> Leanplum, location, "device id"
Doesn't have access to location and the unique id is specific to leanplum so it can't be tied to anything else. See [1] for an explanation (the source seems to match from my quick look)
> GCM
Firefox has certain real-time features (like sending tabs) that wouldn't be feasible without cloud messaging. Telegram FOSS and many other apps use workarounds that are less reliable, worse UX and drain battery anywhere from a bit more to HOLY SHIT WHERE DID THOSE 4500mAh GO? (source: Telegram FOSS on my OP3T) If you want to propose a better solution, I'm sure the 3 remaining devs at Mozilla would love to hear it.
> Okay, now it's time to refine this in context of "Firefox Klar", "Firefox Focus" or say, the Fenix codebase(s). ...
Sure, let's talk about Fenix - what is now available in G Play as the standard "Firefox
Read the rest
for Android". I don't use Klar or Focus, but they use much of the same code, so all of this is quite general.
> - Mozilla implemented their own ads distribution system that hijacks google ads on pages and replaces the id with the one that was specifically generated for the web browser
The link you provided doesn't make that clear and neither do you. What "id" are you referring to? What is its significance and where in the code is it replaced?
> - Mozilla's Safebrowsing uses a generated hash, that is used specifically to identify a single device
The link you give makes no sense. The URL at the marked line is the URL from which hashes of unsafe URLs are fetched (for China). The hashes are (anonymized) URLs, not devices, and they are received, not sent. If what you're concerned about is "SAFEBROWSIND_ID" in that string, it is mapped to an implementation-specific not instance-specific identifier, as is clearly required by Google's API [2] and is in fact taken from a the about:config entry "browser.safebrowsing.id" that you can check for yourself only contains something generic like "navclient-auto-ffox".
> - The server for both of those hash URLs is hosted by Alibaba in CHINA ...
Only for Chinese builds of the engine. See the if statement at [3] and explanation of the config option at [4]. The code you linked simply overrides the default SafeBrowsing API URL for the Chinese market as the original URL is not available there. The browsers treats it identically as the original, so all the client-side privacy guarantees are still there.
> > On top of that, FF takes extra measures to protect privacy "just in case".
> As my links prove: No, they don't
That part of my post was still referring to SafeBrowsing, specifically the part where they separate the cookie jar and inject some extra noise. [5] explains the whole process quite well (it's similar to how HaveIBeenPwned works)
> For example, they activate Leanplum's device id specific tracking even if the user is outside the geofences, so they track users even if they already know it's unnecessary. [7]
But they're not "tracking" them in any significant way. My first link outlines this quite well. As for why those locales are hard-coded, It's probably because those are the biggest markets and will usually be the first in A/B any rollouts, so using geofences would just be wasteful as they'd always return true anyways. Either way, nothing nefarious there.
[1] https://github.com/mozilla-mobile/fenix/blob/b8de7079a963efb...
[2] https://developers.google.com/safe-browsing/v4/reference/res...
[3] https://github.com/mozilla-mobile/fenix/blob/master/app/src/...
[4] https://github.com/mozilla-mobile/fenix/blob/baaa85db804a096...
[5] https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-...