https://www.ghacks.net/2022/03/17/each-firefox-download-has-a-unique-identifier/ ghacks.net * Home * Windows * Linux * Software * Firefox * Chrome * Internet * Mobile Computing * Companies * Email * Misc * Deals * [svg][ghack-logo] * Home * Windows + Windows 11 News + Windows 11 Help + Windows 10 + Windows 8 + Windows 7 + Windows tips + Windows Update * Linux + Linux Mint * Software + Antivirus + Backup + Data Recovery + Encryption + File Sharing + Microsoft Office + Security * Firefox + Firefox add-ons * Chrome + Chrome Extensions * Internet + Brave + Internet Explorer + Microsoft Edge + Opera + Pale Moon + Vivaldi + VPNs + Google Maps + Search * Mobile Computing + Google Android + Apps + iOS * Companies + Amazon + Apple + Facebook + Google + Microsoft + Twitter + Yahoo + Youtube * Email + Gmail + Outlook + Thunderbird * Misc + Crypto & Blockchain + Development + Games + Hardware + Music and Video + Network + Tutorials * Deals Search for: [ ] [Search] ADVERTISEMENT Each Firefox download has a unique identifier Martin Brinkmann Mar 17, 2022 Firefox | 16 Internet users who download the Firefox web browser from the official Mozilla website get a unique identifier attached to the installer that is submitted to Mozilla on install and first run. firefox installer hashfirefox installer hash The identifier, called dltoken by Mozilla internally, is used to link downloads to installations and first runs of the Firefox browser. The identifier is unique to each Firefox installer, which means that it is submitted to Mozilla whenever it is used. While it is possible to download new installers each time a new Firefox version is released, it is also possible to use the downloaded installer again for that purpose. ADVERTISEMENT A bug report on Mozilla's official bug tracking website confirms the use of the download token. The linked document is not public, but the listing itself confirms the use and provides an explanation on why it has been implemented: This data will allow us to correlate telemetry IDs with download tokens and Google Analytics IDs. This will allow us to track which installs result from which downloads to determine the answers to questions like, "Why do we see so many installs per day, but not that many downloads per day?" According to Mozilla's description, the identifier is used to analyze downloading and installation trends among other things. The feature is powered by Telemetry in Firefox and it applies to all Firefox channels. ADVERTISEMENT Interested users may verify the findings. One of the easier ways is to check the hashes of two or more Firefox installer downloads (the same version, language and architecture). Each hash is different. A search for dltoken using any hex editor reveals the string in the Firefox installer. Firefox users who prefer to download the browser without the unique identifier may do so in the following two ways: 1. Download the Firefox installer from Mozilla's HTTPS repository (formerly the FTP repository). 2. Download Firefox from third-party download sites that host the installer, e.g., from Softonic. The downloaded installers do not have the unique identifier, as they are identical whenever they are downloaded. ADVERTISEMENT Mozilla notes that the opt-out mechanism is the standard Telemetry opt-out. How users may opt-out before the installation of Firefox is unclear. A quick check of Chrome installers returned identical hashes each time. Now You: how useful do you think is the information to Mozilla? (thanks PMC for the tip) ADVERTISEMENT Summary Each Firefox download has a unique identifierEach Firefox download has a unique identifier Article Name Each Firefox download has a unique identifier Description Internet users who download the Firefox web browser from the official Mozilla website get a unique identifier attached to the installer that is submitted to Mozilla on install and first run. Author Martin Brinkmann Publisher Ghacks Technology News Logo Ghacks Technology NewsGhacks Technology News Advertisement About Martin Brinkmann Martin Brinkmann is a journalist from Germany who founded Ghacks Technology News Back in 2005. He is passionate about all things tech and knows the Internet and computers like the back of his hand. You can follow Martin on Facebook or Twitter View all posts by Martin Brinkmann - Related content Mozilla Firefox now displays subtitles for videos in Picture-in-Picture mode in the Nightly channelMozilla Firefox now displays subtitles for videos in Picture-in-Picture mode in the Nightly channel Firefox now displays subtitles for videos in Picture-in-Picture mode in the Nightly channel libredirect privacy friendly redirectslibredirect privacy friendly redirects LibRedirect loads privacy-friendly sites automatically when you load YouTube, Search, TikTok and other sites virustotal browser extensionvirustotal browser extension Virus scanning service VirusTotal releases VT4Browsers extension for Chrome and Firefox add search engine firefoxadd search engine firefox Firefox 98.0.1 removes