131–140 of 168 posts
Earlier quoted context omitted.
Better cloudflare than your ISP that's already explicitly intercepting your dns queries to sell your data/profile.
False dichotomy. Not only am I pretty sure Sonic isn't selling my DNS queries, I've already opted out of DNS over HTTPS. Refusing to respect the choices I've made is worse than not. Besides, unencrypted SNI means that if my ISP wanted to get the hosts I was looking at, they could.
The more time passes, the more comfortable I feel about mostly interacting with the internet from a Qubes box, in a disposable Whonix/Tor VM, with Javascript disabled... This is just gross. I mean, not surprising. But appalling in so many ways that it's even possible. If you're not familiar with fingerprint.com, they do "deep user profiling" - think "maintaining a constant user ID across computers, browsers, OSes, et…
Edit: ublock origin filter, which breaks the demo:
||fpjscdn.netGood thing I always change the name of my devices. Apple's default naming is a privacy error. One time I was on a first date with someone in law enforcement. Being a woman alone and obviously interested in protecting herself, she'd done a background check on me and had informed several fellow community members of our whereabouts. I, on the other hand, didn't know her last name. We joked about that. When we got in her…
So many times a rental car comes with a dozen of profiles from previously paired phones along with their phone books, saved map locations, history. Not much use, of course, still, it leaks out without much thought to it.
Guess what, the hardest thing is to remind myself to clear my profile before returning the car...
If only disabling JavaScript didn't disable end user experience lol
This is a well-written, interesting article. I especially like the non-alarmist tone to it ("Considering the inherent weaknesses and numerous limitations, this attack isn't practical.")
This allows to test wether hostnames exists on your network.
It’s maybe not an issue for a unique hostname but what about fixed hostnames or default hostnames that are common in the IoT world.
This allows a website to secretly guess if you own a given device. It’s even worse used in a targeted attack : if you know some devices of the network, you can guess that the connected user is on the targeted network.
Earlier quoted context omitted.
Is that true? There’s a preflight request that checks with the server as to what’s allowed and then the browser issues the original request if it’s ok, right?
"Simple requests" are not preflighted, such as those that do not set any headers (among other qualifications). https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simpl... (Aside, is MDN's href linking broken for everyone or just me?)
On my macOS box, I run Little Snitch, a nice UI that can be set to ask local user for explicit permission before allowing a network request. https://www.obdev.at/products/littlesnitch/index.html I’ve occasionally stumbled on it during remote logins, usually when an SSH session wants to download something new, like NPM requesting NodeJS bits. The text terminal SSH download will block; if I figure out it’s the Little S…
Earlier quoted context omitted.
Using Firefox (on a Linux laptop) with resistfingerpriting=true or Mull (on an Android) with its default settings, I'm able to get assigned a new fingerprint whenever I clear cookies or use a new Incognito session. I haven't tested it, but presumably they also wouldn't be able to track me between domains, even without clearing cookies.
So it gets me on MacOS with safari, lynx, and firefox with strict anti-tracking on. Tor works for blocking it. All in all they have created a creepy wee tool.
A little disappointed that Privacy Badger didn't seem to make any difference. Was active the whole time.
On my macOS box, I run Little Snitch, a nice UI that can be set to ask local user for explicit permission before allowing a network request. https://www.obdev.at/products/littlesnitch/index.html I’ve occasionally stumbled on it during remote logins, usually when an SSH session wants to download something new, like NPM requesting NodeJS bits. The text terminal SSH download will block; if I figure out it’s the Little S…
I've heard of little snitch a ton, but is it just a really smart firewall essentially? On Windows, every darn thing connects to something, its ridiculous.
Earlier quoted context omitted.
Better cloudflare than your ISP that's already explicitly intercepting your dns queries to sell your data/profile.
False dichotomy. Not only am I pretty sure Sonic isn't selling my DNS queries, I've already opted out of DNS over HTTPS. Refusing to respect the choices I've made is worse than not. Besides, unencrypted SNI means that if my ISP wanted to get the hosts I was looking at, they could.