Live data from Hacker News

Ask HN: What's the best ad-blocking, privacy-enhancing extension set up?

news.ycombinator.com

41–50 of 64 posts

Re: Ask HN: What's the best ad-blocking, privacy-enhancing extension set up?

#41
post #4

Drop this in your hosts file and set up a refresh script to replace it periodically. http://someonewhocares.org/hosts/hosts

The connection time outs will make your browsing experience feel slow as page take ages to load before they fail to do so.

If you use the 0.0.0.0 version, pages load much quicker: http://someonewhocares.org/hosts/zero/hosts

Re: Ask HN: What's the best ad-blocking, privacy-enhancing extension set up?

#42
post #38
post #36

Earlier quoted context omitted.

from the page it looks like privacy badger is similar to noscript, care to explain how it's better than noscript? noscript also has "forbid", "temporarily allow", and "allow" settings for blocking domains

Tried out Privacy Badger and had some bugs early on, refused to block certain domains and did not block things by default which I would expect. I prefer noscript.

I'm not clear that it blocks anything by default.

Re: Ask HN: What's the best ad-blocking, privacy-enhancing extension set up?

#43

> My goal is to make my browser as private as possible with minimal damage to my usual browsing experience. Not very long ago I wrote a guide documenting my specific configuration which has precisely this goal in mind [1]. The short version: disable third-party cookies, enable tracking protection (Firefox only), use uBlock Origin with some extra filters, use HTTPS everywhere, Enforce Click-to-Play and Disable Unneces…

I use basically this setup with one additional plugin: Noscript. But this has more to do with browser safety than privacy, in that I don't want some shady third party site getting to run whatever JS they want on my machine.

I made myself use NoScript for a few days. I was quite surprised at how performant the web suddenly was, but quite discouraged at how often I had to unbreak websites. Because of that I don't run it anymore, but understand why people do.

Re: Ask HN: What's the best ad-blocking, privacy-enhancing extension set up?

#44
post #10
post #4

Drop this in your hosts file and set up a refresh script to replace it periodically. http://someonewhocares.org/hosts/hosts

I sincerely hope you don't do this. You're trusting that the people who run that site won't turn malicious in the future; and since your link uses http, you are also trusting that the same applies to their ISP, your ISP, or anyone in between!

you could run it through your own sanitizer before deploying even something as simple as

egrep -v "^127.0.0.1|^#|^$" hosts.zero

should help ease your mind that the worst an attacker could do is make some site you want to go to apparently unavailable, but that would be under your control to fix too.

Re: Ask HN: What's the best ad-blocking, privacy-enhancing extension set up?

#45
post #36

You're pretty much covered. uBlock Origin + Privacy Badger is awesome. You can add something like Tab Cookies or Self Destructing Cookies. You can also add something like uMatrix to the mix. If you really want to go far, add a "User-Agent Switcher" type extension. I wouldn't add more than this though, it starts to be overkill. Also do note: I used to use noscript and it works well, but going from 0 JS on a domain to…

from the page it looks like privacy badger is similar to noscript, care to explain how it's better than noscript? noscript also has "forbid", "temporarily allow", and "allow" settings for blocking domains

They're both good at different things:

NoScript blocks Javascript/Flash/etc. based either on a list you import, or on a case-by-case basis. I use it as a security measure, blocking potentially harmful content by default and enabling it only if I need it for the site to function.

Privacy Badger is not designed for security so much as it is for protection against non-consensual tracking. It observes which third-parties store high-entropy cookies on your device. If it sees a third-party domain doing so across three different first-party websites, it automatically blocks requests for any content to that third-party from your browser.

So I'd say the big differences are Privacy Badger is set-and-forget, while NoScript isn't; Privacy Badger protects against different tracking (including pixel tags); NoScript protects against some first-party tracking (if you don't allow JS on a first-party domain) and security dangers.

Full disclosure: I work for EFF which makes Privacy Badger.

Re: Ask HN: What's the best ad-blocking, privacy-enhancing extension set up?

#46

Earlier quoted context omitted.

I use basically this setup with one additional plugin: Noscript. But this has more to do with browser safety than privacy, in that I don't want some shady third party site getting to run whatever JS they want on my machine.

I made myself use NoScript for a few days. I was quite surprised at how performant the web suddenly was, but quite discouraged at how often I had to unbreak websites. Because of that I don't run it anymore, but understand why people do.

