Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox expands fingerprint protections

blog.mozilla.org

Post reply on HN
Print view View original

111–120 of 177 posts

Re: Firefox expands fingerprint protections

#111

Post by godelski »

recursive4 wrote: post #93
y-c-o-m-b wrote: post #14

I exclusively use private browsing, but I know that doesn't do much in preventing tracking, so it's nice to see this finally starting to roll out. The fact that I have to go to great lengths to browse anonymously - and companies desperately try to circumvent my genuine decision to opt out of their tracking - tells me everything I need to know about those companies. Words like sleezy, shady, and predatory come to mind…

Out of curiousity, how would you steelman the argument that fingerprinting is no different than a store owner, standing behind the counter, taking note of the faces of who enters his store, and maintaining a log?

I'm fairly confident I could sue that store owner for stalking if they were logging every time I entered that store and left, along with all my activities.

I'm absolutely positive I could if they were getting other store owners to help them track me.

What I don't understand is why this is unacceptable if they do it to a single person but perfectly normal if they do it to all their customers. IMO that should make things worse, not better.

Let's put it this way. You'd get a restraining order against someone if they followed you around all day, logging when you woke up, ate, who you talked with (even if they don't hear the conversation), where you went, and when you went to bed. That's clearly stalking, right? So why us it suddenly acceptable when it's being done by some guy named Mark who is stalking a billion people instead of just one?

We clearly differentiate this from being a regular customer at a store. If I'm a regular at Joe's Corner Market and get a sandwich every Wednesday for lunch then he remembers me because we're talking face to face and making conversation. It's personal. There's clear consent in what I'm sharing and there's a clear expectation that Joe isn't going to use that information to manipulate me or follow me around town. Our interaction is limited to the store and maybe bumping into each other on the street. It's clearly not stalking, we're just friendly. The same way your partner might know about when you wake up, go to sleep, eat for breakfast, and all that same stuff. Your partner isn't stalking you.

[Edit]: I want to encourage the above comments. Doesn't matter if recursive4 believes the other side or not, I want these conversations to be front and center. I like to see the other responses than mine as well and I think these help us refine our arguments and by being prominent they help others be convinced and join us. So while I know we don't usually talk about how to upvote/downvote, I'll just say "vote strategically rather than agreeability" :)

Re: Firefox expands fingerprint protections

#112

Post by glenstein »

shevy-java wrote: post #21

I tested firefox recently. It had some AI summary button or something that was new. I instantly wanted to eliminate this from the UI but I don't know how to do that. I guess it is possible? But it probably requires some time and research; the thing I don't need or want this, it just takes away space. Then I remembered why I no longer use firefox. I believe we, as users, need to take back the open web. The days of som…

I feel your pain with the AI stuff, but I think I had one sidebar open one time and I was able to disable it with one click.

Re: Firefox expands fingerprint protections

#113

Post by mihaaly »

y-c-o-m-b wrote: post #14

I exclusively use private browsing, but I know that doesn't do much in preventing tracking, so it's nice to see this finally starting to roll out. The fact that I have to go to great lengths to browse anonymously - and companies desperately try to circumvent my genuine decision to opt out of their tracking - tells me everything I need to know about those companies. Words like sleezy, shady, and predatory come to mind…

I am dreaming for righteous 'small' employees too, those who carry out the dishonourable practice of implementing privacy intrusion following instructions, for money. Corporates are built by thousands of ignorant grey workers.

Re: Firefox expands fingerprint protections

#114

Post by kube-system »

mixmastamyk wrote: post #62

I'm still unhappy with the user-agent header. I tried removing information but it breaks a number of sites. Would like to leave Linux in there (if feasible so it gets counted) but remove/spoof everything else.

Breaking websites is about the only thing you're going to accomplish by messing with the UA string. It's a small amount of entropy and anyone who really wants to track you, doesn't need it.

Re: Firefox expands fingerprint protections

#115

Post by kube-system »

rolph wrote: post #55
cjkaminski wrote: post #33

Earlier quoted context omitted.

Agreed. And this technique becomes more effective as the number of people using it increases. It's easy to match up randomized fingerprints if only one person is doing it, but quite hard when thousands or millions are doing it.

dont use randomized fingerprints, spoof actual fingerprints, randomly.

A good fingerprint algorithm incorporates features and functionality that can't be spoofed because it is necessary for the browser to work correctly.

