Live data from Hacker News

Block Fingerprinting with Firefox

blog.mozilla.org

241–250 of 411 posts

Re: Block Fingerprinting with Firefox

#241
post #232

Earlier quoted context omitted.

I finally made the switch from Brave today and I'm never going back. Firefox is just as privacy-conscious, supports built-in tracker blocking, fingerprinting, and has full sync that Brave hasn't implemented yet.

Just as privacy conscious is a misleading statement. Choosing to migrate their default search to Google was a money grab by Firefox and that money is, in turn, 100% dependent upon tracking. I think this is why what limited privacy options Firefox does offer are entirely opt-in, and often hidden behind menus that your average user will probably never visit. By contrast Brave has had things such as blocking of fingerpr…

I can't say that I could agree Firefox's privacy options are hidden/behind menus. I downloaded a fresh copy of Firefox today and the privacy features were quite encouraged and are even the main focus of the Security / Privacy tab.

Brave is an excellent browser but it is only a matter of time until the remaining features are brought over to Firefox. Not to mention some feel they aren't "out of the grasp" of Google until they're fully away from Chromium.

Re: Block Fingerprinting with Firefox

#242
post #232

Earlier quoted context omitted.

I finally made the switch from Brave today and I'm never going back. Firefox is just as privacy-conscious, supports built-in tracker blocking, fingerprinting, and has full sync that Brave hasn't implemented yet.

Just as privacy conscious is a misleading statement. Choosing to migrate their default search to Google was a money grab by Firefox and that money is, in turn, 100% dependent upon tracking. I think this is why what limited privacy options Firefox does offer are entirely opt-in, and often hidden behind menus that your average user will probably never visit. By contrast Brave has had things such as blocking of fingerpr…

Note that Brave does not develop its own engine, piggybacking on Chromium instead. It's easy to play the righteous game when you're piggybacking on other people's work. DuckDuckGo and all alternative search engines are in the same boat.

It can be argued that Brave has a harder dependency on Google than Mozilla does. Because Mozilla has not outsourced their core competencies.

Just to give an example, with Manifest V3, Google is deprecating extensions like uBlock Origin or Privacy Badger. What will Brave do? Maintain their own fork? Well that can get expensive fast. So if it was a business-driven decision to piggyback on Chromium, I don't see why they wouldn't adopt Manifest V3 as well. Manivest V3 will offer mediocre means to block ads too and the average user will not know the difference.

When Brave implements its own engine, or maintains an actual fork of Chromium, or when DuckDuckGo implements a web crawler and stops leaking data to Microsoft, that's when they can play the righteous game.

> often hidden behind menus that your average user will probably never visit

The average user will not install Brave either so this point is moot.

Re: Block Fingerprinting with Firefox

#243
post #69
post #15

Can someone paste their results (or at least bits of fingerprinting entropy) from https://panopticlick.eff.org with the latest Firefox? With the fancy new anti-fingerprinting Safari on macOS Mojave I get just over 14.5 bits of entropy with the most entropic source being my canvas fingerprint (1 in 600). With Safari on iOS I get 11.71 bits of entropy, with the most entropic value being my screen size and color depth.

I think it's funny that panopticlick gives me a little red X for not allowing trackers from companies that have "promised" not to track me. I have no incentive to do so, as I do not get any sort of compensation if they are found to be in violation of those terms.

Just sticking this comment here since I think most people would like to see how the site works. People are interpreting the numbers incorrectly, as I also did at first even though it says at the top exactly how they're measuring these numbers.

Your entropy is determined exclusively based upon the people that have used the site in the past 45 days. For now that number is about 204k. So for instance if you see something has an etropy of 9.08 (as my user agent does) you'd also see that it says 1 in 542.15 browsers have this value. 2^9.08 ~= 542.15. The ~ there only because the thousandths and onward digits are not showing. My exact entropy would be about 9.08254825596. All that means is that of the ~204k people that have used the site in the past 45 days, 377 had the same user agent.

The problem with this is that the people using this site are going to be a heavily biased sample. And so by tuning to reduce your entropy, you are not actually reducing your trackability but instead making yourself look more like the subset of people that are actively using this site. And this becomes an even bigger problem since I do imagine this site is actively shared on more technically orientated sites, such as this one. But the settings of technically orientated users are often going to vary somewhat significantly from the settings of the other 99% of users.

The point of this is that by working to reduce your entropy on this site you may, ironically, end up making yourself more trackable. So the numbers should be taken not as a measurement of trackability, but rather as an interesting insight of your browser/setting differences/similarities of other users with the site.

---

Also, 100% agreed on the silliness of them marking you down for not allowing cookies marked Do Not Track friendly. Until such things are enforced, in code and ubiquitously, they're meaningless unenforceable promises that rely on tracking and advertising corporations never lying.

Re: Block Fingerprinting with Firefox

#244
post #72

Earlier quoted context omitted.

Can anyone explain why canvas fingerprinting is so difficult to eradicate without breaking canvas?

You can draw with different fonts and background colors, then grab the raw pixel values and hash them. The hash will be different depending on the versions of fonts installed, the OS, the GPU, the browser's text rendering algorithms, and the subpixel order/orientation of the display. See https://en.wikipedia.org/wiki/Canvas_fingerprinting for more info.

They should have standardized the font rendering for canvas. For those rare graphs using canvas i can live without Cleartype and only use normal anti aliasing, and with modern high DPI displays you hardly even need that in the first place anyway.

I mean, one of the major reasons for using canvas over DOM is to get pixel perfect placement of things, like text connecting to an arrow. If your fonts suddenly change size that won't work anymore. SVG has the same problem, on some computers with slightly larger letter spacing a line might become too long so it wraps and become two lines, totally spoiling the desired diagram.

