Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Downgrade User Agent Client Hints to 'harmful'

github.com

Post reply on HN
Print view View original

81–90 of 116 posts

Re: Downgrade User Agent Client Hints to 'harmful'

#81

Post by shadowgovt »

notriddle wrote: post #71
dathinab wrote: post #50

Earlier quoted context omitted.

And the law also only requires you to ask the user if they want to be spied on. It's not tightly bound to cookies in any way. And vastly misunderstood. There was a predecessor which was somehow tied to cookies but even then you didn't need to ask for setting purely functional cookies. But somehow everyone ended up interpreting it as such. Maybe because most sites don't have many purely functional cookies or fingerpri…

I’m convinced that a lot of the really annoying cookie prompts are the result of two things: * paranoia, from small websites that are understandably worried about massive fines that could actually put their one-man-show into the poor house * retaliation, from large websites that intentionally want to turn public sentiment against privacy laws

We were naive if we ever thought the end result would be otherwise.

Re: Downgrade User Agent Client Hints to 'harmful'

#82

Post by 1vuio0pswjnm7 »

marcosdumay wrote: post #80
1vuio0pswjnm7 wrote: post #66

Earlier quoted context omitted.

"I suppose the client could maintain a list of sites that don't need SNI." That list would be much larger than the list of sites that do require SNI. Generally, I can determine whether SNI is required by IP address, i.e., whether it belongs to a CDN that requires SNI. Popular CDNs like AWS publish lists of their public IPs. I use TLSv1.3 plus ESNI with Cloudflare but they are currently the only CDN that supports it.…

I don't think you can ever determine that a site doesn't need SNI using HTTP alone. All you can have is that it doesn't or you don't know.

I do not use "HTTP alone", I use DNS, more specifically IP address. I generate lists. The lists are largely based on the hosting provider and created automatically, but I also edit them manually when necessary, which is the exception not the rule. Most sites requiring SNI that are submitted to HN all use the same CDNs: AWS and Cloudflare. The SNI list is dominated by sites hosted on AWS. The ESNI list is all sites hosted on Cloudlfare.

When I first started developing this workaround I thought I would be manually editing the SNI list constantly for "all those random sites that use SNI". This has not been the case. For the sites submitted to HN, use of SNI is mostly a CDN phenomena.

The important point here is that I do not send SNI by default. The default is privacy-by-design: no SNI. If I encounter a site that fails because it needs SNI, I add it to the list. The failure is caught by the proxy (the proxy verifies certificates, I do not rely on the browser), the SSL error is visible in the logs, and the error page the browser receives is a custom one I created myself that tells me where in the configuration the failure occured. I can test whether a site requires SNI very quickly.

Popular browsers cannot do this, we know that. If they could, I would not be coming up with workarounds. They routinely send more data than is needed, including SNI. That is the point of the original comment.

Re: Downgrade User Agent Client Hints to 'harmful'

#83

Post by ocdtrekkie »

jefftk wrote: post #77
ocdtrekkie wrote: post #73

Earlier quoted context omitted.

I would highlight that both Microsoft and Apple (to a lesser extent, mind you) also operate their own ad platforms. Don't get me wrong, I'd be happy to see a blanket ban on web browsers and ad companies being related, and have it apply to all three. I'm an equally opportunity antitrust breakup advocate. ;) Regarding risk-based authentication, I see a lot of value in it, but I think the cost may be too high, and often…

> I would highlight that both Microsoft and Apple (to a lesser extent, mind you) also operate their own ad platforms. Do you mean that before when you said "every single browser developer that doesn't own an Ads and Analytics suite" you meant to exclude nearly all the browser vendors? Google, sure, but also Apple, and Microsoft. And then Opera, UC Browser, Brave, DDG, ... I think maybe everyone but Mozilla and Vivald…

Perhaps it would be best to say companies support privacy in web browsers inversely correlated with their dependence on ad revenue. So Google is worse than Microsoft, which is worse than Apple, etc. I think it'd be fair to assume if you gave all three a choice to keep their ad products or their browser, Google would keep ads, and both Microsoft and Apple would keep their browsers, because of their relative value to their core business.

Re: Downgrade User Agent Client Hints to 'harmful'

#84

Post by billyhoffman »

1vuio0pswjnm7 wrote: post #66
billyhoffman wrote: post #63

Earlier quoted context omitted.

How would this work? SNI is sent by the client in the initial part of the TLS handshake. If you don't send it, the server sends the wrong/bad cert. The client could retry the handshake using SNI to get the correct cert but: - This adds an extra RTT, on the critical path of getting the base HTML, hurting performance. - A MITM could send back an invalid cert, causing the browser to retry with SNI, leaking it anyway (si…

"I suppose the client could maintain a list of sites that don't need SNI." That list would be much larger than the list of sites that do require SNI. Generally, I can determine whether SNI is required by IP address, i.e., whether it belongs to a CDN that requires SNI. Popular CDNs like AWS publish lists of their public IPs. I use TLSv1.3 plus ESNI with Cloudflare but they are currently the only CDN that supports it.…

Ahhh. I see, you are default-no-SNI, and whitelist those that do.

