Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

blog.mozilla.org

Post reply on HN
Print view View original

61–70 of 246 posts

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#61

Post by ocdtrekkie »

founderling wrote: post #26

In collaboration with Disconnect, we have compiled lists of domains that serve fingerprinting and cryptomining scripts. Now in the latest Firefox Nightly and Beta versions, we give users the option to block both kinds of scripts Isn't this something that content blockers like umatrix already excel at? Why put it into the core of Firefox? I would prefer to see Firefox giving more power to extensions. For example, it i…

Extensions are the primary source of malware I find on PCs, and they're fantastically cross-platform. I just degunked a MacBook Pro the other day that looked like the worst of Windows XP, all done via Chrome extensions shipped from the Chrome Web Store directly.

Firefox does a better job at vetting extensions, but the reality is extensions have incredibly deep access to sensitive data, and they bypass every other security measure on your PC. HTTPS? Pointless if you've got a list of extensions installed on your browser.

The EFF's Privacy Badger has been my sole extension for a while, but as Firefox Tracking Protection has expanded, I've found Privacy Badger catching less and less, since Tracking Protection blocks them first. I will probably retire my use of Privacy Badger pretty soon, because it's just becoming superfluous.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#62

Post by simias »

walrus01 wrote: post #45
empath75 wrote: post #6

Seems like they're just using a blacklist? Those seem to be able to be gamed pretty trivially.

One would think that the past 25 years of experience with SMTP RBLs would teach people that using predefined DNS based blacklists (or IP space range blacklists) is indeed a game of whack-a-mole.

The issue with emails is worse because spam is unsolicited and can be sent from anywhere. That means that basically anything can be used to send spam, from botnets to miss-configured SMTP servers.

On the other hand your fingerprinting/mining JS has to be served by a website that people willingly browse. That's a much higher barrier of entry and means that you can't just change your server's domain every hour lest you manage to convince your partner websites to update their code as frequently (which in turn might end up blacklisting them instead).

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#63

Post by ceejayoz »

2_listerine_pls wrote: post #11

I am not trying to diminishing this post, just want to point out that a great way to increase adoption would be to make a better and simpler-looking UI. A great deal of users prefer Chrome for this reason.

> This is great but the average user doesn't even know about fingerprinting.

So? They don't understand password hashing, either. Doesn't mean it shouldn't be implemented.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#64

Post by oftenwrong »

jefftk wrote: post #24

> In the coming months, we will start testing these protections with small groups of users and will continue to work with Disconnect to improve and expand the set of domains blocked by Firefox. We plan to enable these protections by default for all Firefox users in a future release. While lots of people here already have uMatrix or other blockers running, blocking fingerprinting and cryptomining domains by default wo…

>(Disclosure: I work on ads at Google.)

Is that relevant?

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#65

Post by bloopernova »

GeekyBear wrote: post #12

I appreciate it when my browser takes the position that it acts as the user's agent, and not the advertising network's agent.

This attitude from the Mozilla crew has convinced me to try switching from Chrome for a week. (I understand that these latest features aren't yet available in the normal releases)

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#66

Post by tialaramex »

wurst_case wrote: post #47
jefftk wrote: post #24

> In the coming months, we will start testing these protections with small groups of users and will continue to work with Disconnect to improve and expand the set of domains blocked by Firefox. We plan to enable these protections by default for all Firefox users in a future release. While lots of people here already have uMatrix or other blockers running, blocking fingerprinting and cryptomining domains by default wo…

Since you work on ads, may I ask why you support this? Won't this make most of your features ineffective?

In principle advertising is fine. Telling people that a product exists is useful. "Do you need a hat shaped exactly like a golf ball? At Dave's Golf Ball Hats we sell six sizes!". Targeting this advert to most likely be seen by people who actually had been thinking of buying a hat shaped like sporting equipment is still a good idea too.

