Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Downgrade User Agent Client Hints to 'harmful'

github.com

Post reply on HN
Print view View original

71–80 of 116 posts

Re: Downgrade User Agent Client Hints to 'harmful'

#71

Post by notriddle »

dathinab wrote: post #50
notriddle wrote: post #25

Earlier quoted context omitted.

Having the browser explicitly prompt for cookies is neither necessary nor sufficient to do what strong, consistently-enforced privacy laws can do, because the browser can't tell a tracking cookie (which needs a prompt) apart from a settings cookie (which does not).

And the law also only requires you to ask the user if they want to be spied on. It's not tightly bound to cookies in any way. And vastly misunderstood. There was a predecessor which was somehow tied to cookies but even then you didn't need to ask for setting purely functional cookies. But somehow everyone ended up interpreting it as such. Maybe because most sites don't have many purely functional cookies or fingerpri…

I’m convinced that a lot of the really annoying cookie prompts are the result of two things:

* paranoia, from small websites that are understandably worried about massive fines that could actually put their one-man-show into the poor house

* retaliation, from large websites that intentionally want to turn public sentiment against privacy laws

Re: Downgrade User Agent Client Hints to 'harmful'

#72

Post by ocdtrekkie »

admax88q wrote: post #58
ocdtrekkie wrote: post #45

Earlier quoted context omitted.

I get that. I do think by and large, the user's agent (the browser) should be making display and format decisions based on itself, rather than the server serving different content. Though I think the exception is mobile, where we probably shouldn't serve the client endless garbage it doesn't need. I mostly think the replacement for user agent should be a boolean of mobile or not mobile. And everything else should be…

Honestly though, if its enough content for mobile, its enough content for desktop as well. The "garbage" we don't want to serve mobile, is often also garbage for desktop, autoplay videos, too many tracking scripts, etc. If we force people to optimize their site for mobile and desktop then maybe we'll actually get good desktop sites.

Eh, navigation layout should definitely be different for mobile, and we shouldn't ship the desktop navigation to phone browsers, and I still think it's reasonable to offer phones smaller/more compressed image sizes and stuff by default.

I agree tracking scripts and the like should be blocked and removed across the board. But I think there's probably a suitable amount of visible UI and content that should be shipped differently or less to phones, because of how they're interacted with.

Re: Downgrade User Agent Client Hints to 'harmful'

#73

Post by ocdtrekkie »

jefftk wrote: post #54
ocdtrekkie wrote: post #44

Earlier quoted context omitted.

It's a fundamental disagreement on the very idea: Google's position is that it's okay for a website to know X amount of data about a user, you know, as long as it doesn't, in total, cross the creepy line. Everyone else's position is that if the data isn't required to operate, you don't need it. If we accept that the User Agent, as it is going to be frozen, is going to be served anyways to avoid breaking the legacy we…

> Google's position is ... Everyone else's position is... I don't think this categorization is accurate. For example, Apple built https://webkit.org/blog/8943/privacy-preserving-ad-click-att... > if the data isn't required to operate, you don't need it This is simple, but it's also wrong. Some counterexamples: * Learning from implicit feedback: dictation software can operate without learning what corrections people m…

I would highlight that both Microsoft and Apple (to a lesser extent, mind you) also operate their own ad platforms. Don't get me wrong, I'd be happy to see a blanket ban on web browsers and ad companies being related, and have it apply to all three. I'm an equally opportunity antitrust breakup advocate. ;)

Regarding risk-based authentication, I see a lot of value in it, but I think the cost may be too high, and often less robust methods it uses are a poor metric anyways. I gave an example elsewhere that someone might be using a wired PC and a wireless phone on two different carriers with vastly different user agents at the same time, for instance.

I think there's some merit in some very rough Geo-IP based RBA, but I'm not sure how many other strategies for that I find effective. The fact that Outlook and Gmail seem equally happy to let someone who's never signed in from outside the United States get logged into in Nigeria seems like low-lying fruit in the risk-based authentication space. ;)

Re: Downgrade User Agent Client Hints to 'harmful'

#74

Post by ipaddr »

ajsnigrutin wrote: post #67
notriddle wrote: post #25

Earlier quoted context omitted.

Having the browser explicitly prompt for cookies is neither necessary nor sufficient to do what strong, consistently-enforced privacy laws can do, because the browser can't tell a tracking cookie (which needs a prompt) apart from a settings cookie (which does not).

But browsers could disable third party cookies, and autodelete first party cookies on page/tab close by default. There would be a "keep cookies for this site" button somewhere near the address bar, and at each login, the browser would also ask you if you want to save your password and/or save cookies for that domain. 99% of websites don't require persistant storage, and those who do, 99% of them are sites you're logg…

That's private browsing currently. Why not use a private window?

Re: Downgrade User Agent Client Hints to 'harmful'

#75

Post by grishka »

hypertele-Xii wrote: post #47
grishka wrote: post #13

Earlier quoted context omitted.

Having to request it is a terrible idea to begin with. If I want to use different templates for mobile vs desktop, I need to know, on the backend, whether the device is a mobile device, and I need it on the very first request. Having to request these headers explicitly is an unnecessary complication that would slow down the first load. However it is nice that there's now a separate header that gives a yes or no answe…

Why would you need different templates for mobile/desktop? CSS is quite capable responding to any screen orientation.

