On Wednesday, Mozilla issued Firefox 72.0.1, which included one change: A patch for the vulnerability identified as CVE-2019-17026. “We are aware of targeted attacks in the wild abusing this flaw,” Mozilla said in the short description of the flaw, signaling that criminals were already leveraging the zero-day vulnerability, the term applied because there no time elapses between patching and exploitation.
Mozilla rated the vulnerability as “Critical,” the most serious rating in its multi-step ranking system. To manually update the browser, users can select Help > About Firefox on Windows or Firefox > About Firefox on macOS. The resulting page shows that the browser is either up to date or describes the refresh process.
Wednesday’s update was the first aimed at a zero-day vulnerability in Firefox since June, when Mozilla patched another critical type confusion flaw.
Google yesterday said that in four weeks Chrome would follow Firefox’s lead and tamp down on intrusive requests by websites to dun users with notifications.
“To protect notifications as a useful service … Chrome 80 will show, under certain conditions, a new, quieter notification permission UI [user interface] that reduces the interruptiveness [sic] of notification permission requests,” wrote PJ McLachlan, a Google product manager, in a Jan. 7 post to a company blog.
Chrome 80 is scheduled to release Feb. 4.
What Firefox is doing
Mozilla, the maker of Firefox, just rolled out version 72 this week. High on the list of new features for the browser: An end to intrusive, page-obscuring pop-ups from sites asking to send the user future notifications.
Firefox 72 will prevent most of these pop-ups from appearing. Instead, the browser will display a small cartoon speech bubble in the address bar, then briefly jiggle it for attention. The user can ignore it – leaving the bubble in place – or at any later time interact with it to show the pop-up and choose whether to accept notifications from the site.
Mozilla’s complaint about the site notification appeals rested on two facts. First, the vast majority of the requests are denied – ultimately, 99%, according to the firm’s research – and second, the pop-ups disrupt the user’s workflow.
Chrome’s take on the same problem
Google set a more conciliatory tone. Calling notifications “an essential capability” for some web applications, McLachlan also said it’s Google’s goal to “protect notifications as a useful service for users.”
Chrome 80 will treat site requests similarly to Firefox 72. Rather than allowing sites to place pop-ups on the page requesting permission to send notifications, Chrome 80 will slip into what Google called a “quiet UI” that features an alarm bell icon with a strike-through. On Chrome for the desktop, the icon will appear near the right edge of the address bar. (On mobile Chrome, it will show near the bottom of the screen.) The first time Chrome presents the quiet UI, an in-browser dialog, which can be dismissed, will explain the feature.
Users will be able to engage the new notification request UI manually using a new option found in Settings > Advanced > Privacy and security > Site Settings > Notifications. Toggling the “Use quieter messaging (blocks notification prompts from interrupting you)” switch turns on the pop-up blocker.
Google will also automatically enable the quieter UI for some users. Those who “repeatedly deny” the notification requests will be auto-enrolled, McLachlan said without going into specifics. Google will automatically silence some sites as well.
“Sites with very low acceptance rates will be automatically enrolled in quieter prompts,” McLachlan added. “They will be automatically unenrolled once the user experience is improved.”
McLachlan criticized sites that request notification permission right off the bat, saying that those websites often have very low acceptance rates. “We recommend that websites wait until users understand the context and see benefit in receiving notifications before prompting for the permission,” he wrote.
Google has frequently used Chrome to force websites to make changes that the search giant believes are beneficial to the web in general. A prominent example was Google’s push to get sites to adopt HTTPS. The Mountain View, Calif. company will use that same tactic here, punishing sites that don’t meet its guidelines – whatever they end up being – on notification appeals. It can wield the stick because of Chrome’s domination of the browser market: In December, 66.6% of all personal computer browser activity was credited to Chrome, overwhelming any rival (the closest competitor was Firefox, with a paltry 8.4%).
Firefox’s approach didn’t bother trying to influence websites on their notification practices for the simple reason that few would make changes under threat from Mozilla and its small browser share. Chrome, on the other hand, must be obeyed; to refuse risks largely losing control of notification requests.
Google has a reason for wanting notification entreaties to be less intrusive and disruptive: Anything that keeps users focused on tasks such as web searches – which then display Google’s ads – and not distracted by extraneous chores will better the firm’s bottom line.
