Live data from Hacker News

Tor NoScript visit tracker

bitbucket.org

21–24 of 24 posts

Re: Tor NoScript visit tracker

#21
post #2

> NoScript Tracker is a basic tracker that makes use of iframes and the Refresh HTTP header to measure how long users spend on web pages. > It is ideal for getting basic usage statistics on the Tor network, where JavaScript is not an option for most users. NoScript can block iframes; will that disable this tracker? Also, does the Tor Browser, which includes NoScript, default to blocking iframes?

NoScript->Options->Embeddings->Additional restrictions for untrusted sites->Forbid Just turned that option on, myself. I might have had it on years ago--can't remember for sure--but now that I know it's being abused, I'll definitely leave it on. IFRAMEs are generally poor practice, anyway.

Also, pay attention to these settings in about:config page:

accessibility.blockautorefresh

noscript.forbidBGRefresh

noscript.forbidMetaRefresh

Additionally, you can cherry-pick options (or just use it all) from this repository at https://github.com/pyllyukko/user.js for more privacy.

Re: Tor NoScript visit tracker

#23
post #7

What else, besides using Tor, and turning off Javascript, does a user have to do that a website operator finally gets they don't want to be tracked?

But this can't track individual users, it just provides general usage statistics, like visitor retention. I'd be interested in a viable example of this being used to identify users.

I'm unsure why this is downvoted.

I think he is saying that users can't be tracked between page-loads using this method, or your risk sending multiple users the same token. (which is true, at least with this implementation)

The time they spend on the website, latency, etc can all be used to add to a fingerprint, but there isn't something magic that makes this accurate, especially without JavaScript.

Edit: please don't mind me ghostposting kthx

Re: Tor NoScript visit tracker

#24

Earlier quoted context omitted.

NoScript->Options->Embeddings->Additional restrictions for untrusted sites->Forbid Just turned that option on, myself. I might have had it on years ago--can't remember for sure--but now that I know it's being abused, I'll definitely leave it on. IFRAMEs are generally poor practice, anyway.

Also, pay attention to these settings in about:config page: accessibility.blockautorefresh noscript.forbidBGRefresh noscript.forbidMetaRefresh Additionally, you can cherry-pick options (or just use it all) from this repository at https://github.com/pyllyukko/user.js for more privacy.

Thanks! I'll look into those.
Post reply on HN