Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

blog.mozilla.org

Post reply on HN
Print view View original

41–50 of 246 posts

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#41

Post by VWWHFSfQ »

mcsmash wrote: post #37
mikro2nd wrote: post #31

I don't much like the notion of farming out my "cryptomining blocker" to some unknown-to-me third party. There are a (small) number of sites that do cryptomining after asking for an opt-in permission (e.g. bit.tube). It seems to me that this is an interesting exploration of new, alternate funding models than serving ads, and I, for one, like to (sometimes) support these. I'd hate to see them land up in a blocklist I…

This. The internet desperately needs to progress beyond an advertisement driven business model. Disallowing these scripts seems a little heavy handed. Perhaps the addition of a "requestComputeResources" method to the browser's api would give a way to throttle them instead of outright banning them.

Nobody would use that API if they can just do it anyway without the users consent

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#42

Post by mrspeaker »

mikro2nd wrote: post #31

I don't much like the notion of farming out my "cryptomining blocker" to some unknown-to-me third party. There are a (small) number of sites that do cryptomining after asking for an opt-in permission (e.g. bit.tube). It seems to me that this is an interesting exploration of new, alternate funding models than serving ads, and I, for one, like to (sometimes) support these. I'd hate to see them land up in a blocklist I…

I agree it sounds harsh, but I think for NOW it's the correct choice. Like any browser API that can be abused, the small number of valid sites are so overwhelmingly dwarfed by the dodgy ones. When I first heard about the "notifications" API I thought it was a great idea - so many valid use case! Now I want it to burn in a fire. Something with so few use cases as cryptomining should not be something that users blindly click yes to.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#44

Post by cimmanom »

founderling wrote: post #26

In collaboration with Disconnect, we have compiled lists of domains that serve fingerprinting and cryptomining scripts. Now in the latest Firefox Nightly and Beta versions, we give users the option to block both kinds of scripts Isn't this something that content blockers like umatrix already excel at? Why put it into the core of Firefox? I would prefer to see Firefox giving more power to extensions. For example, it i…

Because the vast majority of users have no idea that that's something they can or should be using.

Power users like you and I can disable this if we like, using about:config.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#45

Post by walrus01 »

empath75 wrote: post #6

Seems like they're just using a blacklist? Those seem to be able to be gamed pretty trivially.

One would think that the past 25 years of experience with SMTP RBLs would teach people that using predefined DNS based blacklists (or IP space range blacklists) is indeed a game of whack-a-mole.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#46

Post by meruru »

founderling wrote: post #40
meruru wrote: post #35

Earlier quoted context omitted.

I prefer to have features like this in core so I don't have to give a ton of permissions to a third party. I hope it becomes powerful enough to replace uMatrix.

Extensions are analyzed by the Firefox team: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/AMO... If the review process is still insecure (That is how I understand you reply) I would prefer them to put their energy into this. Analyzing popular extensions in depth (and giving them some 'in depth analyzed' badge) so you do not have to trust a third party.

I don't know how much I can trust the review process. I believe they have relaxed it a bit recently: https://blog.mozilla.org/addons/2017/09/21/review-wait-times...

>Add-ons built on the WebExtensions API will now be automatically reviewed. This means we will publish add-ons shortly after uploading. Human reviewers will look at these pre-approved add-ons, prioritized on various risk factors that are calculated from the add-on’s codebase and other metadata.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#47

Post by wurst_case »

jefftk wrote: post #24

> In the coming months, we will start testing these protections with small groups of users and will continue to work with Disconnect to improve and expand the set of domains blocked by Firefox. We plan to enable these protections by default for all Firefox users in a future release. While lots of people here already have uMatrix or other blockers running, blocking fingerprinting and cryptomining domains by default wo…

Since you work on ads, may I ask why you support this? Won't this make most of your features ineffective?

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#48

Post by endorphone »

mcsmash wrote: post #37
mikro2nd wrote: post #31

I don't much like the notion of farming out my "cryptomining blocker" to some unknown-to-me third party. There are a (small) number of sites that do cryptomining after asking for an opt-in permission (e.g. bit.tube). It seems to me that this is an interesting exploration of new, alternate funding models than serving ads, and I, for one, like to (sometimes) support these. I'd hate to see them land up in a blocklist I…

This. The internet desperately needs to progress beyond an advertisement driven business model. Disallowing these scripts seems a little heavy handed. Perhaps the addition of a "requestComputeResources" method to the browser's api would give a way to throttle them instead of outright banning them.

They make it optional.

To be real, though, somewhere close to 0% (rounded to the third decimal place) of users would agree to grossly inefficient cryptomining in the browser. As a web funding model it is terrible and is almost always akin to malware. It certainly costs the user much more in electricity costs than it will ever benefit web publishers.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#49

Post by floatingatoll »

founderling wrote: post #26

In collaboration with Disconnect, we have compiled lists of domains that serve fingerprinting and cryptomining scripts. Now in the latest Firefox Nightly and Beta versions, we give users the option to block both kinds of scripts Isn't this something that content blockers like umatrix already excel at? Why put it into the core of Firefox? I would prefer to see Firefox giving more power to extensions. For example, it i…

Users who are prohibited from installing addons (or otherwise unable/unwilling) would benefit greatly from not needing to install an addon to be protected.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#50

Post by alexkavon »

muckrakerz wrote: post #19

Doesn't Brave, Brandon Eich's project, already do this? Its nicer to use to.

Oh you're right. Silly Mozilla adding protections to their browser for their user-base.

That's it everyone. Shut down Mozilla and have all the users switch over to Brave. Brandon Eich's got everything covered.

Post reply on HN