Re: Block Fingerprinting with Firefox

#245
post #94

Google's reCAPTCHA makes it impossible to use large portions of the web once you take reasonable measures to protect your privacy. The challenge will continuously fail, despite you spending time to carefully solve it. This cruel behavior is described in a patent [1] by Kyle Adams of Juniper Networks. [1] https://patents.google.com/patent/US9407661

Google's reCAPTCHA is cancer upon the web. Everyone should enable fingerprint block to shut this invasive and abusive garbage. If everyone would block it the website owners would have no choice other than to move to a different captcha system.

“Hm, works in Chrome. Are you using Chrome?”

Re: Block Fingerprinting with Firefox

#247
post #167

Earlier quoted context omitted.

It was said earlier today that because of American tax rules donation money cannot go to software development. So donation money goes to outreach and similar. Which is useful but doesn't fund Firefox. Someone please correct me if this is wrong.

There is nothing about how charities work under US Federal tax law that would produce this result. Tax-exempt charities (which must by definition be non-profit, but not all non-profits are charities, and not all charities are tax exempt!) must spend money in a way that's aligned with their mission, and there are rules on how much they can spend outside that. (The really big no-no has to do with political lobbying and…

> Their 2016 financial statements (I couldn't find anything newer) are available:

> https://assets.mozilla.net/annualreport/2016/2016_Mozilla_Au....

> tl;dr: In 2016 they spent over $250k on software development as a line-item, out of about $500k in revenue total. It's by far their biggest budget item.

The numbers are actually $250 million and $500 million. All the tables this report (as well as a newer one I have to search the link for) list the figures in thousands.

Re: Block Fingerprinting with Firefox

#248
post #232

Earlier quoted context omitted.

Just as privacy conscious is a misleading statement. Choosing to migrate their default search to Google was a money grab by Firefox and that money is, in turn, 100% dependent upon tracking. I think this is why what limited privacy options Firefox does offer are entirely opt-in, and often hidden behind menus that your average user will probably never visit. By contrast Brave has had things such as blocking of fingerpr…

Note that Brave does not develop its own engine, piggybacking on Chromium instead. It's easy to play the righteous game when you're piggybacking on other people's work. DuckDuckGo and all alternative search engines are in the same boat. It can be argued that Brave has a harder dependency on Google than Mozilla does. Because Mozilla has not outsourced their core competencies. Just to give an example, with Manifest V3,…

Brave is already substantially modifying Chromium to remove undesirable 'features' on top of adding the slew of Brave features. Manifest V3 is just another 'feature' that will be removed. The more significant issue there is that there might end up being conflicts between some Brave and Chrome extensions following this change.

I do not agree that writing a renderer from scratch is a wise idea. I mean in theory it's a great idea, but in practice? The Chrome renderer is very well done but, much more importantly, is also going to be what what 100% of web devs will test their sites with. Even browsers with quite large userbases, including FireFox/Safari/etc, tend to get B-tier treatment, if that. Of course standards alone should mean all sites ought render/behave the same with any compliant browser but... again, that whole theory vs practice thing.

There are also a couple of other major issues. Google can use their clout to rapidly change standards that third party projects must play keep-up on. But perhaps the biggest issue is Google using their monopoly in other fields, such as with YouTube, to change their products in ways that 'coincidentally' end up rendering poorly or slowly on third party renderers, as they have done multiple times. This [1] being one particularly stark example of such behavior.

The future of web usage is always difficult to predict. We've gone through numerous phases of seemingly unbreakable web domination from Netscape to Internet Explorer to Chrome. In my opinion Manifest V3 could finally be the tipping point of Chrome, but that may idealistic - we'll have to just wait and see.

[1] - https://www.neowin.net/news/mozilla-executive-claims-that-go...

Re: Block Fingerprinting with Firefox

#249
post #91
post #57

Earlier quoted context omitted.

The irony is they tried diversifying their income. But people don't want their browser to ask for donations (that's nagging). They don't want their new tab page pre-populated with websites on a new install (even if their browsing overwrites them). They don't want "fun" additions to advertise TV shows (even if they're opt-in). But they're happy to pay via google's search and tracking. Mozilla doesn't have a lot of opt…

Firefox has ~250M users as of about 9 months ago and $562M revenue for 2017. I'd honestly pay $2 per month (12 times "my share") for a Firefox that completely disavows the ad model and produces a truly user-centric experience sans ads, fingerprinting, etc. However, given that over 95% of their revenue comes from Royalties, I don't see that turning around any time soon.

250M users, you would not have a problem with $2 a month. Don't expect the rest of these users to follow. Donations are voluntary, people are unaware, but most importantly: that $2 of yours is of different value elsewhere in the world. All the people who live in poverty (according to my standards) should not feel obligated to pay American price for software. Which is a small quibble I have with proprietary software.

Re: Block Fingerprinting with Firefox

#250
post #207

I've had some issues maintaining reVddit.com while keeping Firefox's tracking protection in mind. I'd love some help if there is anyone who can provide insight. Basically, you can't load reVddit pages on Firefox because reVddit accesses reddit's API, and reddit is listed on Firefox's list of websites that are considered trackers [1]. In my uneducated opinion, this list is weird. I had some discussion about this with…

There is a similar bug in Bugzilla for redditp.com, open since 2015: https://bugzilla.mozilla.org/show_bug.cgi?id=1235978 My general impression is that tracking protection is low-priority for Mozilla and anyone who actually cares is using uBlock Origin / uMatrix or similar extensions since those use filter lists that are actually updated.

> My general impression is that tracking protection is low-priority for Mozilla

It is on by default, and as you point out, breaks many innocent sites. People may migrate elsewhere. That should bump up its priority.

Post reply on HN