Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Block Fingerprinting with Firefox

blog.mozilla.org

Post reply on HN
Print view View original

311–320 of 411 posts

Re: Block Fingerprinting with Firefox

#311

Post by [deleted] »

roca wrote: post #200
3xblah wrote: post #194

Earlier quoted context omitted.

Mozilla has a conflict of interest. It pays its developers indirectly from internet ad revenue through deals with companies that sell ads. More importantly it seeks to compete with a browser controlled by ad sales company. Giving the users commenting negatively the privacy they want would mean that Firefox would not implement the "features" that its developers believe are necessary for a "good browser".1 What "good b…

FORMER Mozilla employee, FWIW. Mozilla doesn't exist for its developers. Most of its developers could make a lot more money working elsewhere. The reality is that if Firefox isn't competitive in performance, security, and Web compatibility, very few people will use it, in which case why even bother? There's more at stake here than just privacy, too. An open platform that isn't controlled by a single vendor, that does…

[deleted]

Re: Block Fingerprinting with Firefox

#312

Post by everdrive »

xvector wrote: post #15

Can someone paste their results (or at least bits of fingerprinting entropy) from https://panopticlick.eff.org with the latest Firefox? With the fancy new anti-fingerprinting Safari on macOS Mojave I get just over 14.5 bits of entropy with the most entropic source being my canvas fingerprint (1 in 600). With Safari on iOS I get 11.71 bits of entropy, with the most entropic value being my screen size and color depth.

"Currently, we estimate that your browser has a fingerprint that conveys at least 17.66 bits of identifying information."

However, some of the information sent by my (stock browser) is clearly false:

User Agent: Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0

Platform: Linux x86_64

I didn't mess with my user agent, so I assume this is related "resistfingerprinting" in about:config.

Re: Block Fingerprinting with Firefox

#313

Post by a_imho »

roca wrote: post #200
3xblah wrote: post #194

Earlier quoted context omitted.

Mozilla has a conflict of interest. It pays its developers indirectly from internet ad revenue through deals with companies that sell ads. More importantly it seeks to compete with a browser controlled by ad sales company. Giving the users commenting negatively the privacy they want would mean that Firefox would not implement the "features" that its developers believe are necessary for a "good browser".1 What "good b…

FORMER Mozilla employee, FWIW. Mozilla doesn't exist for its developers. Most of its developers could make a lot more money working elsewhere. The reality is that if Firefox isn't competitive in performance, security, and Web compatibility, very few people will use it, in which case why even bother? There's more at stake here than just privacy, too. An open platform that isn't controlled by a single vendor, that does…

What is an easier solution to improving browsing experience, performance and security than blocking ads? Don't you think a simple extension like ublock demonstrates a whole paradigm shift in browsing experience? One that moz://a should be striving for?

Re: Block Fingerprinting with Firefox

#314

Post by dhimes »

maxheadroom wrote: post #275
rplnt wrote: post #270

Earlier quoted context omitted.

"But you told me to use Chrome." Google took over with shady practices, with the help of tech savvy people.

Not to mention Edge moving to the Chrome base; which further disenfranchises anyone from making sure it works in 'x' browser, anymore. " It works in Chrome and Edge, which is based on Chrome, so what's your problem, again? "

As developers we should take a blood oath that we will always optimize for Firefox.

Re: Block Fingerprinting with Firefox

#315

Post by dhimes »

visarga wrote: post #263
sebazzz wrote: post #221

Earlier quoted context omitted.

Remember that reCAPTCHA v1 used to be noble: reading books and converting them to text. Now you're just training many Google machine learning algorithms by classifying data. In which they get more useful for the consumer, thus more powerful.

I hate them as much as you do, but you're wrong. Those storefront and traffic sign captchas are not useful for training ML models. If they were to be useful, they would be much more varied, like the original ones (used for OCR).

I hate them as much as you do, but you're wrong.

I would love to see some evidence (a link or something) of this. I see captchas that look like pretty good edge-detection discriminators- street lights in tree limbs, bicycles against brick, and so on.