Mozilla on Tuesday launched Firefox 72, which expanded picture-in-picture video mode to macOS and by default blocked “fingerprinting,” an advanced tracking method practiced by some sites and advertisers.
The open-source developers also patched 11 vulnerabilities, five labeled “High,” Mozilla’s second-most-serious threat rating. As usual, some of the flaws might be used by criminals. “We presume that with enough effort … it could be exploited to run arbitrary code,” the firm wrote of the CVE-2019-17017 vulnerability.
Firefox 72 can be downloaded for Windows, macOS and Linux from Mozilla’s site. Because Firefox updates in the background, most users need only relaunch the browser to get the latest version. To manually update on Windows, pull up the menu under the three horizontal bars at the upper right, then click the help icon (the question mark within a circle). Choose “About Firefox.” (On macOS, “About Firefox” can be found under the “Firefox” menu.) The resulting page shows that the browser is either up to date or describes the refresh process.
Mozilla now refreshes Firefox every five weeks; it last upgraded the browser on Dec. 3.
A month ago, Mozilla introduced Picture-in-Picture (PiP) with Firefox 71, touting the new feature’s ability to display video in a separate, small window while the user continues to surf elsewhere or even works outside the browser. Then, PiP was limited to Firefox running on Windows.
Firefox 72 expanded PiP to macOS – and if Mozilla’s December pledge was honored, Linux as well – and the feature works just as in Windows. Videos that will run in PiP were marked with a small, blue-backed “Picture-in-Picture” message when the mouse cursor hovers over the image. Clicking on that puts a frame on the desktop, video inside, and the frame can be moved and resized at will.
Firefox’s implementation of PiP is significantly smoother than Chrome’s – which requires a pair of right-clicks – in the videos where it’s available.
Scratch sites’ begging to blast you with notices
Another new aspect of Firefox 72 that Mozilla highlighted is its dampening down of the distraction from sites asking users to allow future notifications.
Those irritating pop-ups rarely result in users acquiescing to the request, Mozilla asserted. According to the company’s research, 48% of those prompts are “actively denied by the user” and a whopping 99% go unaccepted. In other words, they’re a vast waste of both websites’ and users’ time.
Firefox 72 blocks the notifications from reaching the screen – and obscuring part of the underlying page – and instead adds a small comic-style speech bubble, one that briefly jiggles for attention no less, to the address bar. Users can click on the bubble to pull up the usual notification pop-up – perhaps to dismiss it entirely and lose the bubble – or just ignore it. (It jiggles just once.)
Users can, of course, check the long-available box marked “Block new requests asking to allow notifications” in Options (Windows) or Preferences (macOS) to avoid all such irritants. (To reach that, from the “Privacy & Security” section, choose “Permissions,” then click the “Settings” button beside “Notifications.”)
Mozilla also trumpeted another addition to Firefox’s anti-tracking skillset that it baked into version 72.
“The latest Firefox browser protects you against fingerprinting by blocking third-party requests to companies that are known to participate in fingerprinting,” Mozilla said here.
Like cookie-based tracking, fingerprinting is used by sites and advertisers to follow users as they wander around the web, most infamously to continue to offer a product that an individual looked at previously. It’s akin to a salesperson following a customer not only around the store, dunning them to buy this or that, but leaving the store with them, tracking them across town and even all the way home.
Fingerprinting relies on piecing together clues – ranging from the browser version and device platform to installed fonts and extensions – to create a profile, hopefully one unique enough to distinguish from others’. Unlike cookie-based tracking, fingerprinting can continue to follow a user even after the browser’s been cleared or its privacy mode has been used to, supposedly, surf anonymously.
Firefox 72 has the fingerprinters portion of Enhanced Tracking Protection (ETP), Mozilla’s name for its collection of anti-tracking technologies, turned on by default. Even if the user has switched off ETP by disabling the other tracker types, the “Fingerprinters” option will be engaged.
Mozilla turned to its partner, Disconnect – which already provided the tracker list that served as the foundation of ETP – as the source of the fingerprints. “Disconnect maintains a list of companies that participate in cross-site tracking, as well a list as those that fingerprint users. Firefox blocks all parties that meet both criteria,” Steven Englehardt, a Mozilla senior privacy engineer, said in a Jan. 7 post to a company blog.
