Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

blog.mozilla.org

Post reply on HN
Print view View original

201–210 of 246 posts

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#201

Post by joemag »

crummy wrote: post #157
JohnFen wrote: post #78

Earlier quoted context omitted.

> Targeting this advert to most likely be seen by people who actually had been thinking of buying a hat shaped like sporting equipment is still a good idea too. Not if that targeting is done using data gathered about me without my consent -- as it almost universally is. Targeting based on context (what sort of website the ad is on, for instance), is fine.

> Targeting based on context (what sort of website the ad is on, for instance), is fine. Why? I didn't consent for that.

Do you object when sports TV channels show ads related to sports or people who enjoy sports?

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#202

Post by zaarn »

jlrubin wrote: post #124
jakubp wrote: post #106

Earlier quoted context omitted.

You are happier to have your resources stolen and not be aware of it (it's invisible, you can't see what's happening and react - right?) than to be shown an annoying thing which is very much in your awareness? I don't know, I'd rather know someone is harming me silently and have the means to stop it by default. The things that are shown in front of me, I can handle them...

Firefox already has tools to throttle tabs which are abusive CPU-load wise, which seems sufficient in this case. And it's unclear such resources are being 'stolen' if it's stated in the site ToS. Cryptocurrency mining is a lot less deleterious than ads. Mining doesn't need to track your behavior, it doesn't generate misleading native content, and it doesn't distract you from what you're trying to do. Sign me up! disc…

Just because you put it in the ToS doesn't make it legally or ethically acceptable. In addition, very few people will read the ToS of random websites they visit that begin cryptomining, resulting in non-consentual mining.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#203

Post by Tsubasachan »

manigandham wrote: post #117
JohnFen wrote: post #78

Earlier quoted context omitted.

> Targeting this advert to most likely be seen by people who actually had been thinking of buying a hat shaped like sporting equipment is still a good idea too. Not if that targeting is done using data gathered about me without my consent -- as it almost universally is. Targeting based on context (what sort of website the ad is on, for instance), is fine.

Data about you is not your data. Anyone can stand outside and watch what people do and take notes. That doesn't need your consent. It's the same thing here.

Following someone around all day taking notes would be considered stalking.

I think the fundamental problem here is that people in the EU will choose privacy over the ability of companies to make money. Its a different outlook on life. When its my interests versus the interests of business I choose me.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#204

Post by alkonaut »

charlesdaniels wrote: post #59

I agree with the general sentiment in the comments that this is good -- fingerprinting in particular is something browser vendors should be trying to combat. I am concerned about the approach however; a simple blacklist of fingerprinting scripts may be insufficient, in that non-blocked scripts can still access the data that is used to accomplish fingerprinting. Personally, I would like to see more security around the…

Agree. It's almost like google made their captcha to ensure browsers continued to allow fingerprinting rather than to tell bots from humans.

As you say perhaps sites can get a kind of "entropy budget". If they ask for my screen size that's X bits of entropy. If they want to render things to a canvas and read back the result that's Y bits of entropy (Y >> X). Once sites reach a certain budget that users can set themselves, they get fake or invalid data. Worst case if I set the entropy budget too low is I get a captcha or an incorrect layout somewhere.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#205

Post by joemag »

jimmaswell wrote: post #104
JohnFen wrote: post #78

Earlier quoted context omitted.

> Targeting this advert to most likely be seen by people who actually had been thinking of buying a hat shaped like sporting equipment is still a good idea too. Not if that targeting is done using data gathered about me without my consent -- as it almost universally is. Targeting based on context (what sort of website the ad is on, for instance), is fine.

I don't understand this new position (that GDPR follows) that consent is required for information to be gathered on someone. If someone sees me wearing a blue shirt and writes in their notebook that I wore a blue shirt then I don't feel like I have some inherent right to coerce them to erase it or prevent them from selling that information to Blue Shirt Emporium.

Many laws and societal norms don’t require universal acceptance. So it’s totally reasonable for you to not care, while society in general feels the opposite. Or vice versa.

