·
    1 year ago

    Question: with this introducing another party into these requests, wouldn’t this be exposing you to another company? If i recall correctly, Firefox connects to cloudflare by default.

    • Em Adespoton@lemmy.ca
      link
      fedilink
      English
      arrow-up
      20
      ·
      1 year ago

      See my comment earlier; what they’ve done is split the PII so that Mozilla and Cloudflare get less of it and Fastly only gets to handle the encrypted parts. It’s a good approach to PII siloing that ensures no one player gets enough to be actionable.

      That said, it still introduces yet another party/point of failure.

  • TCB13@lemmy.world
    link
    fedilink
    English
    arrow-up
    8
    arrow-down
    44
    ·
    edit-2
    1 year ago

    Here you go:

    Fastly a CDN, yet another honeypot for user tracking, and Mozilla, the company that is very well known for adding unique IDs to each installer downloaded from their website are taking another important step towards intercepting internet traffic with Firefox’s adoption of Fastly as an Oblivious HTTP (OHTTP).

    • BolexForSoup@kbin.social
      link
      fedilink
      arrow-up
      22
      arrow-down
      1
      ·
      1 year ago

      Interesting. You’re probably the first person in years I’ve seen critical of firefox from a privacy standpoint. You really think they’re that bad? Genuinely asking.

      • Apollo2323@lemmy.dbzer0.com
        link
        fedilink
        arrow-up
        24
        ·
        1 year ago

        If they are that bad according to him , idk what browser he uses because there is no other option. Firefox is the only non google browser , then brave and all those other shittie chromium browsers.

      • TCB13@lemmy.world
        link
        fedilink
        English
        arrow-up
        7
        ·
        edit-2
        1 year ago

        Firefox is better than most, no double there, but still how can one be okay the unique ID thing? https://www.ghacks.net/2022/03/17/each-firefox-download-has-a-unique-identifier/

        We also all know that CDNs and/or Google Fonts have been, since always, just a very clever way to track users so this move doesn’t inspire much confidence.

        Another thing about Firefox that people should do is launch Wireshark alongside it and see how much calling home and even calling 3rd parties it does. I know all others do it, except for Ungoogled and because of that reason I’m sticking with Ungoogled. I would like to avoid programs that need no snitch whenever you open them.

        • BolexForSoup@kbin.social
          link
          fedilink
          arrow-up
          4
          ·
          1 year ago

          I mean what would you use instead? I just don’t think there is a single, reasonably functional browser out there with privacy as good as FF’s. If there is I truly am all ears. I run little snitch mini a ton and FF doesn’t seem to trip it off, but I’m sure some stuff happens I haven’t caught. Always good to scrutinize these things though.

          • TCB13@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            arrow-down
            1
            ·
            edit-2
            1 year ago

            Little Snitch most likely has rules in place that allow tons of requests to still happen. Get Wireshark, disable LS for a bit, launch Firefox and observe. From basic ocsp requests to calling Firefox servers and a 3rd party company that does analytics they do it all, even after disabling most stuff in Settings and config.

            ungoogled-chromium + ublock origin + decentraleyes + clearurls and a few others.

            • BolexForSoup@kbin.social
              link
              fedilink
              arrow-up
              3
              ·
              edit-2
              1 year ago

              I use Proton VPN + uBO so anymore extensions are at best redundant, at worst memory hogs and conflicting with each other. I found decentraleyes to be pretty worthless personally.

              It is probably time I set up wireshark yes

    • Botzo@lemmy.world
      link
      fedilink
      arrow-up
      14
      ·
      1 year ago

      These are absolutely reasonable criticisms.

      But Mozilla is better that the big G in this respect, and fastly is at least attempting to do something. So for that, I give them kudos. Especially on the heels of the Encrypted Hello announcement.