51–60 of 246 posts
Do I read it correctly that fingerprinting is blocked purely with a script/domain blacklist?
how else would they block it
That's definitely not easy but it beats blacklists which are trivial to work around.
I do appreciate the feature! But how feasible would be to limit the amount of info retrievable from the JS layer instead than relying on a black list of domains serving fingerprinters?
Unfortunately such privacy measures come with a bunch of inconveniences. For both, Recaptca will become more obstructionist. Your window won't start maximised any more. Zoom levels will be forgotten when you open a link in a new tab. And if you use Tor Browser, by design there's also no saving passwords, no saving cookies, no saving tabs between sessions, and no browser/address bar history.
Seems like they're just using a blacklist? Those seem to be able to be gamed pretty trivially.
Seems like they're just using a blacklist? Those seem to be able to be gamed pretty trivially.
Agreed. Setting up blacklists is just whack-a-mole. I'd be more interested in detection of actual fingerprinting techniques, such as system font enumeration using canvas, or WebGL GPU fingerprinting. It would be technically possible to detect the creation of WebGL or canvas contexts that aren't actually rendered in the layout and prevent data gathered from those contexts from being sent in any XHR payload. I'm sure t…
Earlier quoted context omitted.
This. The internet desperately needs to progress beyond an advertisement driven business model. Disallowing these scripts seems a little heavy handed. Perhaps the addition of a "requestComputeResources" method to the browser's api would give a way to throttle them instead of outright banning them.
They make it optional. To be real, though, somewhere close to 0% (rounded to the third decimal place) of users would agree to grossly inefficient cryptomining in the browser. As a web funding model it is terrible and is almost always akin to malware. It certainly costs the user much more in electricity costs than it will ever benefit web publishers.
Earlier quoted context omitted.
how else would they block it
Present a uniform environment to scripts. For example fingerprinting doesn't work very well on iPhones because they are all so similar. Firefox could pretend to be some sort of "standard" machine. That's definitely not easy but it beats blacklists which are trivial to work around.
> In the coming months, we will start testing these protections with small groups of users and will continue to work with Disconnect to improve and expand the set of domains blocked by Firefox. We plan to enable these protections by default for all Firefox users in a future release. While lots of people here already have uMatrix or other blockers running, blocking fingerprinting and cryptomining domains by default wo…
Since you work on ads, may I ask why you support this? Won't this make most of your features ineffective?
I don't much like the notion of farming out my "cryptomining blocker" to some unknown-to-me third party. There are a (small) number of sites that do cryptomining after asking for an opt-in permission (e.g. bit.tube). It seems to me that this is an interesting exploration of new, alternate funding models than serving ads, and I, for one, like to (sometimes) support these. I'd hate to see them land up in a blocklist I…
This. The internet desperately needs to progress beyond an advertisement driven business model. Disallowing these scripts seems a little heavy handed. Perhaps the addition of a "requestComputeResources" method to the browser's api would give a way to throttle them instead of outright banning them.
For one thing it's probably not a good idea on battery-powered devices, so it's only useful for monetizing desktop browsing. It also means that the money you make out of it depends on the average power your "customer" has available to mine.
Beyond that since mining is a zero-sum game it means that the more people opt for this model, the less money they individually make. Maybe today you make on average 0.001cent per minute and per user and a year from now you make a tenth of that. You have absolutely zero control on it since it's merely a factor of the total hashrate and the cryptocurrency's value.
I have a hard time imagining how this could become mainstream. Tipping using cryptocurrency microtransaction seems more promising but even that is far from a solved problem. I'd rather directly send $.002 to the website rather than waste $.01 of electricity for the website to make $.001 out of it.
I am concerned about the approach however; a simple blacklist of fingerprinting scripts may be insufficient, in that non-blocked scripts can still access the data that is used to accomplish fingerprinting.
Personally, I would like to see more security around the data that is used for fingerprinting, such as user agent, screen size, window size, loaded plugins, and so on. If this type of information was either protected with permissions, or if bogus values were provided to non-user-whitelisted sites, then it would be far harder to fingerprint users, as there would be less identifiable information to go off of.
A less aggressive approach might be to have some kind of notification to the user if a website is accessing many API calls that are commonly associated with fingerprinting. Maybe a site that just wants to know window size is fine, since it might want to render something or select a certain layout, but if a site wants to know a wide variety of different information all at once, that would be a red flag that could be signaled to the user in some way.
Seems like they're just using a blacklist? Those seem to be able to be gamed pretty trivially.
Buying a new domain to bypass the list is pretty easy but adding one line in the blocklist is even easier (and easily crowdsourced).