“Expect to hear more updates from us as we continue to strengthen the protections provided by ETP,” Englehardt added, without going into specifics.
The next version, Firefox 73, should launch Feb. 11.
Mozilla this week released Firefox 71, touting a picture-in-picture video mode and new ways to preview a VPN (virtual private networking) service that will be offered to customers next year.
Security engineers included patches for 11 vulnerabilities, six marked “High,” the second-most-serious threat rating. None were tagged “Critical.” Some of these flaws might be exploitable by cyber criminals, Mozilla said. “This could have caused heap corruption and a potentially exploitable crash,” the firm noted of one vulnerability, labeled CVE-2019-11745.
Firefox 71 can be downloaded for Windows, macOS and Linux from Mozilla’s site. Because Firefox updates in the background, most users need only relaunch the browser to get the latest version. To manually update, pull up the menu under the three horizontal bars at the upper right, then click the help icon (the question mark within a circle). Choose “About Firefox.” The resulting page shows that the browser is either up to date or describes the refresh process.
Mozilla refreshes Firefox every six to eight weeks; it last upgraded the browser Oct. 22.
PiP PiP, and all that
Mozilla trumpeted a new Picture-in-Picture (PiP) mode within Firefox 71. “Picture-in-Picture allows a video to be contained in a separate and small window, and still be viewable whether you switch from tab-to-tab or outside the Firefox browser,” wrote Marissa Wood, vice president of product, in a Dec. 3 post to a company blog._
Although PiP was available only in Windows’ version of Firefox 71, the feature will be baked into the next upgrades for macOS and Linux, Mozilla said. Currently, Firefox 72 has been pegged with a Jan. 7 release date.
(If that January ship date for Firefox 72 seems earlier than it should, it is. In September 2019, Mozilla announced it would speed up Firefox releases by reducing the interval between upgrades. Starting with Firefox 74, set to debut March 10, the interval will drop to just four weeks. Mozilla will shorten the interval in steps; the six-week stretch between Firefox 70 and 71 will be reduced to five weeks between 71 and 72, and between 72 and 73.)
Not every video will play in PiP; those that do will display a small blue-backed “Picture-in-Picture” when the mouse cursor is hovered over the image. Clicking on that message deposits a frame on the desktop, video inside. The frame can be moved and resized at will.
And as Wood mentioned, the video is independent of the tab from which it spawned; that tab does not need to remain active and, in fact, the user can step outside the browser to another application’s window and the video will continue.
Firefox is somewhat late to the PiP party. Apple’s Safari now has PiP – as of the October upgrade, macOS Catalina – and Google’s browser has had it since Chrome 70 (an October 2018 upgrade). But Firefox’s implementation is significantly easier to use than Chrome’s, which required two right-clicks to initiate in Windows (and Computerworld was never able to successful call up PiP in Chrome on macOS).
Testing, testing of services
Other than PiP, Mozilla’s other Firefox 71 area of attention is further testing of its “Firefox Private Network” (FPN), the browser extension the company released in September. FPN accesses a VPN-like service that encrypts browser-to-site-and-back traffic and was free to Firefox Account holders in the test phase that kicked off then. Website security vendor Cloudflare provided the proxy server for FPV.
That September offer, however, has been shuttered.
Instead, a second testing phase launched alongside the debut of Firefox 71. Like the first, this “limited-time free service” relies on the FPN add-on to encrypt to-and-from-browser transmissions but comes with a major restriction: Usage tops out at 12 hours each month.
After signing up for the free deal, users are given a dozen passes, each good for an hour of encrypted traffic. “To claim a pass, simply turn Private Network on,” the beta’s explanatory page stated. “Use Firefox as usual, and your browsing will be encrypted and sent through a proxy service provided by our trusted partner Cloudflare. Passes expire after one hour, even if you turn Private Network off. You’ll receive 12 new passes at the beginning of each month.”
Mozilla suggested that users switch on FPV (and so use one of the month’s 12 passes) when relying on a public network, such as at a coffee shop or an airport.
