71–80 of 246 posts
Earlier quoted context omitted.
Mozilla devs seem to take this into account whenever adding new JS features, at least on their mailing lists. For example, this discussion of a new API for gamepads immediately turned to a discussion of its fingerprinting risks and how they can be mitigated: https://groups.google.com/d/msg/mozilla.dev.platform/75GrJSP...
The www has an API for gamepads. I need a moment.
I agree with the general sentiment in the comments that this is good -- fingerprinting in particular is something browser vendors should be trying to combat. I am concerned about the approach however; a simple blacklist of fingerprinting scripts may be insufficient, in that non-blocked scripts can still access the data that is used to accomplish fingerprinting. Personally, I would like to see more security around the…
> like to see more security around the data that is used for fingerprinting, such as user agent I think this is already available, just not enabled by default. In about:config one need to set privacy.resistFingerprinting to true. (be aware however that this setting causes problems with google captcha - the number of challenges that you will need to solve will drastically increase)
0: https://developer.mozilla.org/en-US/docs/Web/API/Event/timeS...
Earlier quoted context omitted.
One would think that the past 25 years of experience with SMTP RBLs would teach people that using predefined DNS based blacklists (or IP space range blacklists) is indeed a game of whack-a-mole.
The issue with emails is worse because spam is unsolicited and can be sent from anywhere. That means that basically anything can be used to send spam, from botnets to miss-configured SMTP servers. On the other hand your fingerprinting/mining JS has to be served by a website that people willingly browse. That's a much higher barrier of entry and means that you can't just change your server's domain every hour lest you…
https://www.welivesecurity.com/2017/01/12/fast-flux-networks...
Earlier quoted context omitted.
Mozilla devs seem to take this into account whenever adding new JS features, at least on their mailing lists. For example, this discussion of a new API for gamepads immediately turned to a discussion of its fingerprinting risks and how they can be mitigated: https://groups.google.com/d/msg/mozilla.dev.platform/75GrJSP...
The www has an API for gamepads. I need a moment.
> In the coming months, we will start testing these protections with small groups of users and will continue to work with Disconnect to improve and expand the set of domains blocked by Firefox. We plan to enable these protections by default for all Firefox users in a future release. While lots of people here already have uMatrix or other blockers running, blocking fingerprinting and cryptomining domains by default wo…
>(Disclosure: I work on ads at Google.) Is that relevant?
I agree with the general sentiment in the comments that this is good -- fingerprinting in particular is something browser vendors should be trying to combat. I am concerned about the approach however; a simple blacklist of fingerprinting scripts may be insufficient, in that non-blocked scripts can still access the data that is used to accomplish fingerprinting. Personally, I would like to see more security around the…
> like to see more security around the data that is used for fingerprinting, such as user agent I think this is already available, just not enabled by default. In about:config one need to set privacy.resistFingerprinting to true. (be aware however that this setting causes problems with google captcha - the number of challenges that you will need to solve will drastically increase)
I appreciate it when my browser takes the position that it acts as the user's agent, and not the advertising network's agent.
Earlier quoted context omitted.
Since you work on ads, may I ask why you support this? Won't this make most of your features ineffective?
In principle advertising is fine. Telling people that a product exists is useful. "Do you need a hat shaped exactly like a golf ball? At Dave's Golf Ball Hats we sell six sizes!". Targeting this advert to most likely be seen by people who actually had been thinking of buying a hat shaped like sporting equipment is still a good idea too. But an advert that steals from you, or harms you is neither of those things. Goog…
Not if that targeting is done using data gathered about me without my consent -- as it almost universally is.
Targeting based on context (what sort of website the ad is on, for instance), is fine.
Earlier quoted context omitted.
> like to see more security around the data that is used for fingerprinting, such as user agent I think this is already available, just not enabled by default. In about:config one need to set privacy.resistFingerprinting to true. (be aware however that this setting causes problems with google captcha - the number of challenges that you will need to solve will drastically increase)
> this setting causes problems with google captcha - the number of challenges that you will need to solve will drastically increase No kidding. I'm talking about ~30-40 clicks (1 click per task in the captcha grid)
Earlier quoted context omitted.
The www has an API for gamepads. I need a moment.
You remember how HTML5 was sold as the replacement for Flash; as a platform perfect for browser games? This is the logical extension of that.