LWN.net needs you!

Without subscribers, LWN would simply not exist. Please consider signing up for a subscription and helping to keep LWN publishing

In early 2012, Mozilla released Collusion, an experimental extension for Firefox that recorded third-partyweb tracking and rendered its information in a graph-likevisualization. Since then, the add-on has undergone furtherdevelopment, and Mozilla announced its first majorupdate on October 25. In a move that will come as no shock toMozilla watchers, the project has been renamed, but it also now offersadditional ways to dig into the tracking data that the extensioncollects, and users can now choose to contribute their trackingstatistics to a data survey Mozilla is conducting on web privacy.

The rebranded extension is now called Lightbeam, and iscompatible with Firefox 18 and newer. Lightbeam works by recordingthird-party HTTP requests in the pages visited with the browser, noting requests that match a list of web tracking services andadvertisers. The list itself originally came from privacychoice.org. Eachtracker encountered is saved in a local recordthat notes which domain linked to the tracker, whether cookies wereset by the request, whether the request was made via HTTP or HTTPS,whether the user has actually visited the tracker domain in question,and a few other details about the connection.

Lightbeam for Firefox is developed with support from the Ford Foundation and the Natural Sciences and Engineering Research Council, as well as faculty and students from the Emily Carr University. Popular Alternatives to Firefox Lightbeam for Google Chrome. Explore 12 Google Chrome apps like Firefox Lightbeam, all suggested and ranked by the AlternativeTo user community. List updated: 8/7/2020 4:35:00 PM.

You're on candid camera

The first visualization of this data (and the only option in theCollusion-branded release) was a connected graph, withedges connecting the domains that a user has intentionally visited toall of the tracker domains that come along for the ride. Not onlydoes that visualization immediately show which sites are the worstthird-party tracking offenders, but it also reveals how manyindependent sites are sending data back to the same tracking service.This is an educational experience; most users are aware that large webservice companies like Google and Facebook do web tracking, but seeingthe full list of third-party, business-to-business web-tracking siteswithout household names is another thing altogether.

The graph is updated in real time, which makes for interesting (andarguably creepy) viewing in a separate window while one goes about theday's surfing. For example, over the past 48 hours, Lightbeamindicates that I have visited 94 sites, which have in turncollectively reached out to 177 third-party sites. Not all of thosethird-party sites are trackers, of course: those that are known to betracking services are rendered as blue-outlined nodes, while others arerendered with white outlines. The graph shows visited sites ascircles and third-party sites as triangles.

Interested users should note, though, that Lightbeam is still onthe buggy side; the project's GitHub issue tracker indicates thatquite a few users are encountering compatibility problems with otherextensions—particularly those that also deal with third-partyweb tracking or privacy protection. There also appear to be severalFirefox privacy preference settings that break Lightbeam. Ironically,of course, the users most interested in Lightbeam are likely to alsobe the most interested in tweaking privacy settings and in installingother web-tracking countermeasures, so these unresolved issues greatlyimpact Lightbeam's usefulness.

When it does work, the graph visualization allows one to focus inon each individual site, which shuffles around the graph connectionsso that the site of interest is in the center. Clicking on a nodealso opens a side pane showing the server location and the list ofthird-party sites that have been contacted. While the graph isrevealing from a big-picture perspective, it is also not necessarilythe easiest way to study in depth. Luckily, Lightbeam offers twoother views on the same data. The 'clock' provides a time-based lookat the visits and third-party connections made, and there is also astraightforward list.

Users can also save the extension's current data locally, or resetit to begin a new capture session. That capability would be mostuseful to do something like compare the effect that changing the 'DoNot Track' preference has on third-party trackers, but in my testsenabling the 'Do Not Track' setting was one of the preferences thatstopped Lightbeam from working altogether.

Spies like us

Better visualization features are nice, but arguably the biggestchange in the revamped extension is the fact that Lightbeam users canopt-in to send their data to Mozilla. That might sound a tadoxymoronic, but Mozilla insists that the data collected from userswill be anonymized and will only be published in aggregate. Forinstance, only the domain and subdomain of visited sites are recorded,not the path component of URLs, so in most cases usernames and otherpersonally-indentifiable data will not be included.

In September 2012, Mozilla's David Ascher wroteabout the so that users can better understand what types ofrequest are in their interest and which are not. He also said thatMozilla intended to use the data to work with site publishers. Theblog post announcing the October Lightbeam release followed up on thisidea, albeit with few specifics. The post says only that 'Oncethe open data set has time to mature, we’ll continue to explore howpublishers can benefit from additional insights into the interactionof third parties on their sites.'

There indeed may be a lot about third-party tracking (bothcommercial tracking services and tracking that is performedsurreptitiously) that site owners in general are generally in the darkabout. Still, it would be nice to have more detail available aboutexactly what the data collection effort at Mozilla will look like beforeopting in to it. In the meantime, though, Lightbeam definitely does'pull back the curtain' (as the blog post puts it) on webtracking for individual users. Hopefully as Mozilla pursues a broadereffort, the results will be enlightening for users of the web ingeneral—most of whom know that 'web tracking' exists in someform, but for whom its full extents and methods remain a mystery.

(Log in to post comments)

Do you really know where your browser goes when you type a URI into its address bar? Do you realise that your browser not only accesses the site you intended but may also have visited 3rd party websites running connected services?

For many of us this revelation is nothing new but to a lot of surfers this type of activity is news – for the simple reason that it happens behind the scenes.

Sometimes, but by no means always, you can see the end results of this behind the scenes traffic on the website you’re visiting; it’s essential for delivering features like Google AdSense, Facebook Likes or Pinterest ‘Pin it’ buttons for example.

What’s happening is that when you type a URL into your browser it fetches the web page you asked for and then it fetches anything else that web page says it needs.

Typically a page will contain instructions to fetch things like stylesheets that control the layout of the page, graphics and photographs to illustrate it and scripts to create functionality.

Those things might come from the same website as the page you asked for but they don’t have to, the web page can also ask for things from 3rd party websites.

To both the web browser and the 3rd party websites involved these unseen secondary requests are indistinguishable from a user just typing a URL into the address bar.

Lightbeam For Firefox

This is an extremely useful feature, one that is essential to the operation of a lot of web services, but it allows the 3rd parties involved to do things you might not expect such as track your ‘visit’ or set cookies on your browser.

This isn’t a secret but it isn’t obvious either. Web browsers have ways of showing you this traffic if you want to see it but it’s not visible in a form that would make sense to a non-technical user.

Recently, Mozilla released a new add-on for Firefox called Lightbeam. The primary purpose of Lightbeam is to help people better understand how the web works and to shine a light on the realities of data tracking.

Released at this year’s MozFest, Lightbeam builds on existing technology called Collusion to give users more control over their surfing activities and how they are being monitored on the web.

In a blog post announcing Lightbeam, Mozilla’s Alex Fowler stated, “we believe that everyone should be in control of their user da