Mozilla's new Exa partnership: the privacy implications
Mozilla recently announced a partnership with the AI company Exa. They say:
Firefox is investing in partnerships with companies like Exa.ai to bring deep expertise in specific areas while sharing our commitment to user choice, privacy, and transparency.
They continue:
We’re picking partners for the same reason each time: people who think AI in a browser should work for you, not the other way around.
This is a little ironic when Exa's CEO describes it differently:
We’re organizing the world’s knowledge, but this time for AI
...But I digress. Mozilla promises three things above.
- User choice
- Privacy
- Transparency
I'll be looking into privacy exclusively (and leave the fact Exa is an undisclosed member of the Andreesen Horowitz portfolio for another day).
A Privacy Audit
Exa's privacy policy is short and troubling. It starts with an entitled attitude towards private data that might be available online:
Although publicly available data is not considered "personal information" under certain data privacy laws, we have nevertheless described how we collect, use and disclose such information...
This is an appeal to technical legality: common sense would dictate that a publicly leaked database of social security numbers would be personal information, but apparently the possibility that it's not explicitly enumerated under some (unnamed) privacy laws irks the AI company.
Not a great start, but maybe things get better...
When you use or access the Services, we collect certain categories of information about you from different sources. In addition to the specific uses discussed below, we may use this information to provide and improve the Services and to maintain our business relationship... and protecting our rights and the rights of our employees, users or other individuals.
What other individuals need this company'a protection? How will information be used to "improve" their product? These questions are unanswered. But we do get told a bit more about sources:
We and third parties also automatically collect certain information about your interactions with the Services, including through cookies, pixels or other tracking technologies. This information is collected and used to better understand user interactions with the Services, run analytics, monitor and improve performance, measure engagement and to tailor and enhance user experience. Such information includes:
Device information, such as device type, operating system, unique device identifier, and internet protocol (IP) address.
Location information, such as approximate location based on IP address.
Other information regarding your interaction with the Services, such as browser type, log data, date and time stamps, clickstream data (e.g., page requests, page views, how much time is spent on a page, content viewed or interacted with, text entered, etc.), interactions with marketing emails
That's a ton of data!
Exa describes how they refuse to honor requests not to track you.
Your browser settings may allow you to transmit a "Do Not Track" signal when you visit various websites. Like many websites, our website is not designed to respond to "Do Not Track" signals received from browsers.
Exa admits they knowingly collect personal data by default, and it's unclear how or if Firefox Smart Window uses can steer clear of the privacy problems.
On default plans, we use anonymized data...
[You can] opt out of Exa's collection of brokered personal information, opt out of its database, or out of its certain sale of data customers...
Opt out of certain, but not all, sales.
Exa has a second privacy page that describes its compliance with requests to delete private data or opt out of selling it. It received 50 total requests to delete or opt out of selling private data, and "complied", which can include incomplete compliance for some reason, with only 5 of them. That's a 10% compliance rate.
[new] Exa monetized "finding" individual people
I just found out about another skeleton in Exa's closet: the stalkerish People Search that scraped and started publicizing work information. From a LinkedIn post:
I can pull entire staff lists for companies. I can [get] an individual’s work history. I can pull lists of people with a particular job title in a geographical area. I can also combine all this with richer company information and web search data...
Exa are very brave as I can’t imagine LinkedIn likes it very much.
Does this fit Mozilla?
On privacy alone: no.
Mozilla promises a commitment to user privacy, and promises to only work with companies that share that commitment. Exa demonstrates hostility towards user privacy.
Maybe the New, AI-First Mozilla has abandoned this charter, but their website still says:
Individuals’ security and privacy on the internet are fundamental and must not be treated as optional.
9 replies
I hate to be kneejerk, but Mozilla keeps tripping over they own dick. All they had to do was keep being Mozilla.
If this includes any information anyone enters into any type of medical service portal this is an instant HIPPA violation and these guys need to be federally prosecuted straight into the dirt. There may be other regulations that apply to this as well, e.g. those related to the banking sector. Never mind the inherent security implications in basically any workplace.
You do not log a user's keystrokes or text entry. Ever. You know who does do that? Malware.
It has? I don't see it. Actually I don't use AI at all. I'm still amazed that Mozilla wastes all this money to stay relevant. They must know it's bullshit, so is it some kind of corruption or something?
AI has changed how I browse. There's 10x the slop. Search for a Tomb Raider walkthrough and I get fifteen AI generated "Walkthroughs" before I see Gamefaqs.
I'm not exactly sure what Mozilla's deal is - the CEO seems to be a true believer - but it's clear from this sentence (and the ones after it) that they're trying to manufacture an opinion about AI instead of letting it naturally emerge from user requests. "AI is inevitable, therefore we will obviously add a whole AI mode into our browser (that's what Smart Window is)".
The funny thing is its first selling point in a lot of their documentation is that it's "optional." As in, you don't have to use it. Kind of flies in the face of inevitability if your #1 selling point for a feature is that you can avoid it... But sadly disabling or ignoring it doesn't remove the per-update bloat, bugs, or development time spent on it when it could have gone elsewhere.
Hey! Look at that!
It's the last straw.
Goodbye, Mozilla.
I finally gave in and installed Waterfox on my own machine today. I hate to admit it, but having used it for my regular workflow (i.e. actually at work) for the last few hours so far it seems like what base Firefox should be. And arguably still was up until two or three years ago, although I suppose minus the Pocket integration BS that they were doing at that time.
The trouble with all of these forks is that they outright rely on regular Firefox to continue to exist upstream, and if Mozilla tanks and takes down Firefox as a whole all of the forks will by association go with it. I didn't want to actually abandon Mozilla's version because their user numbers seem to be tenuous enough as it is. But at this rate I think I'm going to switch our office over to Waterfox in the next couple of days regardless.
I don't see a world where Firefox tanks that doesn't have some much farther-reaching implications, specifically because Google itself is basically using them as a shield to ward off antitrust lawsuits. Mozilla won't go belly-up because Google simply can't let it.
Even with all its quirks and inconsistencies I've enjoyed using firefox and thunderbird and appreciated mozilla for a long, long time but mozilla has jumped the shark. It's time for us to find and/or create the next big thing.