131–140 of 180 posts
I'm surprised browsers wouldn't prefetch stuff like this given it's an easy performance win. Which would then also make these stats useless.
Prefetching state that's never needed is a bandwidth waste.
If you're concerned as a user of a malicious site: * Link click tracking - So what, the site could route you through a server side proxy anyways * Hover tracking - Can track movements of course, but doesn't really help fingerprinting. This is still annoying though and not an easy fix * Media query - So what, user agent gives this away mostly anyways * Font checking - Can help fingerprinting...browsers need to start r…
> So what, the site could route you through a server side proxy anyways There's little interest in proxying through a token system (this would require a DB read at each click, and a DB write at each page generation), which means the actual link is available client-side and the whole thing can be bypassed.
I don't see what's problematic about this. The tracking is not really done in CSS, so much as on the server. You could accomplish the same thing with 1x1 images, or loading any remote resource. Effectively the only difference is you're loading the URL conditionally via CSS, as opposed to within a ` ` or ` ` tag. Furthermore, this can be blocked in the same way as any tracking URL. I concede this is a novel way of fin…
If you're concerned as a user of a malicious site: * Link click tracking - So what, the site could route you through a server side proxy anyways * Hover tracking - Can track movements of course, but doesn't really help fingerprinting. This is still annoying though and not an easy fix * Media query - So what, user agent gives this away mostly anyways * Font checking - Can help fingerprinting...browsers need to start r…
> If you're concerned as a user of a malicious site Or if you're concerned as a user of a regular "safe" site... Google Analytics does all of these things: link tracking, hover tracking, media query tracking. GA or something like it is being used by vast swaths of the web. I don't claim it's the majority, because I don't know, but that's what I assume, that all sites are tracking (whether or not the site even knows i…
[1]: https://whotracks.me/trackers/google_analytics.html [2]: http://randomwalker.info/publications/OpenWPM_1_million_site...
Whose going to be first to make the 'I always browse the Web with CSS disabled' post?
Well, I have firefox `layout.css.visited_links_enabled` set to false not to leak history.
Earlier quoted context omitted.
> It doesn't; without media queries you can't detect thing like browser window size or screen pixel density. Sorry if I wasn't clear. I shouldn't have said media queries, I should have said "CSS property queries". What CSS properties you have doesn't leak any more than your UA I would guess. > There's a lot of trade-offs here [...] I'll take it as an option to have a strict subset (though would prefer it as opt-out t…
>> Sorry if I wasn't clear. I shouldn't have said media queries, I should have said "CSS property queries". What CSS properties you have doesn't leak any more than your UA I would guess. >> Unique font names per user seem unnecessary. As a dev that has worked in CSS for over a decade, I have no idea what either of those mean. EDIT: I see the unique font names part now, totally missed that while focusing on the other…
Earlier quoted context omitted.
Completely disabling CSS will make a lot of sites inaccessible. Partly disabling it (for example the #after part) would be interesting...
Wonder how complicated a CSS Parser / White-listing extension would be?
How does 'check spelling as you type' work, via a dictionary that is previously downloaded, or is this an online service that leaks all/or some of your key presses?
Earlier quoted context omitted.
> * Media query - So what, user agent gives this away mostly anyways I was earnestly surprised how much data macOS and Android devices tend to put into the user agent. Not only the exact patch level of the browser, but also the OS patch level and Android devices even tend to broadcast the precise device model as well -- more accurately than just looking at the device! Some examples: Mozilla/5.0 (iPad; CPU OS 10_3_3 l…
The user agent is such a mess, why should any website know all that? Why should a website know anything about the visiting guest, they should be using feature detection instead. Lets get rid of the user agent or just put "Mobile/phone", "Desktop" or similar in it. Maybe OS and a short browser name and main version number for statistics.
Earlier quoted context omitted.
If somebody has fonts installed for specific reasons then presumably they don't want web pages changing them. Web pages shouldn't need any more control than selecting from "serif", "sans-serif", or "monospace". The most legible font is the font you're most familiar with. I don't want web pages to use different fonts just because some marketing drone thought it was good for branding. It's disappointing that we allowed…
Have you heard a term 'design'? + sometimes you can't adjust the website to work well with all (or even the popular ones) sans-serif fonts