And in your case of the note taker, a better example would be somebody that frequently follows you, and takes notes about what you wear. In many places, that could be grounds for harassment claim. In other words, it’s not the act that matters to most people, but the frequency and scale at which the act takes place.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#207

Post by alkonaut »

Smithalicious wrote: post #175

I don't like this reaction to crypto mining scripts. I won't argue that a lot of crypto mining scripts out there are blatantly abusive but I think that as a concept it's a great business model. I wouldn't have a problem using sites that eschewed ads and used crypto mining scripts instead and I would have no reason at all to block them (unlike ads) as long as they're well behaved. I think blocking mining scripts is a…

If it could be made 1) openly 2) efficiently 3) for a good cause (i.e. something where companies pay for computing power, but likely not crypto mining) then I'd be all for it. It's at least a workable micro-transaction.

"You aren't a subscriber. Do you want to see the article while running a cpu intensive script, or pay $0.50, or pay $10 for a yearly subscription?"

I'm not too optimistic this would work however. Bandwidth issues, and the short stay would make it very tricky to do something efficiently.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#208

Post by nukeop »

tialaramex wrote: post #66
wurst_case wrote: post #47

Earlier quoted context omitted.

Since you work on ads, may I ask why you support this? Won't this make most of your features ineffective?

In principle advertising is fine. Telling people that a product exists is useful. "Do you need a hat shaped exactly like a golf ball? At Dave's Golf Ball Hats we sell six sizes!". Targeting this advert to most likely be seen by people who actually had been thinking of buying a hat shaped like sporting equipment is still a good idea too. But an advert that steals from you, or harms you is neither of those things. Goog…

The purpose of advertising is to manipulate you into buying things you don't need, not to inform you about a product that is useful. Turn on the TV, or the radio, or any website, and show me one advert that is purely informative.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#209

Post by nukeop »

charlesdaniels wrote: post #59

I agree with the general sentiment in the comments that this is good -- fingerprinting in particular is something browser vendors should be trying to combat. I am concerned about the approach however; a simple blacklist of fingerprinting scripts may be insufficient, in that non-blocked scripts can still access the data that is used to accomplish fingerprinting. Personally, I would like to see more security around the…

The more websites use Google's "captcha", the more pointless it is to resist fingerprinting. And since that "captcha" is built into Cloudflare's "spam protection", it blocks you from half of the internet already.

Why the scare quotes? Because the purpose of recaptcha isn't to tell humans from bots, it's to punish users who do not wish to be tracked by giving them an endless stream of challenges to solve no matter if they keep getting them right or wrong. It is especially obvious when they intentionally delay the loading of subsequent images if you have too many privacy features enabled, because it does nothing to prevent bots from solving them. It's grouped into several tiers, depending on the amount of frustration they want to generate:

1. Invisible captcha - you have Chrome, you're logged into a Google account, your advertising ID has a profile full of useful data. You go in with no hassle.

2. 1 click - maybe you're on a new IP or a new device, but you're logged into a Google account and use Chrome. Click the checkbox and that's it.

3. Regular captcha - You're not logged in but you don't use any privacy enhancements, so through a combination of fingerprinting, cookies, and other tracking techniques you're uniquely identified anyway. You get 9 images, select 2 or 3 of them and you're good to go.

4. Annoying captcha - you're blocking third party cookies, you're not on Chrome, looks like you're not being a good cog in the machine. You get a captcha with 9 squares that load more images, or you have to "select squares containing X", and you get 2-5 of these in a row.

5. Infuriating captcha - you're blocking third party trackers, cookies, all other storage methods, you block or mitigate canvas fingerprinting, you're behind a VPN, your fingerprint is not recognized, there's no data in your profile. Google won't squeeze a cent out of you, so you don't get to use the internet. You're getting an endless stream of slowly loading squares, or 5-7 objects to recognize. Even if you do all of them correctly, it won't let you in. Maybe after 4-8 cycles, but that will still waste ~10 minutes per try. You're barred from any website that links to reCaptcha.

These days websites using it are for all purposes dead to me. I can't visit them and I won't waste my time clicking their images or selecting squares or whatever.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#210

Post by close04 »

l0b0 wrote: post #197
sneak wrote: post #190

Earlier quoted context omitted.

No, it’s the site owner choosing to outsource their decisions about gatekeeping a private site to Google. Google isn’t censoring you via CAPTCHA, the site owner is.

That is only true as far as the site owner knows of and understands the consequences of their actions. I would be extremely surprised if more than 10% of their users understand this. Whether they care is a whole other matter, but this is very likely ignorance rather than malice on the part of site owners.

I can understand why site owners resort to such services. They need a a strong CAPTCHA system. The problem is really Google for abusing it.
Post reply on HN