Earlier quoted context omitted.
People with that preference usually just turn off javascript.
...and they would still be susceptible to CSS-based fingerprinting.
[deleted]
Firefox to add Tor Browser anti-fingerprinting technique called letterboxing
201–210 of 216 posts
Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing
#202Earlier quoted context omitted.
> Trading functionality that relies on DOM/media queries for privacy is totally valid Perhaps it should be a site-specific permission like the microphone or camera. Your generic news site doesn't need that functionality (and shouldn't ask for the permission - you'd know something shady was going on) but your browser-based CAD tool would and you'd grant it there.
This will cause a permissions fatigue. Only the most sensitive things should have permission. The usage of these capabilities is large enough that it should not be behind a permission.
If we went down this path, I think that the any permissions dialog would come at the end of a very long PR campaign and feature ratcheting to get developers to update their sites to not need the permission unless absolutely necessary. Sort of like what's happened with the deprecation of Flash.
Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing
#203Earlier quoted context omitted.
I've seen this tendency on HN - if this person/entity does something, I suspect it must be bad or selfish. On the subject of HTTPS - do you think the interests of ordinary consumers are in any way served by continuing on HTTP? Countless websites, even those accepting login credentials used to think that it was acceptable to not take the trouble to set up HTTPS. The only thing the operators of these websites cared abo…
Sorry, but there's really no reason to force HTTPS on static webpages, news sites, or any site where you're just browsing/consuming. Google is smart enough where they could've enforced the penalty on sites that should use HTTPS, such as those with any kind of form submission or login. But they chose not to without much of a reason, and that's why I can believe it helped some hidden motive of theirs.
> Sorry, but there's really no reason to force HTTPS on static webpages...
I downvoted you because this is wrong. There are at least two good reasons for it:
1. It prevents MitM attacks. For example, some ISPs and free WiFi APs inject arbitrary code into unencrypted pages.
2. It improves privacy by hiding the request headers, including hostname.
Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing
#204The Tor Uplift process later continued in Firefox 55 when Mozilla added a Tor Browser feature known as First-Party Isolation (FPI), which worked by separating cookies on a per-domain basis, preventing ad trackers from using cookies to track users across the Internet. This feature is now at the heart of Project Fission and will morph into a Chrome-like "site isolation" feature for Firefox.
This is just factually incorrect.
Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing
#205Earlier quoted context omitted.
There is a way to stop fingerprinting. That way is serving pages via distributed network (over a WoT or torrent-like thing). All these other ways do is give people the illusion that they're safe from being tracked, when the reality is that they're tracked just the same, but by fewer people so the data is more valuable. This means that the money is centralizing around the actors with the most inexplicable methods of t…
Protocol wise, basic shared VPNs will stop most everything short of a semi-global passive adversary. The problem is running hostile code on your own machine, coupled with browser makers thinking it is a generally fantastic idea to allow that hostile code to access a whole slew of security-sensitive information. Sure, VPN won't repudiate the region bullshit, and can even be outright blocked. But if adoption rose to th…
>and can even be outright blocked.
That's my biggest fear. Yesterday I woke up to find out that Three (a big telco provider in the UK) had blocked Mullvad's API path as 'adult content'. I had to physically go to a store and verify that I was an adult to be able to use my VPN - the very same VPN I use because I have so little trust in the UK Gov (I'm not from here and am not staying long term, but hate that the society reminds me of 1984 regularly),
Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing
#206Earlier quoted context omitted.
I've been using privacy.resistFingerprinting for a while and also recommend it, but there is one major "side effect": your reCAPTCHA score will drop to 0.1 making many websites really tedious to use. It's a price I'm willing to pay though...
> ne major "side effect": your reCAPTCHA score will drop to 0.1 making many websites really tedious to use. I instantly leave a website that has this aggressive reCaptcha that uses free labour to train algorithms.
I personally take the route of training the algorithms poorly. It wants me to select streetlights? Fine, I'll pick all but one streetlight and maybe even a tree. Do I have to click more boxes because of this? For sure. Is it worth it? Yep.
Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing
#207Earlier quoted context omitted.
The ad industry was ready to honour DNT. MS killed it by going default.
Sure, they gave their pinky promise do not track those, who will set it.
You can opt out of ads, actually, and those will be respected. And companies in the industry knew they'd play by the rules or suffer.
I was in favour of DNT and made a little browser extension that would allow you to DNT some sites and not others. My hope was that eventually we'd be in a state where you could signal to the site right away whether you'd accept tracking or not and the site could paywall you if you didn't. That way it's a "pay with your data or money" loaded into the User Agent and I think I like that. It respects user choice.
Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing
#208Earlier quoted context omitted.
Protocol wise, basic shared VPNs will stop most everything short of a semi-global passive adversary. The problem is running hostile code on your own machine, coupled with browser makers thinking it is a generally fantastic idea to allow that hostile code to access a whole slew of security-sensitive information. Sure, VPN won't repudiate the region bullshit, and can even be outright blocked. But if adoption rose to th…
>and can even be outright blocked. That's my biggest fear. Yesterday I woke up to find out that Three (a big telco provider in the UK) had blocked Mullvad's API path as 'adult content'. I had to physically go to a store and verify that I was an adult to be able to use my VPN - the very same VPN I use because I have so little trust in the UK Gov (I'm not from here and am not staying long term, but hate that the societ…
I was referring to blocking by websites, as there is actually some competition between them. For example, a few major ecommerce sites frustrate or outright block traffic from my VPS, so I've simply stopping visiting them rather than poking holes.
A similar dynamic is present for ISPs wherein if most people expect "Internet access" to mean something that works with VPNs, then ISPs can't block it [0]. But that's a harder state to reach as there's much less competition between ISPs. A commerce site wouldn't want to forgo 10% of their business, but a government/quasi-government has no problem demonizing 10% of their subjects.
Which is why we ultimately do need non-real-time protocols and namespaces for the bulk of communication.
[0] Nagging systems like the UK would still exist, but they couldn't progress further to outright banning it.
Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing
#209This is horrible from a UX perspective. There are many fingerprinting techniques besides this. I don't see how adding a user hostile behaviour will help.
Fortunately, this is entirely optional. The "privacy.resistFingerprinting" option bundles a set of features that make it more difficult for sites to uniquely identify the user at a cost to usability. It's up to each user to determine whether that usability cost is worth the privacy improvements. On Firefox, it's an opt-in setting, off by default.
Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing
#210This is horrible from a UX perspective. There are many fingerprinting techniques besides this. I don't see how adding a user hostile behaviour will help.
What else can they do to decrease the effectiveness of increasingly hostile trackers?