Re: Block Fingerprinting with Firefox

#316

Post by bytesandbots »

sebazzz wrote: post #221
dessant wrote: post #94

Google's reCAPTCHA makes it impossible to use large portions of the web once you take reasonable measures to protect your privacy. The challenge will continuously fail, despite you spending time to carefully solve it. This cruel behavior is described in a patent [1] by Kyle Adams of Juniper Networks. [1] https://patents.google.com/patent/US9407661

Remember that reCAPTCHA v1 used to be noble: reading books and converting them to text. Now you're just training many Google machine learning algorithms by classifying data. In which they get more useful for the consumer, thus more powerful.

They are able to verify that the user selection is correct. It is possible only if they already have the right answer. If they already have the right answer, what are they training for.

Re: Block Fingerprinting with Firefox

#317

Post by dual_basis »

bytesandbots wrote: post #316
sebazzz wrote: post #221

Earlier quoted context omitted.

Remember that reCAPTCHA v1 used to be noble: reading books and converting them to text. Now you're just training many Google machine learning algorithms by classifying data. In which they get more useful for the consumer, thus more powerful.

They are able to verify that the user selection is correct. It is possible only if they already have the right answer. If they already have the right answer, what are they training for.

They have some known right answers and some they don't know. They check that you get the ones they know correct, and then they take the other info you provide and add some confidence that they are correct. This bootstraps the system.

Re: Block Fingerprinting with Firefox

#318

Post by dual_basis »

maxheadroom wrote: post #279
visarga wrote: post #263

Earlier quoted context omitted.

I hate them as much as you do, but you're wrong. Those storefront and traffic sign captchas are not useful for training ML models. If they were to be useful, they would be much more varied, like the original ones (used for OCR).

> Those storefront and traffic sign captchas are not useful for training ML models. Not to get all tin-foil-hat, but this is going to sound like it, but if you have a car that has 9+ cameras upon it that drives in areas full of these, then maybe there would be some use for it for Google. Bear in mind that I'm not saying that they are doing this but to dismiss it unequivocally as something that can't or wouldn't be do…

Of course that's what they're doing... I thought this was well known? I don't think they claim otherwise.

Re: Block Fingerprinting with Firefox

#319

Post by tragicpapercut »

yc12340 wrote: post #309
philpem wrote: post #287

Earlier quoted context omitted.

While I agree with you -- I'd also like to point out that >90% of malicious traffic to the websites I administer comes through the Tor network. It shouldn't be the case, and I don't want to block people who have a legitimate reason to use Tor. Unfortunately there isn't a "block Tor traffic from assholes" option, so all I can really do to reduce the malicious traffic is block exit nodes.

This has nothing to do with Tor. Cloudflare frequently blacklists entire countries/counties worth of people (and rarely reverts those blacklists). There is a good chance, that you have missed a lot Indian/Vietnamese/Russian/Chinese visitors, because Cloudflare concluded, that forwarding their traffic to your site isn't financially viable for them. > Unfortunately there isn't a "block Tor traffic from assholes" option…

And for companies that don't do business with those countries - this is not a loss.

Most "asshole" traffic I see falls into one of two categories - attempts to exploit vulnerabilities (../../../etc/passwd stuff) and account takeover attacks.

The first I can forgive, I don't frankly care where that traffic comes from and the responsibility is entirely mine as website admin to prevent these types of attacks through good coding practices, WAF, etc.

The second I have less control over because customers / the general public sucks at security. They re-use passwords they've had for 10 years and won't opt-in to 2fa. And as a merchant, my company generally eats the cost of fraud that these attacks generally result in.

If no or little legitimate traffic is coming from Tor, and a significant percentage of malicious traffic is coming from Tor - at great cost to me / my company - why the hell would I allow it to continue?

Re: Block Fingerprinting with Firefox

#320

Post by dual_basis »

philpem wrote: post #290
atoav wrote: post #260

Earlier quoted context omitted.

I had simple questions you can answer with text on my site for years, and I had no spam problem whatsoever. I am not convinced that training google’s image recognition algorithms is the only way to solve the captcha problem

I have one which picks a bunch of random single-digit numbers and a math operator, then asks you to type the result. I spent days trying it out with screen readers and tweaking it to work with as many as possible.

This seems like it would be very easy to game
Post reply on HN