You can't just make your browser's APIs give erroneous outputs and still expect the browser's APIs to work.

Re: Firefox expands fingerprint protections

#116

Post by godelski »

kube-system wrote: post #101
godelski wrote: post #91

Earlier quoted context omitted.

Firefox is low on browser count but it's still around 4%[0]. That's enough that there will be lots of collisions. Even a small percent of a very large number is a very large number [0] https://radar.cloudflare.com/reports/browser-market-share-20...

Of course. However, if you're trying to search for somebody, and you're able to eliminate 96% of the data, you're in a much better position to accomplish your goal. Whether or not you should care about this depends on what kind of tracking threats you're trying to avoid.

I mean yes and no. Raw numbers still matter. It's all about context. If you have a billion visitors and rule out 96% of them, sure, searching 4 million it's easier but it's still such a large number that that alone isn't enough. That's all I'm trying to say.

Re: Firefox expands fingerprint protections

#117

Post by godelski »

kube-system wrote: post #97
godelski wrote: post #88

Earlier quoted context omitted.

Easy to detect but companies are lazy. I remember when Netflix first worked for Linux on chrome but not Firefox. I changed my agent and was good to go. After some months I emailed them asking to lift the agent block. They assured me they weren't blocking by agent. I sent them screenshots. They doubled down. So I said ¯\_(ツ)_/¯ and just kept using the agent until they unblocked it

Absolutely, but the parent was speaking about privacy. Access is a different story, because you can test different user agent strings, and immediately determine whether you get access. By contrast, you can't change a user agent string and readily determine whether or not you've broken someone's ability to track you.

My example of access is just a clearer example of laziness. Maybe they were tracking but it seems unlikely, right? If they were, why not block? Laziness is a much better explanation.

I can get feedback with access, I can't get feedback with tracking. That's why I mentioned access.

Re: Firefox expands fingerprint protections

#118

Post by kube-system »

godelski wrote: post #117
kube-system wrote: post #97

Earlier quoted context omitted.

Absolutely, but the parent was speaking about privacy. Access is a different story, because you can test different user agent strings, and immediately determine whether you get access. By contrast, you can't change a user agent string and readily determine whether or not you've broken someone's ability to track you.

My example of access is just a clearer example of laziness. Maybe they were tracking but it seems unlikely, right? If they were, why not block? Laziness is a much better explanation. I can get feedback with access, I can't get feedback with tracking. That's why I mentioned access.

They probably weren't tracking you, that was probably a case of directing a user toward a supported browser for customer support purposes. I would imagine that was a requirement in somebody's Jira ticket, solved with a few lines of code.

By contrast, tracking people on the web is a multibillion dollar industry, and there are out of the box commercial libraries that do very sophisticated tracking. None of these solutions rely on user agent string alone.

The vast majority of websites by count are not doing anything sophisticated. But some are.

Re: Firefox expands fingerprint protections

#119

Post by dpoloncsak »

godelski wrote: post #111
recursive4 wrote: post #93

Earlier quoted context omitted.

Out of curiousity, how would you steelman the argument that fingerprinting is no different than a store owner, standing behind the counter, taking note of the faces of who enters his store, and maintaining a log?

I'm fairly confident I could sue that store owner for stalking if they were logging every time I entered that store and left, along with all my activities. I'm absolutely positive I could if they were getting other store owners to help them track me. What I don't understand is why this is unacceptable if they do it to a single person but perfectly normal if they do it to all their customers. IMO that should make thin…

Doesn't your (proverbial) Costco membership card track every time you enter and leave the store? Doesn't seem like anyone is suing them...

Also, if they were logging you specifically, you may have grounds to stand on. But if they're logging every customer that comes in/out (like websites do), I think there is a lot less grounds for a restraining order or anything

Edit: Found out I'm using 'proverbial' wrong but I think you get the idea either way.

Re: Firefox expands fingerprint protections

#120

Post by kube-system »

godelski wrote: post #116
kube-system wrote: post #101

Earlier quoted context omitted.

Of course. However, if you're trying to search for somebody, and you're able to eliminate 96% of the data, you're in a much better position to accomplish your goal. Whether or not you should care about this depends on what kind of tracking threats you're trying to avoid.

I mean yes and no. Raw numbers still matter. It's all about context. If you have a billion visitors and rule out 96% of them, sure, searching 4 million it's easier but it's still such a large number that that alone isn't enough. That's all I'm trying to say.

Completely agreed
Post reply on HN