Earlier quoted context omitted.
This is why Firefox is gaining momentum; they seem to be the only browser interested in user privacy. Users are definitely interested.
Indeed. i even use FF despite its terrible terrible "pinch to zoom" functionality - which works perfectly in other browsers (Safari, Chromium, Chrome). Zooming is such a basic thing... i don't understand why they implement it in such a crappy way. Certainly doesn't attract users.
Online tracking: A 1-million-site measurement and analysis
261–270 of 272 posts
Re: Online tracking: A 1-million-site measurement and analysis
#262Earlier quoted context omitted.
But that's not what I'm suggesting. We can begin by actually reviving browser user style sheets and having a well known and respected sets of names will allow for appropriate styling on the client.
I'm all for user style sheets, I see no problem in people overriding site defaults. Re: sites breaking existing functionality while changing, maybe I just don't see big regressions as having happened in Gmail (which I always have open) or Github (which I rarely have open, as my source is in a local repo, but I visit on a regular basis from links here and elsewhere). It is interesting that you mention keyboard mouse c…
GitHub has been, like Twitter, grabbing more key bindings that existed before in a web browser like Ctrl-K and their comment edit box got limited in its resizability, forcing me to edit outside the website and paste into it often enough that it's an annoyance.
Re: Online tracking: A 1-million-site measurement and analysis
#263Earlier quoted context omitted.
The problem here is Canvas fingerprinting - that's what I found the most surprising and interesting. How do you prevent that, apart from working on 'fixing' browsers to create pixel-perfect renders across different browsers/platforms/configurations. Would that even be possible? Edit: > Tor Browser notifies the user for canvas read attempts and provides the option to return blank image data to prevent fingerprinting.…
> apart from working on 'fixing' browsers to create pixel- > perfect renders Alternatively, maybe have browsers slightly randomize canvas drawing results in ways that are essentially undetectable to a human eye.
Re: Online tracking: A 1-million-site measurement and analysis
#264Earlier quoted context omitted.
Not all of my devices make it possible to disable WebRTC, which makes defense in depth a necessity. Can you provide pointers to more information?
I don't experience webrtc leaks with Openvpn and this config: http://pastebin.com/raw/hiH1TZtS (I use IVPN, their client prevents webrtc leaks on windows by default, but had to manually configure openvpn on linux). Of course, I keep webrtc disabled in Firefox anyway except when i need it, defense in depth like you said.
Re: Online tracking: A 1-million-site measurement and analysis
#265Earlier quoted context omitted.
Yes. Changing common settings might in fact even make you stand out _more_. Check the EFF's Panopticlick [0] to see how your specific configurations leaks identifying information. [0] https://panopticlick.eff.org/
This week’s http://www.heise.de/artikel-archiv/ct/2016/11/144_kiosk states “Viele .. fingerprinting-verfarhen laufen auf Mobilgeräten ins Leere. … Zudem gibt es kein Mittel, mit dem man über gezielt gegen Fingerprinting über die Sensoreigenschaften vorgehen kan - weder unter iOS noch unter Android.” And then it concludes recommending Adblockers for Safari on iOS noting that it depends on the quality of the block-list…
However, mobile devices have a bunch of sensors, some of which can be accessed by JavaScript without permission, namely the ones you wouldn't expect to yield identifying information (e.g. accelerometer). The problem is that no two sensors are alike – they all introduce noise into the data which can be enough to fingerprint a device.
See here for a paper on the subject: https://crypto.stanford.edu/gyrophone/sensor_id.pdf
Re: Online tracking: A 1-million-site measurement and analysis
#266Earlier quoted context omitted.
Indeed. i even use FF despite its terrible terrible "pinch to zoom" functionality - which works perfectly in other browsers (Safari, Chromium, Chrome). Zooming is such a basic thing... i don't understand why they implement it in such a crappy way. Certainly doesn't attract users.
Can you elaborate what's so bad about Firefox's pinch to zoom?
In Safari, this is what it does: https://up1.ca/#Lu0r_cI_v0vXvzpa9nUmEg So in Safari it lets me zoom all the way in and/or out with 1 smooth movement.