Yandex Search and Mail.ru search providers firefox relay uifirefox relay ui Firefox Relay update brings larger attachment sizes and a filter for promotional emails whatsapp code verifywhatsapp code verify Meta releases Code Verify extension for WhatsApp Web Previous Post: << Firefox now displays subtitles for videos in Picture-in-Picture mode in the Nightly channel Comments 1. Mike said on March 17, 2022 at 4:54 pm Reply It's useful enough for them to have implemented it. GA telemetry isn't horribly invasive. Google is a bit slicker and implements the install tagging server-side leaving as little client side evidence as they can. As for Firefox, you can prevent launch of the first-run OOBE via their Enterprise Policies, they have an atomic policy toggle for all outbound telemetry as far as I know, doubt it changed in the past 5 months since I stopped bothering to use FF. (Edge Enterprise FTW!) 2. Gerard said on March 17, 2022 at 5:02 pm Reply This is a deal breaker. They have now made me a Mozilla basher. Screw them! 3. Mystique said on March 17, 2022 at 5:30 pm Reply Mozilla questioning everything but their poor approach to the browser and community. How to fix this and win back marketshare? The answer invariably is MORE TELEMETRY! And they all cheered in their board meeting! "IT'S GOLD!!" "MAKE IT SO!!" "WINNING!!" Morons! 4. Black Prince said on March 17, 2022 at 5:43 pm Reply This 'feature' appears to enable interested persons to identify specific computers accessing specific sites. I suspect our 'security services' would find this 'feature' very useful should they have access to the data. 5. Tom Hawack said on March 17, 2022 at 5:45 pm Reply I do download a new installer each time a new Firefox version is released and perform a clean install (previous version is uninstalled). I always download the installer from [https:// archive.mozilla.org/pub/firefox/releases/] but I do acknowledge [https://ftp.mozilla.org/pub/firefox/releases/] provided in the article. I just downloaded FF98.0 from the latter and it's exactly the same as the installer from the former : hence, no dltoken identifier. Besides this dltoken, there are two more IDs right in a Firefox's profile, in the prefs.js file, accessible as well in about:config : toolkit.telemetry.cachedClientID AND browser.newtabpage.activity-stream.impressionId No idea what the second relates to, but the first is surprising given all telemetry is blocked here. Setting both to "" (about:config or with user.js) doesn't change anything, but because I set pref values with Firefox Autoconfig rather than with a user.js file I can clear both on start and this time they are rebuilt but with different values : // RESET IDs AT START clearPref("toolkit.telemetry.cachedClientID"); clearPref("browser.newtabpage.activity-stream.impressionId"); Am I over-reacting? Maybe. I just dislike IDs hanging around and if my battle doesn't change anything at least it doesn't harm. See what they've done to me, ma? Twenty years ago when I started surfing on the Web I'd post my name, email and so on (fortunately a good guy told me then to at least always avoid sharing my true "snail-mail" address) and now I behave as a newborn soldier, always cautious, often over-cautious, maybe occasionally paranoid. But, hey, we're all like special agents in that we have to be aware of not only the bad guys but as well of the "good guys", those who track us for our good, to protect us, for a better e-experience ... The beat goes on, baby. 1. Frankel said on March 17, 2022 at 6:12 pm Reply And that is the thing: All telemetry they collect is useless, since they scared away the tech savvy crowd. The clever people still use Firefox, especially on Linux. But they have become mutes toward Mozilla. At the same time they wonder why so many people complain on bugzilla, yet use the argument they are a minority. They are not! Just because I disable telemetry in about:config and on DNS level doesn't mean I am irrelevant or a minority. I simply would prefer not to bug my machine to have a right to veto terrible changes to the browser I love! "O Mozilla, your leaders have been like foxes among ruins." -- modified from Ezekiel 13:4 1. Tom Hawack said on March 17, 2022 at 6:34 pm Reply "The beast that you saw was, and is not, and is about to rise from the bottomless pit and go to destruction. And the dwellers on earth whose names have not been written in the book of life from the foundation of the world will marvel to see the beast, because it was and is not and is to come" -- Revelation 17:8 2. Neutrino said on March 17, 2022 at 7:11 pm Reply @Tom Hawack "the book of life" aka the "tree of life", aka the "right hand of god", aka the right hemisphere of the brain. Sorry for the off-topic, couldn't resist. 