Every Firefox download has a unique identifier
Internet users who download the Firefox web browser from Mozilla’s official website get a unique identifier attached to the installer that is sent to Mozilla during installation and first run.
The token, called dltoken by Mozilla internally, is used to link downloads to installs and first runs of the Firefox browser. The identifier is unique for each Firefox installer, which means that it is sent to Mozilla each time it is used.
While it is possible to download new installers every time a new version of Firefox is released, it is also possible to use the newly downloaded installer for that purpose.
A bug report on Mozilla’s official bug tracking website confirms the use of the download token. The linked document is not public, but the listing itself confirms the usage and provides an explanation as to why it has been implemented:
This data will allow us to correlate telemetry IDs with download tokens and Google Analytics IDs. This will allow us to track which installs result from which downloads to determine the answers to questions like “Why do we see so many installs per day, but not so many downloads per day?”
According to Mozilla’s description, the identifier is used to analyze download and installation trends, among other things.
The feature works with Telemetry in Firefox and applies to all Firefox channels.
Interested users can verify the findings. One of the easiest ways is to check the hashes of two or more Firefox installer downloads (same version, language, and architecture). Every hash is different. A search for dltoken using any hex editor reveals the string in the Firefox installer.
Firefox users who prefer to download the browser without the unique identifier can do so in the following two ways:
- Download the Firefox installer from the Mozilla HTTPS repository (formerly the FTP repository).
- Download Firefox from third-party download sites that host the installer, for example from Softonic.
Downloaded installers do not have the unique identifier as they are identical each time they are downloaded.
Mozilla notes that the opt-out mechanism is the standard telemetry opt-out. It is not clear how users can opt out before installing Firefox. A quick check of the Chrome installers returned identical hashes every time.
Now you: How useful do you think the information is for Mozilla? (thanks PMC for the advice)
advertising