Hah, yep, but after a while you get good at guessing which third party sites will unbreak the current page. And sometimes you realize the content isn't worth letting all the garbage run on your computer.

Re: Ask HN: What's the best ad-blocking, privacy-enhancing extension set up?

#47
post #42
post #38

Earlier quoted context omitted.

Tried out Privacy Badger and had some bugs early on, refused to block certain domains and did not block things by default which I would expect. I prefer noscript.

I'm not clear that it blocks anything by default.

That's correct; Privacy Badger doesn't block anything by default because it doesn't use a blacklist. Instead, it observes the behavior of third-party domains and blocks them based on their behavior. (So it may take a bit of normal browsing before it starts blocking things.)

Also, Privacy Badger recently transitioned from beta to 1.0, so if you last tried it more than a month or so ago, I recommend giving it another shot. And if you find bugs, please report them!

Full disclosure: I work at EFF, which makes Privacy Badger.

Re: Ask HN: What's the best ad-blocking, privacy-enhancing extension set up?

#48
> Various forms of fingerprinting are blocked/disabled

Be very careful with that. If you're one the few who have the features disabled on a compatible browser, you make your configuration more unique and it becomes easy to identify you.

I'd would also advice not to spoof the User-Agent since the browser can be detected thanks to other parameters and if those ones contradict the User-Agent that's a very specific fingerprint.

I'd also advice not to enable the DNT (Do Not Track) header since it does nothing at all and is used by a minority, so it increases your entropy too.

The combination of your three extensions is very fine as far as I can tell. This is what I would advice in addition to them:

- Whitelist first-party cookie. Make them be deleted when you close the browser (in the privacy settings of Firefox) and whitelist the few sites you need them to be remembered. To whitelist a site on Firefox, click on the thing at the left of its url on the address bar (either a planet or a lock), click on 'More informations...', go to the Permissions tab, scroll to 'Set cookie', uncheck 'Use default' and click the 'Allow' radio button.

Many websites include arbitrary JavaScript that they grabbed in the documentation of some statistic tool or something like that. Such scripts, running directly in the site's pages, can then access first-party cookies.

- Use something else than Google. If you can't deprive yourself of Google results relevance, then use StartPage, it's a Google proxy. They make money by displaying non-targeted self-hosted ads. Unfortunately, I fear that Google might be able to identify you thanks to your queries themselves. Otherwise, just use DuckDuckGo.

- Use your history and bookmarks. Search engines are for discovering new content. To find something you have already seen or to reach a website you already visited, use your history. Ctrl+Shift+H. Or just type some word you remember in the address bar and pick the correct suggestion.

- Use search keywords (https://support.mozilla.org/en-US/kb/how-search-from-address...). They allow you to associate a keyword to about any search form anywhere and then search this form directly in the address bar. This also will reduce your search engine usage.

You should also know that when your browser performs a third-party request, the recipient of the request can know the page you're coming from thanks to the HTTP referer header. It can be disabled in about:config (http://www.technipages.com/firefox-enable-disable-referrer), but I'm not sure it would be a good idea, first because of what I've said about fingerprints in the beginning, second because it might break some websites.

Re: Ask HN: What's the best ad-blocking, privacy-enhancing extension set up?

#49
post #36

Earlier quoted context omitted.

from the page it looks like privacy badger is similar to noscript, care to explain how it's better than noscript? noscript also has "forbid", "temporarily allow", and "allow" settings for blocking domains

They're both good at different things: NoScript blocks Javascript/Flash/etc. based either on a list you import, or on a case-by-case basis. I use it as a security measure, blocking potentially harmful content by default and enabling it only if I need it for the site to function. Privacy Badger is not designed for security so much as it is for protection against non-consensual tracking. It observes which third-parties…

thanks for answering!

Re: Ask HN: What's the best ad-blocking, privacy-enhancing extension set up?

#50
post #12

What's the overlap between uBlock Origin and other plugins like Ghostery or Privacy Badger? Or even uMatrix?

One major difference is that Privacy Badger doesn't use a blacklist like the others and really isn't designed for the purpose of ad-blocking. It's designed to prevent non-consensual tracking, so it observes which third-party domains try to store high-entropy cookies, and if it sees a third-party domain doing so across multiple first-party sites, blocks any further third-party requests to that domain.

Full disclosure: I work at EFF, which makes Privacy Badger.

Post reply on HN