Here’s the actual paper of the technology (Prio) that it’s based on.

Some problems stand out:

• It requires that the organisations (Mozilla and ISRG) not collude to decrypt the secret share (probably reasonable)
• The paper suggests registering end users to protect against Sybil attacks.
• The scheme requires the organisations to correctly withhold results from advertisers until there are sufficient results.

I’m not overly familiar with the tech stack but I’d be concerned about browsers using a persistent UUID to send impressions to Mozilla’s API.

The biggest elephant in the room is that seemingly nobody wants the damn thing. It offers nothing to users, except maybe a good feeling inside that they’re supporting AdTech. It offers AdTech less than the current deal where they can collect obscene amounts of personal information for targeted advertising.

PSA: if your financial institution/government/<other website> is using SMS codes (aka PSTN MFA) for multi-factor authentication they are practically worthless against a determined attacker who can use SIM swap or an SS7 attack to obtain the code. Basically you are secured by a single factor, your password. If your password is compromised it may be sold via black hat marketplaces and purchased by an attacker who would then likely attempt to break that second factor.

The best way to protect yourself is to use a unique password; a password manager especially helps with this. Sometimes institutions will offer “Authenticator” (TOTP) as a second factor, or PassKey authentication, both secure alternatives to SMS codes.

Here in Aus I’m working with Electronic Frontiers Australia to try and force some change within government and financial institutions (via the financial regulator). Most banks here use SMS codes and occasionally offer a proprietary app. One of the well-known international banks, ING Bank, even uses a 4 pin code to login to their online banking portal. 😖

Unfortunately SMS codes are a legacy left from old technology and a lack of understanding or resourcing by organisations that implement it. Authenticator/TOTP tokens have been around for 16 years (and standardised for 13 years), and PassKeys are relatively newer. There is a learning curve but at the very least every organisation should at least provide either TOTP or PassKeys as an option for security-minded users.

It’s called Microsoft Clarity, and yes, Teams does it https://clarity.microsoft.com/ https://en.wikipedia.org/wiki/Session_replay

I much prefer Librewolf. They are a little more transparent about it is, an independent, open source repackaging of Firefox with Arkenfox(ish) patches applied to it, rather than an entity which signs up for deals with other businesses.