As an alternative, Firefox users can request an invitation to a full VPN service, which for $4.99 month encrypts traffic to and from up to five devices. Mozilla called this a “paid beta.” The VPN service uses servers around the globe controlled by Mullvad, a Swedish VPN that sells its services for €5 per month. Initially, the Firefox offer only applies to users running Windows 10, although Mozilla said, “other platforms coming soon.”
Mozilla on Tuesday upgraded Firefox to version 70, enhancing its anti-tracking technology with new blockers that automatically stymie social media trackers and compiling reports so users can see what spying the browser has stopped.
Security engineers at Mozilla also included patches for 13 vulnerabilities, one marked “Critical” and three marked “High,” the organization’s two top threat ratings. The critical flaw was described as “memory safety bugs,” a label that’s present in virtually every Firefox upgrade’s patch list. “Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could be exploited to run arbitrary code,” Mozilla wrote in the accompanying security advisory.
Firefox 70 can be downloaded for Windows, macOS and Linux from Mozilla’s site. Because Firefox updates in the background, most users need only relaunch the browser to get the latest version. To manually update, pull up the menu under the three horizontal bars at the upper right, then click the help icon (the question mark within a circle). Choose “About Firefox.” The resulting page shows that the browser is either up to date or describes the refresh process.
Mozilla updates Firefox every six to eight weeks; it last upgraded the browser on Sept. 3.
Stops trackers from Twitter, Facebook, LinkedIn
Mozilla amped up its assault on trackers, the bits and pieces in websites and on pages that collectively allow advertisers — primarily but not exclusively them — to watch where users go on the web in an effort to piece together profiles, which in turn are used to deliver advertisements that, theoretically at least, should be more appealing and likely to trigger a purchase.
On the heels of Firefox 69, which switched on Enhanced Tracking Protection (ETP) for all users, Mozilla this version added trackers from several social media giants — Facebook, Twitter and the jobs-related LinkedIn (owned by Microsoft) — to the browser’s block list.
“Social networks place trackers on other websites to follow what you do, see, and watch online,” Mozilla wrote. “This allows social media companies to collect data about your browsing history and improve their ad targeting.”
Users can set social media blockers at two strength levels — Standard (the default) and Strict — just as they can blockers for other classes of trackers.
Privacy report card
Firefox 70 also introduced a basic privacy report that describes the number of times the browser blocked a tracker — broken down by cross-site, social media, fingerprinter and cryptominer categories — over the past week with totals segregated by day.
The report also displays the number of email addresses monitored for inclusion in publicly-known data breaches, the number of those breaches and how many passwords were leaked in those hacks. (The data comes from Firefox Monitor, which Mozilla introduced a year ago.)
To access the report, click the shield-like icon in the address bar — it’s at the far left of the bar — then select “Show Report” from the drop-down menu. Or type about:protections in the address bar and hit Enter to bring up the report.
Mozilla has ulterior motives in pushing the report. The more impressed users are by the report’s totals — particularly the number of blocked trackers, cookies and content both — the more likely they are to stick with Firefox and recommend it to others.
Firefox has held on for the last two months in the fight over user share, but it’s still in the sub-9% cellar. Mozilla has banked on its privacy work, notably ETP, to bring in new users (or bring back deserters), so the only surprise is that it waited until now to debut a report lauding its accomplishments.
Lock ’em up, Danno!
During the summer, Mozilla started showing off a built-in Lockwise password manager in an under-baked preliminary version of Firefox 70. In that same preview, Mozilla demonstrated how Lockwise worked alongside its already-available Firefox Monitor, a service that provides warnings to users when their saved passwords have been revealed by a data hack.
The release version of Firefox 70 puts the two — the Lockwise password manager and the Monitor password revelation tool — in the hands of all users. And almost the way Mozilla outlined it earlier.
While Lockwise will crank out a password for the user when she creates a new account on a site, it’s not possible to ask the manager to craft one of those very strong passwords for an existing, stored account. That’s a pity, because that feature comes in handy in a third-party password manager when its user is told — because of a data breach, for instance — to change a password. And make it strong while they’re at it.
