Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Block Fingerprinting with Firefox

blog.mozilla.org

Post reply on HN
Print view View original

171–180 of 411 posts

Re: Block Fingerprinting with Firefox

#171

Post by qiqitori »

wybiral wrote: post #60
xvector wrote: post #15

Can someone paste their results (or at least bits of fingerprinting entropy) from https://panopticlick.eff.org with the latest Firefox? With the fancy new anti-fingerprinting Safari on macOS Mojave I get just over 14.5 bits of entropy with the most entropic source being my canvas fingerprint (1 in 600). With Safari on iOS I get 11.71 bits of entropy, with the most entropic value being my screen size and color depth.

I wonder if these fingerprint checks look for the more stealthy and sinister approaches, like localhost port scanning [1] and specific CSS selector behavior...? [1] https://twitter.com/davywtf/status/1132026581038190592

There's so much fingerprinting that can't really be disabled. Think about it:

Performance

- Single-threaded CPU performance

- Multi-threaded CPU performance

- WebGL performance

- Video performance

- Network performance (how long does it take to transfer data to various locations, what's the lag, is the lag consistent, etc.)

- (Maybe) Time it takes to execute certain JavaScript functions

User behavior

- How does the user use their mouse when navigating web pages?

- Not at all?

- Jerky movements?

- Smooth movements?

- If the user uses the keyboard, do they appear to be advanced keyboard users, do they have an IME, etc.

- Does the user press X buttons on tiny annoying popups that wouldn't interfere with the page's browsing experience?

- Does the user appear to block access to certain resources? (ad blocker)

- Does the user's workplace/country/etc. appear to block anything?

Re: Block Fingerprinting with Firefox

#172

Post by groovecoder »

xvector wrote: post #15

Can someone paste their results (or at least bits of fingerprinting entropy) from https://panopticlick.eff.org with the latest Firefox? With the fancy new anti-fingerprinting Safari on macOS Mojave I get just over 14.5 bits of entropy with the most entropic source being my canvas fingerprint (1 in 600). With Safari on iOS I get 11.71 bits of entropy, with the most entropic value being my screen size and color depth.

Please note: the fingerprinting protection in this blog post is different from the resistFingerprinting about:config pref which would affect your entropy bits on panopticlick.

Re: Block Fingerprinting with Firefox

#173

Post by blotter_paper »

munchbunny wrote: post #169
SquareWheel wrote: post #152

Earlier quoted context omitted.

>You do realize that Google does not benefit from keeping your info to themselves, right? Of course they do. That's literally their business model, to use that data to serve more relevant ads. If they gave it to third parties then they would lose their biggest competitive advantage. And really, they couldn't be any more clear about it: https://safety.google/privacy/ads-and-data/ >We do not sell your personal informat…

>We do not sell your personal information to anyone. That's a technically true and practically meaningless statement. No lying required. Google's business model relies on giving advertisers a way to target you based on that data and to track you to other activities down the line. Advertisers might never see the data itself, but all that means is Google is selling the product that lets advertisers do the things they w…

> Whether you consider that equivalent to selling your data is a separate question. You'll find a lot of disagreement here about it.

I can't remember previously seeing an argument that this is equivalent. Sharing one quality (in this case the ability to target users on Google's platform based on data Google has collected) does not make two things equivalent. Data passing between hands is obviously different than one entity providing an interface for another entity to utilise data without having it themselves, as in the former case you are now trusting both entities to safely store it which increases the chance of public disclosure (or private exposure that results in negative personal effects such as embarrassment and/or blackmail).

HurpaDurpaEdit: s/latter/former

Re: Block Fingerprinting with Firefox

#174

Post by thristian »

silversconfused wrote: post #138
hartator wrote: post #117

Earlier quoted context omitted.

The thing is there is disparity between the value they promote - privacy - and Mozilla actions. If privacy first was truly the Mozilla mission, we won't have Google Analytics on extension internal pages, the Mr Robot Ad, the Yahoo ad deal, and the ability to inject code remotely in your browser. Privacy seems to be a Mozilla concern but it's not a primary one.

Mozilla will gladly protect you from other entities, but they are not user freedom respecting enough to realize that they should also not require you to submit yourself to them. My argument is that allowing users to "opt out" from tracking is insufficient, and I will argue against it whenever possible.. You should be asked and informed before ANY DATA IS SENT to them, not just informed that it is already happening an…

You're right - the user should be asked and informed before any data is sent. But the situation is more complex than that.

- For better or worse, most people aren't scared of the Internet, so they don't want a detailed, itemised list of risks and mitigations to allay their fears, they just want to get down to business. How do you ask and inform a user who refuses to answer or read?

- People want to use the web-browser that works best with the sites they visit, and the connectivity they have available. While every person's situation is different, the Pareto principle says an awful lot of people will be in a very similar situation, so any browser vendor willing to accurately measure people's situations and optimize for them would become tremendously more attractive for most people. Refusing to implement telemetry, or leaving it as opt-in, means voluntarily giving up the mass market to less scrupulous browser vendors.