3. Tom Hawack said on March 17, 2022 at 9:08 pm Reply @Neutrino, no problem! I had tried myself to comment the quote but after 5 minutes gave up and considered that I'd appear smarter without trying to be. Remains the verse is increasingly questioning as you read it again and again. I found it by searching for revolt+bible, I'm not at all an exegete :=) Back to our beasts, those which are! 6. Klaas Vaak said on March 17, 2022 at 5:50 pm Reply The fact that FF is downloadable without a unique ID is not the issue, and not even that useful since most users are unaware of the possibility and/or will not make use of it. The elephant in the room is that that unique ID can, and undoubtedly will some time, be used for installations and 1st runs. In other words, this is another step down the Google path. FF's telemetry is changed almost every time there is an update, so you have to check again and again what has changed and correct /counteract it. 7. Andy Prough said on March 17, 2022 at 6:48 pm Reply Why would anyone download directly from Firefox? It's already in the repos for nearly all distros. Is this article about Windows or Mac users? They are already uniquely identified in so many different ways, why should they care about this? 1. Frankel said on March 17, 2022 at 6:58 pm Reply That is defeatist thinking and whataboutism. Because one company tracks you, all others must as well? Cool. Also try reading the article, your other questions are already answered in it. 1. Andy Prough said on March 17, 2022 at 7:20 pm Reply Cool, I guess it's a concern for Windows and Mac users, in which case I do not care. Those who desire to be identified and tracked, and spend their money to be identified and tracked, will be identified and tracked. 2. bob said on March 17, 2022 at 8:11 pm Reply I'm sure both of you using Linux will be fine, but the vast majority of us will be using Windows. Personally, I started downloading from the ftp site as soon they started using those horrid stub-installers way back when. 1. Andy Prough said on March 17, 2022 at 9:40 pm Reply For firefox? I would imagine the percentage of users on various distros is quite high. We're not talking about Chrome. Firefox is the default browser on nearly every distro. 8. beemeup5 said on March 17, 2022 at 8:10 pm Reply An installer triggering an outbound connection is actually fairly common, though the reasons may vary. It's usually to check if you're installing the latest version but by default I block all such connections. I've noticed before that installing Firefox triggers my firewall but I didn't know that THIS was the reason why. Well now I know. ;) Leave a Reply Cancel reply [ ] [ ] [ ] [ ] [ ] [ ] [ ] Comment[ ] [ ]Check the box to consent to your data being stored in line with the guidelines set out in our privacy policy We love comments and welcome thoughtful and civilized discussion. Rudeness and personal attacks will not be tolerated. Please stay on-topic. Please note that your comment may not appear immediately after you post it. Name [ ] Email [ ] [ ] Save my name, email, and website in this browser for the next time I comment. [Post Comment] Search for: [ ] [Search] Advertisement Spread the Word Ghacks Newsletter Sign Up Please click on the following link to open the newsletter signup page: Ghacks Newsletter Sign up Advertisement Popular Posts * Firefox 89 ships with interface changes 251 * How to fix the Firefox 89 user interface 124 * Here is what is new and changed in Firefox 88.0 104 * Firefox 94.0 release: here is what is new and changed 100 * Mozilla bans the FVD Speed Dial extension and removes it from Firefox; but users are furious after losing their bookmarks 99 Advertisement Recently Updated * Firefox now displays subtitles for videos in Picture-in-Picture mode in the Nightly channel Published in: March 17, 2022 12:01 pm | Updated in: March 17, 2022 12:01 pm * LibRedirect loads privacy-friendly sites automatically when you load YouTube, Search, TikTok and other sites Published in: March 16, 2022 7:50 am | Updated in: March 16, 2022 7:50 am * Virus scanning service VirusTotal releases VT4Browsers extension for Chrome and Firefox Published in: March 15, 2022 4:59 pm | Updated in: March 15, 2022 4:59 pm * Firefox 98.0.1 removes Yandex Search and Mail.ru search providers Published in: March 15, 2022 6:41 am | Updated in: March 15, 2022 6:41 am * Firefox Relay update brings larger attachment sizes and a filter for promotional emails Published in: March 12, 2022 4:55 pm | Updated in: March 12, 2022 4:55 pm Advertisement About gHacks Ghacks is a technology news blog that was founded in 2005 by Martin Brinkmann. It has since then become one of the most popular tech news sites on the Internet with five authors and regular contributions from freelance writers. * About * RSS Feeds * Legal Information * Terms of use * Privacy Policy * Cookie Policy * Cookie settings * Advertise with Us * Martin Brinkmann * Mike Turcotte * Ashwin * We Use The name and logo of Ghacks are copyrights or trademarks of SOFTONIC INTERNATIONAL S.A. Copyright SOFTONIC INTERNATIONAL S.A. (c) 2005- 2022 - All rights reserved [svg][ghack-logo-me] * Home * Windows * Linux * Software * Firefox * Chrome * Internet * Mobile Computing * Companies * Email * Misc * Deals