Other parts of Lockwise, notably those that come courtesy of the marriage between Lockwise and Firefox Monitor, are there, said Mozilla, but not testable because Computerworld couldn’t come up with an account revealed by a breach. The collaboration as described sounds slick: Exposed accounts are to be marked on the Lockwise page with both an icon in the list on the left and with a more prominent note in the main section on the right. (A Mozilla video shows how it’s supposed to look and work.)
One bit that was planned for the merger between Lockwise and Monitor — the ability to sort accounts so that revealed-by-hack usernames and passwords would be at the top of the list — didn’t make the cut with Firefox 70, as it was absent in the version pushed to users Oct. 22.
Elsewhere in Firefox 70, Mozilla claimed that it significantly reduced the browser’s power consumption on macOS (and published a technical thicket of a piece explaining that).
The next version, Firefox 71 — and the last of the year — should launch Dec. 3.
With the release of Firefox 70, Mozilla’s web browser now lets you track the trackers. Every user can view their own personalized Privacy Protections report showing them how many third-party trackers Firefox has blocked. Plus more besides.
called Enhanced Tracking Protection (ETP). This blocks third-party trackers by default for all users. In a nutshell, if a tracker is on the list maintained by Disconnect, Firefox will block it by default.
Now, Mozilla is offering users more information related to these online trackers. All users can view a Privacy Protections report showing you how many trackers Firefox has stopped, as well as fingerprinters and cryptominers. And it can make for scary reading.
How to Access Your Privacy Protections Report
Mozilla details its new Privacy Protections reports in a post on The Mozilla Blog. The headline being that since July 2 Mozilla has “blocked more than 450 billion tracking requests that attempt to follow you around the web.”
While that number is impressive, it’s too large to mean anything to individual users. Which is where the Privacy Protections reports come in. These show each individual Firefox user how many times ETP has blocked an attempt to tag you with cookies.
As well as revealing the number of cross-site and social media trackers, fingerprinters, and cryptominers Firefox has blocked, you’ll also find links to Firefox Monitor (which lists data breaches) and Firefox Lockwise (which securely store your passwords).
To access your Privacy Protection report, click the shield icon in the Firefox address bar to the left of the URL you’re currently on. You’ll then see information about the site you’re on, as well as the option to “Show Report” to reveal the overall statistics.
Not All Browser Cookies Are Created Equal
We suspect most people will be shocked by the number of trackers Firefox has blocked over the last few months. However, it’s important to note that not all trackers are bad. If you’re going to see ads online, isn’t it better to see ads relevant to your interests?
“We’re adjusting our cadence to increase our agility, and bring you new features more quickly,” wrote Ritu Kothari and Yan Or, the Firefox release management team leader and senior director of product integrity, respectively, in a post to Mozilla’s Hacks blog. “We’ve had many requests to take features to market sooner ((and)) feature teams are increasingly working in sprints that align better with shorter release cycles.”_
Mozilla will ease into the faster pace, said Kothari and Or. The next interval – between the already-out Firefox 69 and the future Firefox 70 – will remain at seven weeks but the next (between Firefoxes 70 and 71) will be shortened to six weeks. (Until the cadence change, the year’s final interval was to be seven weeks.) The next two upgrades, to Firefoxes 72 and 73, will take place in January and February, each five weeks after its predecessor. The pace will quicken to four weeks with Firefox 74, slated to ship in March, and remain there.
Kothari and Or showed a timetable of planned launch dates under the new scheme: The timetable indicated 13 releases of Firefox in 2020, or almost double the number of recent years. Mozilla delivered seven upgrades in 2017 and another seven in 2018; it’s slated to do the same this year. In 2018, the average interval between upgrades was 56 days, exactly twice the length of the future four-week span.
The two Mozilla officials touted the advantages of new 28-day interval. “Shorter release cycles provide greater flexibility to support product planning and priority changes due to business or market requirements,” Kothari and Or asserted. “With four-week cycles, we can be more agile, and ship features faster. Also, we put new features and implementation of new Web APIs into the hands of developers more quickly.”
Firefox Extended Support Release (ESR) – the designed-for-enterprise build that limits feature changes to about once each year – will not be affected by the faster tempo. “We anticipate a major ESR release every 12 months with three months support overlap between new ESR and end-of-life of previous ESR,” Kothari and Or said. The next two ESR releases will be in June 2020 and June 2021.