But an advert that steals from you, or harms you is neither of those things. Google Ads doesn't need those to be profitable. It would suit them if those went away.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#67

Post by eitland »

mrspeaker wrote: post #42
mikro2nd wrote: post #31

I don't much like the notion of farming out my "cryptomining blocker" to some unknown-to-me third party. There are a (small) number of sites that do cryptomining after asking for an opt-in permission (e.g. bit.tube). It seems to me that this is an interesting exploration of new, alternate funding models than serving ads, and I, for one, like to (sometimes) support these. I'd hate to see them land up in a blocklist I…

I agree it sounds harsh, but I think for NOW it's the correct choice. Like any browser API that can be abused, the small number of valid sites are so overwhelmingly dwarfed by the dodgy ones. When I first heard about the "notifications" API I thought it was a great idea - so many valid use case! Now I want it to burn in a fire. Something with so few use cases as cryptomining should not be something that users blindly…

Could we make Javascript optional as well while we're at it?

"This site tries to run Javascript. Normal news sites shouldn't need this.

[Allow this session] [Allow 5 seconds] [Deny]"

I'd be particularily interested in the second option since it would allow us to use sites that depend on JS for content while they roll back the craziness that is depending on scripting to show static content.

While I'm at it:

I want badges!

- Certified Javascript free page (Platinum)

- Certified progressive site, no dependence on Javascript, no long running background scripts (Gold)

- etc

Obviously I'm exaggerating the implementations here but I'm serious about the idea.

(And yes, I earn good money on frontend work, I just think it often makes solutions worse.)

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#68

Post by jacekm »

charlesdaniels wrote: post #59

I agree with the general sentiment in the comments that this is good -- fingerprinting in particular is something browser vendors should be trying to combat. I am concerned about the approach however; a simple blacklist of fingerprinting scripts may be insufficient, in that non-blocked scripts can still access the data that is used to accomplish fingerprinting. Personally, I would like to see more security around the…

> like to see more security around the data that is used for fingerprinting, such as user agent

I think this is already available, just not enabled by default. In about:config one need to set privacy.resistFingerprinting to true. (be aware however that this setting causes problems with google captcha - the number of challenges that you will need to solve will drastically increase)

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#69

Post by 4mitkumar »

jacekm wrote: post #68
charlesdaniels wrote: post #59

I agree with the general sentiment in the comments that this is good -- fingerprinting in particular is something browser vendors should be trying to combat. I am concerned about the approach however; a simple blacklist of fingerprinting scripts may be insufficient, in that non-blocked scripts can still access the data that is used to accomplish fingerprinting. Personally, I would like to see more security around the…

> like to see more security around the data that is used for fingerprinting, such as user agent I think this is already available, just not enabled by default. In about:config one need to set privacy.resistFingerprinting to true. (be aware however that this setting causes problems with google captcha - the number of challenges that you will need to solve will drastically increase)

> this setting causes problems with google captcha - the number of challenges that you will need to solve will drastically increase

No kidding. I'm talking about ~30-40 clicks (1 click per task in the captcha grid)

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#70

Post by codezero »

charlesdaniels wrote: post #59

I agree with the general sentiment in the comments that this is good -- fingerprinting in particular is something browser vendors should be trying to combat. I am concerned about the approach however; a simple blacklist of fingerprinting scripts may be insufficient, in that non-blocked scripts can still access the data that is used to accomplish fingerprinting. Personally, I would like to see more security around the…

I'm also concerned with the general blacklists that are showing up. Some of the analytics companies in the list they are using from github don't use any particular fingerprinting technologies outside of setting a cookie. Given that there are a wide array of more aggressive and seemingly more malicious ways to fingerprint, bundling up cookie usage with that seems like a recipe for throwing the baby out with the bathwater. This is happening throughout the browser world right now though. There's no way for a "good" analytics company that sells a service to a website owner, with no intent to share, sell, or aggregate that data with third parties to differentiate itself from a malicious ad network that is intent on cross-device fingerprinting, persisting your identity, and knowing who you are everywhere you go on the web.

Until there is some kind of official agreed upon terms/privacy policy that can be adhered to/audited, this will keep happening. It will lead the already advanced bad actors to further their game of whack-a-mole, and push the "good" companies to do more and more questionable things to avoid going out of business as moves like this cripple them.

To be clear, I'm not saying that the analytics industry hasn't been complicit in its own punishment, it's just come to a head in a way that I feel warrants more cooperative action than blacklists based on... what criteria?

Post reply on HN