Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple adds a tracker blocker to desktop Safari

techcrunch.com

Post reply on HN
Print view View original

71–80 of 301 posts

Re: Apple adds a tracker blocker to desktop Safari

#71

Post by gsnedders »

derefr wrote: post #57
pmiller2 wrote: post #30

Earlier quoted context omitted.

I don't think that's even theoretically possible. How do you block JS font enumeration without crippling the browser font API?

Simple way would be tainting any JS/DOM data that interacts with the font metrics API (or one of a number of other similar APIs) and then not allowing tainted data to be used as parameters in network requests.

You don't even need the font metrics API. Draw a span containing the character "m", measure the width of the span using Element.clientWidth. Unless you taint (almost literally) the entire CSSOM, you can pull off similar things.

Re: Apple adds a tracker blocker to desktop Safari

#72

Post by alternativetoo »

tannhaeuser wrote: post #26

Thumbs up for Apple distinguishing themselves by their pro-privacy stance, as opposed to MS, who don't have anything to win by Win10's excessive "telemetry" IMHO.

Hmmm.

https://arstechnica.com/tech-policy/2017/03/isps-say-your-we...

> CTIA is the main lobbyist group representing mobile broadband providers such as AT&T, Verizon Wireless, T-Mobile USA, and Sprint.

It doesn't just represent them, Apple is also a member:

https://www.ctia.org/about/our-members

Re: Apple adds a tracker blocker to desktop Safari

#73

Post by tptacek »

wolf550e wrote: post #68
JumpCrisscross wrote: post #36

Earlier quoted context omitted.

What are the other two (for macOS)?

I guess password manager and U2F yubikey.

I'd combine those two, and then my #3 would probably be making sure that you can't easily click on things in emails that open documents in local applications, and my #4 would be some combination of FDE and encrypted DMGs for projects and sensitive files.

Re: Apple adds a tracker blocker to desktop Safari

#74

Post by tyingq »

tinus_hn wrote: post #51
tyingq wrote: post #27

The big question to me is whether it's enabled by default, and whether it blocks requests to Google Analytics. If so, that's an interesting shot across the bow.

You don't need to block Google Analytics to make it more private. You just need to make the user appear to a new user to every site. So Google may lose data because then they can't track you all over the web, but the websites don't because they still see you as one user.

Maybe I'm overly paranoid, but I assume Google does all sorts of fingerprinting (documented and not) via GA. Why else would it be free if it didn't provide a big upside for Google?

Re: Apple adds a tracker blocker to desktop Safari

#75

Post by moogleii »

M4v3R wrote: post #44
yladiz wrote: post #37

Earlier quoted context omitted.

Can you give specific examples why Chrome is significantly better than other browsers, including Firefox, Opera? Chrome is a non starter for me because of its resource usage and battery hunger. One specific area where Safari is better than Chrome is in private browsing mode. In Safari, each tab is completely separate, and the cookies aren't shared (as far as I can tell) whereas in Chrome, it's only separate as a whol…

Me too, I only use chrome for its built-in Flash support when a site requires it.

Even then, I use Safari. The single-use permission request is handy. I pretty much only use Chrome as a development tool.

Re: Apple adds a tracker blocker to desktop Safari

#76

Post by om2 »

tptacek wrote: post #46
cylo wrote: post #41

Earlier quoted context omitted.

I am curious to know why you say this considering Safari is just as sandboxed as Chrome?

No, it isn't.

Safari sandbox isn't identical to Chrome's but it's pretty effective. I don't think your statement is a fair one without qualification.

ETA: we'd appreciate info about specific info wrong with Safari's sandboxing. We are definitely looking to improve it.

Re: Apple adds a tracker blocker to desktop Safari

#78

Post by tyingq »

hoschicz wrote: post #56
tyingq wrote: post #27

The big question to me is whether it's enabled by default, and whether it blocks requests to Google Analytics. If so, that's an interesting shot across the bow.

Does Analytics do some tracking by default? Or only if you enable the advanced demographics options, which enable DoubleClick?

The fact that it's free for site owners suggests it has some benefit to Google, so I assume heavy fingerprinting and tracking.

Re: Apple adds a tracker blocker to desktop Safari

#79

Post by om2 »

dmix wrote: post #66
tptacek wrote: post #29

This is great, but unfortunately, until Apple ups its browser security game, Safari is a non-starter. On macOS, switching from any other browser to Chrome is in the top 3 things you can do to materially improve your security in ways that actually matter in the real world.

Do they even try to break Safari at those pwn2own events? Or is it just assumed to be an easy target/too niche/no money from Apple?

They do. Breaking out of the sandbox is not trivial though over time people have found ways to do it.

Re: Apple adds a tracker blocker to desktop Safari

#80

Post by tptacek »

dfischer wrote: post #64
tptacek wrote: post #29

This is great, but unfortunately, until Apple ups its browser security game, Safari is a non-starter. On macOS, switching from any other browser to Chrome is in the top 3 things you can do to materially improve your security in ways that actually matter in the real world.

How is Chrome more secure than Safari on macOS?

If you're interested in a detailed answer, read this:

https://medium.com/@justin.schuh/securing-browsers-through-i...

Then try to work back either Edge's or Chrome's approach to security to specific Safari features and design.

The Chrome security team is probably the most sophisticated software security team in the industry (lest you think I'm in the tank for Google, I'd say the iOS platform security team is a close 2nd --- and, to be clear: Safari is a different story on iOS).

Post reply on HN