Apple adds a tracker blocker to desktop Safari • Hacker News Board

Re: Apple adds a tracker blocker to desktop Safari

#21

Post by wil421 » Mon, Jun 05, 2017, 7:08 PM UTC

gruez wrote: post #11

TallGuyShort wrote: post #6

Earlier quoted context omitted.

In practice, User-Agent strings (which are just HTTP headers) have been shown to be pretty effective at uniquely identifying and tracking most people. So even disabling JavaScript and Cookies only goes so far.

Source? Because the only information contained in user-agent strings in modern browsers are browser version (realistically limited to vendor since browsers auto-update) and operating system version. So basically all you're going to get is (Chrome/Firefox/Edge/Internet Explorer/Safari on Windows/Linux/Mac), which isn't much.

A quick Wikipedia search turns up more fields [1]. Although some of these fields are not 100% accurate due to historical reasons (I'm looking at you IE). I'd bet there are a couple other data points they gather via JS to finger print.

Example:

Mozilla/5.0 (iPad; U; CPU OS 3_2_1 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Mobile/7B405

1. https://en.m.wikipedia.org/wiki/User_agent

Re: Apple adds a tracker blocker to desktop Safari

#22

Post by notalaser » Mon, Jun 05, 2017, 7:09 PM UTC

amelius wrote: post #13

Sir_Cmpwn wrote: post #4

Earlier quoted context omitted.

There are a number of ways. Cookies are one, but you can also collect other kinds of data from a web browser to uniquely identify a user across multiple sessions. Generally speaking, if you can run JavaScript, you can track the user. This is done by all advertisers and most little widgets like Facebook or Disqus comments, like and tweet buttons, etc.

> This is done by all advertisers and most little widgets like Facebook or Disqus comments, like and tweet buttons, etc. Why isn't this illegal already?

Because it's highly lucrative.

Re: Apple adds a tracker blocker to desktop Safari

#23

Post by bauerd » Mon, Jun 05, 2017, 7:11 PM UTC

throwaway2048 wrote: post #14

bauerd wrote: post #5

Earlier quoted context omitted.

Probably most (if not all) fingerprinting sources are showcased by fingerprint.js: https://github.com/Valve/fingerprintjs2

It is essentially impossible to enumerate all the ways browsers leak fingerprintable information.

Yeah true, should've put it another way.

Re: Apple adds a tracker blocker to desktop Safari

#24

Post by _xgw » Mon, Jun 05, 2017, 7:12 PM UTC

gruez wrote: post #11

TallGuyShort wrote: post #6

Earlier quoted context omitted.

In practice, User-Agent strings (which are just HTTP headers) have been shown to be pretty effective at uniquely identifying and tracking most people. So even disabling JavaScript and Cookies only goes so far.

Source? Because the only information contained in user-agent strings in modern browsers are browser version (realistically limited to vendor since browsers auto-update) and operating system version. So basically all you're going to get is (Chrome/Firefox/Edge/Internet Explorer/Safari on Windows/Linux/Mac), which isn't much.

It's more than just the browser, it's the exact, EXACT version of the browser which can be very revealing if you're not updating your browser (almost) every day. For example: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.85 Safari/537.36

Re: Apple adds a tracker blocker to desktop Safari

#25

Post by fjarlq » Mon, Jun 05, 2017, 7:17 PM UTC

hellofunk wrote: post #3

It's unclear to me how these "trackers" work? How do they track you, is it cookies, or what?

A decent overview: https://panopticlick.eff.org/about

Test your browser: https://panopticlick.eff.org/

Re: Apple adds a tracker blocker to desktop Safari

#26

Post by tannhaeuser » Mon, Jun 05, 2017, 7:20 PM UTC

Thumbs up for Apple distinguishing themselves by their pro-privacy stance, as opposed to MS, who don't have anything to win by Win10's excessive "telemetry" IMHO.

Re: Apple adds a tracker blocker to desktop Safari

#27

Post by tyingq » Mon, Jun 05, 2017, 7:21 PM UTC

The big question to me is whether it's enabled by default, and whether it blocks requests to Google Analytics. If so, that's an interesting shot across the bow.

Re: Apple adds a tracker blocker to desktop Safari

#28

Post by abc_lisper » Mon, Jun 05, 2017, 7:25 PM UTC

gruez wrote: post #11

TallGuyShort wrote: post #6

Earlier quoted context omitted.

In practice, User-Agent strings (which are just HTTP headers) have been shown to be pretty effective at uniquely identifying and tracking most people. So even disabling JavaScript and Cookies only goes so far.

Source? Because the only information contained in user-agent strings in modern browsers are browser version (realistically limited to vendor since browsers auto-update) and operating system version. So basically all you're going to get is (Chrome/Firefox/Edge/Internet Explorer/Safari on Windows/Linux/Mac), which isn't much.

Check https://panopticlick.eff.org/

Re: Apple adds a tracker blocker to desktop Safari

#29

Post by tptacek » Mon, Jun 05, 2017, 7:26 PM UTC

This is great, but unfortunately, until Apple ups its browser security game, Safari is a non-starter. On macOS, switching from any other browser to Chrome is in the top 3 things you can do to materially improve your security in ways that actually matter in the real world.

Re: Apple adds a tracker blocker to desktop Safari

#30

Post by pmiller2 » Mon, Jun 05, 2017, 7:26 PM UTC

ceejayoz wrote: post #9

vim_wannabe wrote: post #2

>“It’s not about blocking ads, the web behaves as it always did, but your privacy is protected,” he added. Does this mean browser fingerprint is somehow scrambled before it is sent to the tracker instead of blocking?

> Does this mean browser fingerprint is somehow scrambled before it is sent to the tracker instead of blocking? It might be homogenized instead of scrambled. Every iOS device could be given (barring IP etc.) the same fingerprint.

I don't think that's even theoretically possible. How do you block JS font enumeration without crippling the browser font API?