This is what the same movement does in Firefox: https://up1.ca/#SEKWNOm1BSQnkntxj_v53w In Firefox, if i want to zoom all the way in, i have to pinch in like 10 times (very annoying) and then to zoom out pinch out another 10 times...
Re: Online tracking: A 1-million-site measurement and analysis
#267Earlier quoted context omitted.
The Tor Browser does not send misinformation; it just blocks. A solution would probably be a browser where every version, on every platform reports the exact same things, always the same way.
> The Tor Browser does not send misinformation; it just blocks. No, it doesn't. TB sends all kinds of misinformation, from the user agent string (always reports itself as being its base version of Firefox running on 32-bit Windows 7) to rounding javascript timing functions to reduce the precision. > A solution would probably be a browser where every version, on every platform reports the exact same things, always the…
Re: Online tracking: A 1-million-site measurement and analysis
#268Earlier quoted context omitted.
I'm all for user style sheets, I see no problem in people overriding site defaults. Re: sites breaking existing functionality while changing, maybe I just don't see big regressions as having happened in Gmail (which I always have open) or Github (which I rarely have open, as my source is in a local repo, but I visit on a regular basis from links here and elsewhere). It is interesting that you mention keyboard mouse c…
I have to use Gmail in static HTML mode so that it doesn't try to reinvent and fail at a text edit control for composing a mail. GitHub has been, like Twitter, grabbing more key bindings that existed before in a web browser like Ctrl-K and their comment edit box got limited in its resizability, forcing me to edit outside the website and paste into it often enough that it's an annoyance.
I'm not really sure what you are referring to here. Gmail does attempt to give you an editor for emails, but it's extremely simple in my experience to get it to do what you want most the time. If your complaint is that you want it to just send a text email, and not a multi-part with a plain text version and an HTML version, in which case I have to question why, as all it does it add choice and allow people to view it in the format they prefer, and it should look the same either way.
> grabbing more key bindings that existed before in a web browser like Ctrl-K and their comment edit box got limited in its resizability
Re: key binding, yeah, I can see that as somewhat annoying. I suspect they are trying to match some standard usability map and thinking of their site as an application, but it's annoying that it interferes with the browser (but only when within a text input, from what I can tell).
To some degree, I have to agree with what's probably Github's stance, which is that it's their site, and while it may seem annoying in some respects, they may have specific reasons they do things. They obviously aren't going to be able to make every change something everyone likes, but I don't necessarily think they are making change for change's sake. It's likely in response to pressure from gitlab and competitors. Presumably they are audience testing. The best way you can speak to this is to not use them when possible, or urge others to not use them.
Re: Online tracking: A 1-million-site measurement and analysis
#269Earlier quoted context omitted.
I mostly agree. Ideally I'd like to have a minimal OS and file set on my local machine (for offline and poor connectivity scenarios), that automatically syncs with my own, encrypted cloud system, such that I can (at my own discretion) update the OS from controlled sources (e.g. git). But I don't think there is enough interest from others for such a system, and I'm occupied with enough other projects that I won't be a…
I think that it depends on your use-case. I use Google Photos to store my media files, Github to store application configuration & source code of my applications, Chrome to store bookmarks, passwords, Spotify to save & listen music etc. Even if I lost my computer now, I would easily setup my desktop environment again.
I do use Github for some projects, but I also maintain local copies and maintain my own backups for all my projects.
If pinboard.in ever disappeared, it'd be like loosing an appendage! It might not be as bad as loosing an entire arm or leg, but its loss would be equivalent to at least a finger or two!
Re: Online tracking: A 1-million-site measurement and analysis
#270Earlier quoted context omitted.
So a regular site using, say, mixpanel doesn't need to show a warning?
If the cookies are purely technical (say, login cookies), no. If the cookies are used for tracking, like Google Analytics, then yes, it needs to ask the user for consent. And that’s not a warning, but actual "yes/no", and in the no case, it may not set a tracking cookie, or have set a tracking cookie already. Most sites (except for a few dozen German and Dutch ones) just redirect you somewhere else, though, if you re…