Yes it is. Except you can't use the same markup for both because the input devices, and thus interaction paradigms, are so radically different. Mice are precise and capable of hovering over things, so it makes sense to pack everything densely and add various tooltips and popup menus. Touchscreens are imprecise and don't have anything resembling hovering, so UI elements must be large, with enough padding around them, and with menus appearing on click.

Re: Downgrade User Agent Client Hints to 'harmful'

#76

Post by marcosdumay »

ipaddr wrote: post #74
ajsnigrutin wrote: post #67

Earlier quoted context omitted.

But browsers could disable third party cookies, and autodelete first party cookies on page/tab close by default. There would be a "keep cookies for this site" button somewhere near the address bar, and at each login, the browser would also ask you if you want to save your password and/or save cookies for that domain. 99% of websites don't require persistant storage, and those who do, 99% of them are sites you're logg…

That's private browsing currently. Why not use a private window?

Because software is supposed to make our lives easier, not to insist we keep making the same choices again and again, and undo everything as soon as we make a mistake.

Re: Downgrade User Agent Client Hints to 'harmful'

#77

Post by jefftk »

ocdtrekkie wrote: post #73
jefftk wrote: post #54

Earlier quoted context omitted.

> Google's position is ... Everyone else's position is... I don't think this categorization is accurate. For example, Apple built https://webkit.org/blog/8943/privacy-preserving-ad-click-att... > if the data isn't required to operate, you don't need it This is simple, but it's also wrong. Some counterexamples: * Learning from implicit feedback: dictation software can operate without learning what corrections people m…

I would highlight that both Microsoft and Apple (to a lesser extent, mind you) also operate their own ad platforms. Don't get me wrong, I'd be happy to see a blanket ban on web browsers and ad companies being related, and have it apply to all three. I'm an equally opportunity antitrust breakup advocate. ;) Regarding risk-based authentication, I see a lot of value in it, but I think the cost may be too high, and often…

> I would highlight that both Microsoft and Apple (to a lesser extent, mind you) also operate their own ad platforms.

Do you mean that before when you said "every single browser developer that doesn't own an Ads and Analytics suite" you meant to exclude nearly all the browser vendors? Google, sure, but also Apple, and Microsoft. And then Opera, UC Browser, Brave, DDG, ... I think maybe everyone but Mozilla and Vivaldi has an ads product?

Re: Downgrade User Agent Client Hints to 'harmful'

#78

Post by jefftk »

zenexer wrote: post #62
jefftk wrote: post #56

Earlier quoted context omitted.

There are really only two ways this can go: A. Browsers successfully reduce available entropy to where users cannot reliably be tracked across sites. B. Browsers fail at this, and widely available JavaScript libraries allow cross-site tracking. If it's possible to extract enough bits, they will be extracted. The thing is, if you can't get all the way to (A) then in removing bits you're just removing useful functional…

Why not both (A) and a regulatory solution? I see no reason to avoid the regulatory route.

Legislation prohibiting fingerprinting would be great!

(Though potentially a bit tricky to craft and enforce)

Re: Downgrade User Agent Client Hints to 'harmful'

#79

Post by barneygale »

jefftk wrote: post #54
ocdtrekkie wrote: post #44

Earlier quoted context omitted.

It's a fundamental disagreement on the very idea: Google's position is that it's okay for a website to know X amount of data about a user, you know, as long as it doesn't, in total, cross the creepy line. Everyone else's position is that if the data isn't required to operate, you don't need it. If we accept that the User Agent, as it is going to be frozen, is going to be served anyways to avoid breaking the legacy we…

> Google's position is ... Everyone else's position is... I don't think this categorization is accurate. For example, Apple built https://webkit.org/blog/8943/privacy-preserving-ad-click-att... > if the data isn't required to operate, you don't need it This is simple, but it's also wrong. Some counterexamples: * Learning from implicit feedback: dictation software can operate without learning what corrections people m…

> Learning from implicit feedback: dictation software can operate without learning what corrections people make, or a search engine can operate without learning what links people click on, but the overall quality will be lower. Each individual piece of information isn't required, but the feedback loop allows building a substantially better product.

That sounds cool. How do I opt into it?

Re: Downgrade User Agent Client Hints to 'harmful'

#80

Post by marcosdumay »

1vuio0pswjnm7 wrote: post #66
billyhoffman wrote: post #63

Earlier quoted context omitted.

How would this work? SNI is sent by the client in the initial part of the TLS handshake. If you don't send it, the server sends the wrong/bad cert. The client could retry the handshake using SNI to get the correct cert but: - This adds an extra RTT, on the critical path of getting the base HTML, hurting performance. - A MITM could send back an invalid cert, causing the browser to retry with SNI, leaking it anyway (si…

"I suppose the client could maintain a list of sites that don't need SNI." That list would be much larger than the list of sites that do require SNI. Generally, I can determine whether SNI is required by IP address, i.e., whether it belongs to a CDN that requires SNI. Popular CDNs like AWS publish lists of their public IPs. I use TLSv1.3 plus ESNI with Cloudflare but they are currently the only CDN that supports it.…

I don't think you can ever determine that a site doesn't need SNI using HTTP alone. All you can have is that it doesn't or you don't know.
Post reply on HN