If your threat model is such that you absolutely positively cannot leak the signal of what domain names you want to make HTTPS connections to, then I suppose this is an approach that can be used. But if you believe that is your threat model, I imagine you have bigger issues to protect against. As you say, it's unlikely to work for others.

Re: Downgrade User Agent Client Hints to 'harmful'

#85

Post by ajsnigrutin »

ipaddr wrote: post #74
ajsnigrutin wrote: post #67

Earlier quoted context omitted.

But browsers could disable third party cookies, and autodelete first party cookies on page/tab close by default. There would be a "keep cookies for this site" button somewhere near the address bar, and at each login, the browser would also ask you if you want to save your password and/or save cookies for that domain. 99% of websites don't require persistant storage, and those who do, 99% of them are sites you're logg…

That's private browsing currently. Why not use a private window?

Because i might want cookies on this page, gmail and reddit, and nowhere else. This would mean me starting a private window, googling something, finding a link on reddit, opening it, either logging in again, or copying the link to a non-private window, commenting, closing that window, and back to search results.

Re: Downgrade User Agent Client Hints to 'harmful'

#86

Post by fomine3 »

wolverine876 wrote: post #30
m45t3r wrote: post #26

Earlier quoted context omitted.

Unless a big vendor (coff Microsoft coff) decides to enable it by default, them it becomes meaningless.

Yes, but it's not hard to ignore DNT on Microsoft user agents, which are a small part of the population.

which were a large part of the population at the time.

Re: Downgrade User Agent Client Hints to 'harmful'

#87

Post by admax88q »

ocdtrekkie wrote: post #72
admax88q wrote: post #58

Earlier quoted context omitted.

Honestly though, if its enough content for mobile, its enough content for desktop as well. The "garbage" we don't want to serve mobile, is often also garbage for desktop, autoplay videos, too many tracking scripts, etc. If we force people to optimize their site for mobile and desktop then maybe we'll actually get good desktop sites.

Eh, navigation layout should definitely be different for mobile, and we shouldn't ship the desktop navigation to phone browsers, and I still think it's reasonable to offer phones smaller/more compressed image sizes and stuff by default. I agree tracking scripts and the like should be blocked and removed across the board. But I think there's probably a suitable amount of visible UI and content that should be shipped d…

I hear you, but I'd wager the size differences are actually pretty minor. Absolute worst case you have 2X the CSS and HTML but much will be redundant so it will probably compress well with gzip.

Re: Downgrade User Agent Client Hints to 'harmful'

#88

Post by joshuamorton »

csmpltn wrote: post #15

> "User Agents MUST return the empty string for model if mobileness is false. User Agents MUST return the empty string for model even if mobileness is true, except on platforms where the model is typically exposed." (quoted from https://wicg.github.io/ua-client-hints/#user-agent-model ) Honestly now - who drafts and approves these specs? Not only does it make no sense whatsoever to encode such information this way -…

Why/how does this waste bandwidth? These are opt-in, so they are only sent if requested.

I mean sure http being plaintext is silly but that's not down to the authors of this particular rfc.

Re: Downgrade User Agent Client Hints to 'harmful'

#89

Post by 1vuio0pswjnm7 »

billyhoffman wrote: post #84
1vuio0pswjnm7 wrote: post #66

Earlier quoted context omitted.

"I suppose the client could maintain a list of sites that don't need SNI." That list would be much larger than the list of sites that do require SNI. Generally, I can determine whether SNI is required by IP address, i.e., whether it belongs to a CDN that requires SNI. Popular CDNs like AWS publish lists of their public IPs. I use TLSv1.3 plus ESNI with Cloudflare but they are currently the only CDN that supports it.…

Ahhh. I see, you are default-no-SNI, and whitelist those that do. If your threat model is such that you absolutely positively cannot leak the signal of what domain names you want to make HTTPS connections to, then I suppose this is an approach that can be used. But if you believe that is your threat model, I imagine you have bigger issues to protect against. As you say, it's unlikely to work for others.

No "threat model" here, just a dissatisfaction with so-called "modern" browsers and TLS extensions that disproportionally benefit hosting companies over users (privacy in this case). Plus I genuinely prefer commandline TCP clients and text-only browser to read HTML for most web use. I like the speed, reliability and more uniform presentation I get across all web sites. I like text. Big browsers that do everything under the sun written by people working for "tech" companies funded by advertising are not interesting to me. In fact, I find them annoying.

Some folks write "browser extensions" to control graphical browsers to their liking. I generally do not use graphical javascript-enabled browsers; I prefer to use a different program, a proxy, to control the browser. It works with both graphical browsers and text-only ones.

Re: Downgrade User Agent Client Hints to 'harmful'

#90

Post by bzbarsky »

csmpltn wrote: post #15

> "User Agents MUST return the empty string for model if mobileness is false. User Agents MUST return the empty string for model even if mobileness is true, except on platforms where the model is typically exposed." (quoted from https://wicg.github.io/ua-client-hints/#user-agent-model ) Honestly now - who drafts and approves these specs? Not only does it make no sense whatsoever to encode such information this way -…

The bar for creating a wicg draft is _very_ low. Things in that space are not "specs" that are "approved" in any way.
Post reply on HN