To account for the shorter periods of development, Mozilla will increase the frequency with which it cuts and distributes new betas, said Kothari and Or. “We will move to more frequent Beta builds, similar to what we have today in Firefox Nightly,” the two wrote.
And even though it will be even more important than before to move customers from one version to the next, Mozilla still intends to roll-out each new Firefox in stages so that if a problem pops up, it does not affect everyone.
Mozilla earlier this month quietly outlined paid support for enterprise users of Firefox, but last week scrubbed the reference from its website, saying that it is “still exploring that option.”
The offering – labeled “Mozilla Enterprise Client Support” – was to start at $10 per “supported installation,” which likely referred to per-device, not per-user, pricing. It’s unclear whether that was an annual or monthly fee, and Mozilla declined to say which it was when asked.
In return for the fee, Mozilla said on the now-absent Firefox enterprise site – still visible through the Internet Archive’s Wayback Machine – customers would be able to privately report bugs via a new web portal and receive fixes on a timeline dependent on the impact and urgency of the problem. Customers would also be able to file requests for help with Firefox’s installation and deployment, management policies, functionality and customization.
Support customers were to have an inside track on feature requests – although Mozilla said it would not commit to delivering said features – and Mozilla would provide them with “proactive notification on critical Firefox events,” although the company did not describe what that would entail.
A detailed service level agreement (SLA) for Mozilla Enterprise Client Support published on the firm’s website included everything from how support requests would be escalated and the targeted response times.
Other information, including pricing, required customers to reach out to Mozilla’s sales staff.
But on Monday, Mozilla said it was all premature.
“We work in the open, so often ideas under consideration are made public before we’ve committed fully to their pursuit,” a Mozilla spokesperson said in an emailed statement. “The page outlining that these paid support services for enterprise clients will be available was posted incorrectly.”
But the spokesperson did not dispute that Mozilla might get around to selling support. Firefox’s enterprise roadmap “could eventually include additional paid support down the line,” Mozilla said, “but we’re still exploring that option.
“As we continue to improve our enterprise offerings, we will share more details about what those services will entail,” the spokesperson said.
It was hard to see the posting of the paid support information as an accident. According to the WayBack Machine’s archives, the description of Mozilla Enterprise Client Support first appeared on the site on Sept. 4. It was still there on Sept. 11, a week later, a long time for a mistake to go unnoticed or uncorrected. Meanwhile, the program’s SLA remained untouched.
On Sept. 12, Martin Brinkman of Ghacks broke the news of Firefox paid support. By the next day, Sept. 13, the particulars had been expunged from Mozilla’s site. Almost certainly, Mozilla scotched the text after Brinkman’s story drew attention to the program.
Elsewhere, Mozilla referred to the program as an “initial pilot,” signaling that it has been, or would be, tested with some customers before being rolled out to all comers.
Money maker? Or money pit?
It would not be a surprise if – or when – Mozilla asks enterprises to pony up for better support. It’s not as if other developers don’t charge for support that goes above and beyond what’s available for free to the general public.
It might also be new revenue for Mozilla, which for years has cast about for ways to make money other than to sell the search engine default to companies like Google and Yahoo. (Although historically, software support often ends up as a cost center that doesn’t generate much if any revenue.)
Just as important, paid support could help Mozilla position Firefox as an alternative to Chrome – and to Microsoft’s Chromium-built Edge as well – in the enterprise. Manageability is important to corporate IT, but so is access to immediate support when mission-critical tools go south. In many ways, enterprise support is a box that needs to be checked for a developer to be seen as serious about the market, whether a large number of customers pay for such support or not.
Questions remain about Mozilla’s plans, though. Will Mozilla Enterprise Client Support apply to the rapidly-updated Firefox – the one consumers use – as well as Firefox Extended Support Release (ESR), the build which upgrades about once a year? Or only the business-grade latter? How will paid support integrate with other for-a-fee services that Mozilla plans, or does it need to? And importantly, will enterprises even pay for browser support?
Mozilla has relaunched its Test Pilot program, and kicked things off with a new project codenamed Firefox Private Network. This is essentially a VPN designed to protect you and your information when you’re browsing the web using Firefox.
for everyone, and now the company is launching its own virtual private network designed to keep its users safe.