Re: Block Fingerprinting with Firefox

#175

Post by derefr »

ngokevin wrote: post #32
OJFord wrote: post #2

> You probably wouldn’t appreciate someone tracking your moves in real life. There’s no reason to accept it online. Great to read something like this on mozilla.org.

Kind of funny though, the vast majority of Mozilla's money comes from the ads and tracking industry, just one step removed.

What’s wrong with using the resources of evil (freely given, oddly enough) to destroy evil?

If someone you hate offers you a billion dollars, you should take it—because in doing so you’ve made someone you hate a billion dollars poorer! It’s like stealing the money from them, with less work!

Imagine, analogously: a lottery whose proceeds go to a charity supporting statistics education.

Re: Block Fingerprinting with Firefox

#176

Post by zwaps »

SquareWheel wrote: post #150
zwaps wrote: post #133

Earlier quoted context omitted.

Never? You may not remember this, but Google used to be cool. "Don't be evil", and all that. There was a lot of hope - when Microsoft was still the bad guys. Working at Google was the dream - they made movies about that. Nowadays we all feel stupid, obviously. Right up to deleting "Don't be evil". Literally taking it out. The nerve.

>Nowadays we all feel stupid, obviously. Right up to deleting "Don't be evil". Literally taking it out. The nerve. No they didn't. Please don't spread misinformation.

Alright, taking it out of the important part and dropping it from Alphabet

https://www.searchenginejournal.com/google-dont-be-evil/2540...

http://time.com/4060575/alphabet-google-dont-be-evil/

I am more right than I am wrong.

Re: Block Fingerprinting with Firefox

#177

Post by RonanTheGrey »

skybrian wrote: post #159
ngold wrote: post #147

Earlier quoted context omitted.

“A lot of the scripts that are run to enable tracking delay webpage load times while all these tracking scripts fire and run in the background,” said Peter Dolanjski, Firefox Product Lead. Over at Google they are trying to sell fingerprinting as a feature.

What do you mean? Link?

Fingerprinting is the primary way that Captcha decides whether to block you or not. Fingerprinting == security is the parallel they are drawing.

Re: Block Fingerprinting with Firefox

#178

Post by SquishyPanda23 »

Despegar wrote: post #114
dmos62 wrote: post #71

Earlier quoted context omitted.

> always-negative/outrage attitude That's a meaningful insight. I think Web is in a place now where anyone with technical insight is frustrated. Yes, frustration is the right word. And confused. And it's this mix of confusion and frustration that has people going around bad mouthing all browsers, or at least I think so. Mozilla Firefox is the only significant browser that has the economic incentives to take care of p…

>there's no debate about that right? Sure there is. Mozilla depends heavily on revenue from Google whereas Apple doesn't. For Mozilla it's life or death and for Apple it's not (to be the default search engine). There isn't a single tech company where the business incentives are more aligned with privacy than Apple.

If you think of "privacy-preserving" for a company as a costly virtue, then the standard advice is to appear virtuous without actually bearing all the cost of truly being virtious.

Since they are closed source and secretive, there is a significant information asymmetry and we will never know how honest they are being.

Firefox, on the other hand, has an incentive to honestly preserve privacy, as their attempts to test the water on privacy-reducing features have a high probability of becoming public.

Re: Block Fingerprinting with Firefox

#179

Post by msla »

ziddoap wrote: post #34

I find it really interesting that when a company is making moves in a direction that benefits privacy of consumers, everyone takes the opportunity to shit on them for past mistakes or how it isn't good enough or why isn't it on by default or any other thing they can find to shit on. Yes, every single company has made mistakes. FireFox is no exception. Some of them were pretty egregious. Mistakes are - hopefully - an…

> This always-negative/outrage attitude just erodes any sort of meaningful discussion.

They destroyed some of my bookmarks when they dropped RSS support. That isn't privacy-eroding, it's data destruction, and they didn't even let me opt out.

I know they probably had a lot of conversation about it, but when the conversation ends with "And then we destroy the data of random people without letting them say no", you need to back up a few steps and look closely at what went wrong in your process.

Re: Block Fingerprinting with Firefox

#180

Post by SquareWheel »

zwaps wrote: post #176
SquareWheel wrote: post #150

Earlier quoted context omitted.

>Nowadays we all feel stupid, obviously. Right up to deleting "Don't be evil". Literally taking it out. The nerve. No they didn't. Please don't spread misinformation.

Alright, taking it out of the important part and dropping it from Alphabet https://www.searchenginejournal.com/google-dont-be-evil/2540... http://time.com/4060575/alphabet-google-dont-be-evil/ I am more right than I am wrong.

Alphabet never used "Don't be evil" as a motto. They have used "Do the right thing" since their inception.
Post reply on HN