Live data from Hacker News

Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

blog.mozilla.org

91–100 of 246 posts

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#91
post #90

Earlier quoted context omitted.

Imagine how powerful a paid browser could become on this front. As people slowly become more privacy-aware this might be feasible.

You already can donate to Mozilla: https://donate.mozilla.org

I'd rather buy a browser as a company's primary product, not donate to Mozilla which makes a browser and does many other things, many of which I disagree with and would rather not fund.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#92
post #79

Earlier quoted context omitted.

> this setting causes problems with google captcha - the number of challenges that you will need to solve will drastically increase No kidding. I'm talking about ~30-40 clicks (1 click per task in the captcha grid)

Why can't they just allow the user to whitelist recaptcha?

The people who're trying to avoid being fingerprinted are probably thinking of Google when they decided to go down this path.

I'm willing to go through extensive captcha cycles if that's the cost of retaining some anonymity.

I installed uMatrix a while back to recover some anonymity and it worked at first, my Captcha load spiked significantly which was a great indication that I'd succeeded but it has dropped over time. I guess I'm gradually being fingerprinted again.

Google's captcha tests are my litmus paper test that what I'm doing is effective.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#93
post #37

Earlier quoted context omitted.

This. The internet desperately needs to progress beyond an advertisement driven business model. Disallowing these scripts seems a little heavy handed. Perhaps the addition of a "requestComputeResources" method to the browser's api would give a way to throttle them instead of outright banning them.

They make it optional. To be real, though, somewhere close to 0% (rounded to the third decimal place) of users would agree to grossly inefficient cryptomining in the browser. As a web funding model it is terrible and is almost always akin to malware. It certainly costs the user much more in electricity costs than it will ever benefit web publishers.

>They make it optional.

Mozilla? Optional protection? Don't trigger my memories.

They also made it optional to block unsigned extensions, which you could turn off if you wanted to tweak one to fix a bug because it wasn't being maintained fast enough.

Like, if you believed in the whole Open Source/tinkering philosophy, or something, which Mozilla may or may not care about.

Then, they started disallowing it in 2016.

And they turned off key remapping too.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#94
post #90

Earlier quoted context omitted.

You already can donate to Mozilla: https://donate.mozilla.org

I'd rather buy a browser as a company's primary product, not donate to Mozilla which makes a browser and does many other things, many of which I disagree with and would rather not fund.

I'm confused here. Seems to me that if you want these kind of features in a browser you want exactly what funds. Also, even if you paid for software with these features, it's likely a good portion of the money you pay will also go towards things you disagree with as well.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#95
post #79

Earlier quoted context omitted.

> this setting causes problems with google captcha - the number of challenges that you will need to solve will drastically increase No kidding. I'm talking about ~30-40 clicks (1 click per task in the captcha grid)

Why can't they just allow the user to whitelist recaptcha?

It would be more interesting, to me, to see Google support something like CloudFlare's Privacy Pass. https://support.cloudflare.com/hc/en-us/articles/11500199265... Though it seems unlikely they would want to?

(Though I don't know a lot about and would be interested to hear criticisms of it.)

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#96

Earlier quoted context omitted.

In principle advertising is fine. Telling people that a product exists is useful. "Do you need a hat shaped exactly like a golf ball? At Dave's Golf Ball Hats we sell six sizes!". Targeting this advert to most likely be seen by people who actually had been thinking of buying a hat shaped like sporting equipment is still a good idea too. But an advert that steals from you, or harms you is neither of those things. Goog…

Untargeted advertising is very often more egregious than merely telling people a product exists. Traditional pre-digital advertising runs the gamete from "Come to me and I'll fix your car" to "You are ugly and unpopular, but you can fix that by drinking our caramel colored sugar water." Advertising that tries to induce then exploit self esteem issues is a plague.

This little bit of misdirection Google and Facebook have propagated about how much better the advertising you get with tracking is the slimiest piece of bait-and-switch in history. Seeing people repeat it like it's fact is testament to just how insidious it is.

Targeted advertising is not designed to serve the viewer, it's designed to serve the advertiser. So advertisements you get are even sleazier than non-targeted advertising because they have by definition more information about the reader. So instead of generically exploiting people's self esteem, it exploits people's self esteem armed with much more information about the users.

Targeting and tracking is a plague and should be discouraged and blocked to oblivion.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#97
Right decision to make a step towards a user and protect their market. Preventing fingerprinting is interesting and non-trivial by itself. It's impossible to implement with just a plugin.

One day I found that navigator.getGamepads() did rat out my gamepad in Chrome while using private mode, I twitted Google, they didn't answer. Who knows what else is exposed.

I didn't know Firefox had privacy.resistFingerprinting.reduceTimerPrecision.jitter option, that's cool, but what about requestAnimationFrame()? Games wouldn't work without it. Not to mention spawning workers and passing values between them; delays while using things like shaders and gpu.js; decoding various formats like audio and measuring time, etc. Anyone tried to block videos on news sites? They are unstoppable, I can watch vids like with everything red in uBlock Origin.

I think Mozilla could make a contest for breaking their fingerprint resistance, before they are ready to merge their privacy features from Nightly to master branch.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#98
post #90

Earlier quoted context omitted.

You already can donate to Mozilla: https://donate.mozilla.org

I'd rather buy a browser as a company's primary product, not donate to Mozilla which makes a browser and does many other things, many of which I disagree with and would rather not fund.

Could you give some examples of things they do that you disagree with? I can't really think of any controversial non-firefox things they've done.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#99
post #60
post #6

Seems like they're just using a blacklist? Those seem to be able to be gamed pretty trivially.

That's effectively how ad-blockers function and they seem to work pretty well. Buying a new domain to bypass the list is pretty easy but adding one line in the blocklist is even easier (and easily crowdsourced).

This is a good insight.

Because Firefox is open-source, everything can be gamed. If they went for some more "intelligent" method, the kind that instinctively appeals to people like you and I and anyone posting on HN, the fingerprinters could see exactly what they were being tested on, and it would be faster to iterate their counter-measures (keep this particular activity just below threshold X on metric Y) than it would be to make new Firefox releases. And the counter-measures to these more smart kind of measures happen _in secret_, whereas counter-measures to the "bash the problem to death with simple rules" approach are public, are (if their fingerprinting is to have any point) widely distributed, and thus much more immediately picked up and remedied by the many wonderful people who work on the lists used by privacy tools like ad blockers.

While we all like a cool and innovative solution, sometimes bashing the problem to death with dumb rules really is the best approach :)

(edited for a clarification)

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#100

I appreciate it when my browser takes the position that it acts as the user's agent, and not the advertising network's agent.

This attitude from the Mozilla crew has convinced me to try switching from Chrome for a week. (I understand that these latest features aren't yet available in the normal releases)

I switched completely to Firefox on my work computer. Don't miss Chrome at all.
Post reply on HN