How to Try the Firefox Private Network
Mozilla announced Firefox Private Network on The Mozilla Blog, describing it as “an extension which provides a secure, encrypted path to the web to protect your connection and your personal information anywhere and everywhere you use your Firefox browser.”
It’s essentially a VPN which offers protection while using Firefox on a public network and masks your IP address to prevent third-party trackers following you around the web. And you can toggle Firefox Private Network on or off at any time.
Protect yourself from hackers lurking in plain sight on public connections by being one of the first to start testing out our Firefox Private Network, now in beta in the US!https://t.co/PTe6FmkEgX
The Firefox Private Network is currently being beta tested. You’ll need to be resident in the US, have the Firefox desktop browser installed on a PC or Mac, and have a Firefox account. Mozilla is promising to roll the beta out to other locales and platforms over time.
To try the Firefox Private Network, visit this page and follow the instructions. You need to install the addon and then click the icon that shows up in your toolbar. Then a dropdown menu will appear allowing you to toggle the Firefox Private Network on or off.
Paid VPNs Are Better Than Free VPNs
During the beta testing phase, Firefox Private Network is completely free to use. However, it looks like Firefox’s new VPN will cost money eventually, with Mozilla mentioning it will be exploring “possible pricing options” down the line.
Mozilla this week resurrected its Test Pilot preview program, offering Firefox users a free VPN-like service to encrypt browser-to-site-and-back transmissions over public networks.
“The Firefox Private Network is an extension which provides a secure, encrypted path to the web to protect your connection and your personal information anywhere and everywhere you use your Firefox browser,” wrote Marissa Wood, vice president of product, in a post to the Mozilla blog.
The free service is available immediately, but only to U.S.-based users running the desktop version of Firefox. A Firefox account – typically used for syncing copies of the browser on multiple devices – and an accompanying add-on are required.
Wood trumpeted Firefox Private Network using examples highlighting privacy, Mozilla’s raison d’être. The encryption, she argued, would “protect all your sensitive information like the web addresses you visit, personal and financial information” at unsecured public Wi-Fi hotspots. The service also masks the originating IP address “to keep advertising networks from tracking your browsing history.”
Website security vendor Cloudflare provided the proxy server for Firefox’s VPN (virtual private network), Mozilla said. (Cloudflare offers a VPN service, dubbed “Warp,” to its customers, as part of the new-this-year 18.104.22.168 DNS resolver app for iOS and Android.)
Once the add-on is installed and the user logs in with his or her account credentials, Firefox Private Network is extremely simple to operate: It’s either on or off. There are no settings, no options. Computerworld did notice a performance hit while browsing with Firefox Private Network engaged; sites appeared slower than with it disabled.
Mozilla was clear that the free part of Firefox Private Network would likely not last, as the organization intends to charge a fee at some point.
“Your feedback will be essential in making sure that we offer a full complement of services that address the problems you face online with the right-priced service solutions,” wrote Wood, referring not just to the VPN but also to other, still-undisclosed offerings. She added that the Firefox Private Network beta testing, which is what Test Pilot now is, will run through some variations to “explore technical and possible pricing options” for the service.
Mozilla has not hidden its desire to branch into new revenue territories to divest from the more-or-less-single-source of search engine royalties. In June, CEO Chris Beard and other Mozilla officials said that paid service subscriptions would roll out this fall, but assured users that the browser itself would remain free of charge. The VPN could be the first of several paid services pitched to Firefox users, or part of a larger all-in-one package; Mozilla hasn’t been clear about the form(s) this new revenue stream may take.
Nor did Wood say how long her team will test Firefox Private Network. However, she did position this iteration of Test Pilot differently than before. “The difference with the newly relaunched Test Pilot program is that these products and services may be outside the Firefox browser, and will be far more polished, and just one step shy of general public release,” she said.
Mozilla has been back and forth with Test Pilot. The name harks to 2009, when it described a data-gathering effort on how people used the web. In 2016, Test Pilot was refocused, that time for users to “try out experimental ((in-browser)) features and let us know what you think,” according to Nick Nguyen, a now-former vice president of Firefox. That version was written off in January, Mozilla saying at the time that it no longer needed a separate test bed for add-ons.