Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple adds a tracker blocker to desktop Safari

techcrunch.com

Post reply on HN
Print view View original

121–130 of 301 posts

Re: Apple adds a tracker blocker to desktop Safari

#121

Post by 0x0 »

cptskippy wrote: post #100
dkonofalski wrote: post #58

Earlier quoted context omitted.

There's a huge difference between being asked if it's ok to share your data and just sharing it by default. Additionally, Apple doesn't offer any kind of way for anyone but you to decrypt your data.

So you've never actually installed Windows 10 then? Because from the beginning it's asked for permission to share your data for things like Cortona, the touch keyboard, ink, voice, etc. Based on user response they've evolved the interface and made it clearer removing anti-patterns. This is the same stuff Apple asks for permissions on. Microsoft doesn't let you turn off telemetry data entirely. Things like hardware co…

You can turn off spotlight and safari and siri suggestions and there should be no traffic to Apple after that.

Re: Apple adds a tracker blocker to desktop Safari

#122

Post by cpeterso »

gruez wrote: post #11
TallGuyShort wrote: post #6

Earlier quoted context omitted.

In practice, User-Agent strings (which are just HTTP headers) have been shown to be pretty effective at uniquely identifying and tracking most people. So even disabling JavaScript and Cookies only goes so far.

Source? Because the only information contained in user-agent strings in modern browsers are browser version (realistically limited to vendor since browsers auto-update) and operating system version. So basically all you're going to get is (Chrome/Firefox/Edge/Internet Explorer/Safari on Windows/Linux/Mac), which isn't much.

Even without JavaScript or cookies, HTTP request headers can reveal a lot of unique entropy:

  * Browser
  * Browser version
  * OS
  * OS version
  * Machine architecture such as x86, x86-64, or ARM
  * User locale
  * IP address
  * DNT flag
Trackers can also tag clients with unique cookie-like ETag or Cache-Control values that clients will return in future HTTP requests.

Re: Apple adds a tracker blocker to desktop Safari

#123

Post by eugeniub »

jacobolus wrote: post #62
dkonofalski wrote: post #58

Earlier quoted context omitted.

There's a huge difference between being asked if it's ok to share your data and just sharing it by default. Additionally, Apple doesn't offer any kind of way for anyone but you to decrypt your data.

I think he’s referring to aggregated anonymized usage data, which people can opt in or out of with no effect on function. (This is different than messages, etc., which are stored on Apple’s servers but end-to-end encrypted.)

Messages are not currently stored on Apple servers unless you enable iCloud backup.

Re: Apple adds a tracker blocker to desktop Safari

#125

Post by gsnedders »

derefr wrote: post #83
gsnedders wrote: post #71

Earlier quoted context omitted.

You don't even need the font metrics API. Draw a span containing the character "m", measure the width of the span using Element.clientWidth. Unless you taint (almost literally) the entire CSSOM, you can pull off similar things.

Is there a reason to not taint the entire CSSOM? Alternately: why not anonymize CSSOM return values? Your browser might have access to OS fonts A+B+C, but if your JS asked the CSSOM about the size of characters on the page, the answer it would give would come from an "alternate world" where the browser only has access to the web-safe fonts, and so is using one of them.

Huge amounts of the web will break: anything doing anything layout-related with JS will likely break.

Changing line-lengths will cause odd bits of layout breakage, so just giving bogus results as if rendered with a different set of fonts won't work properly either.

Re: Apple adds a tracker blocker to desktop Safari

#126

Post by ocdtrekkie »

miles wrote: post #105
ch4ck wrote: post #47

Earlier quoted context omitted.

Internet Explorer has tracking protection since IE9.

They are completely different beasts. Internet Explorer merely offers the option to enable[1] "Do Not Track", which websites and advertisers are free to ignore[2], while Safari's new ad tracker blocker "uses machine learning to identify trackers, segregate the cross-site scripting data, put it away so now your privacy — your browsing history — is your own"[3]. [1] https://en.wikipedia.org/wiki/Do_Not_Track#Internet_E…

You are actually incorrect. Tracking Protection refers to an IE feature that lets you set "Tracking Protection Lists", which block traffic to specified domains and URLs. You can see a bit about them here: https://msdn.microsoft.com/en-us/library/hh273400(v=vs.85).a...

The whole "Do Not Track" default thing was, of course, a huge fiasco, as Google and others chose to ignore IE's default usage of it.

Re: Apple adds a tracker blocker to desktop Safari

#128

Post by alternativetoo »

alternativetoo wrote: post #72
tannhaeuser wrote: post #26

Thumbs up for Apple distinguishing themselves by their pro-privacy stance, as opposed to MS, who don't have anything to win by Win10's excessive "telemetry" IMHO.

Hmmm. https://arstechnica.com/tech-policy/2017/03/isps-say-your-we... > CTIA is the main lobbyist group representing mobile broadband providers such as AT&T, Verizon Wireless, T-Mobile USA, and Sprint. It doesn't just represent them, Apple is also a member: https://www.ctia.org/about/our-members

5 downvotes huh; anyone able to explain how the above is compatible with a strong pro-privacy stance? That's like saying you're a vegetarian, except for saturday noon.

Re: Apple adds a tracker blocker to desktop Safari

#129

Post by justinschuh »

tptacek wrote: post #29

This is great, but unfortunately, until Apple ups its browser security game, Safari is a non-starter. On macOS, switching from any other browser to Chrome is in the top 3 things you can do to materially improve your security in ways that actually matter in the real world.

Just to add some context, on macOS you can look at the seat-belt policy as a rough analog of for basic sandboxing guarantees, where the fewer exceptions you have the stronger your sandbox is. From that perspective, Chrome's policy has around 1/10th the exceptions of Safari.

* Safari SB policy: https://trac.webkit.org/browser/webkit/trunk/Source/WebKit2/...

* Chrome SB policy: https://cs.chromium.org/chromium/src/content/renderer/render...

And of course, that's before we get into more complex forms of isolation that Chrome implements, such as the sandboxed GPU process, or ongoing work into things like network sandboxing, the macOS bootstrap sandbox, and site isolation (origin-bound renderer sandboxing).

Re: Apple adds a tracker blocker to desktop Safari

#130

Post by AlexandrB »

tptacek wrote: post #80
dfischer wrote: post #64

Earlier quoted context omitted.

How is Chrome more secure than Safari on macOS?

If you're interested in a detailed answer, read this: https://medium.com/@justin.schuh/securing-browsers-through-i... Then try to work back either Edge's or Chrome's approach to security to specific Safari features and design. The Chrome security team is probably the most sophisticated software security team in the industry (lest you think I'm in the tank for Google, I'd say the iOS platform security team is a close…

> The Chrome security team is probably the most sophisticated software security team in the industry

Unfortunately the Chrome security team can't provide the kind of security I care about - security from Google's tracking.

Post reply on HN