30 ms·

I have used the previous version several times over the years across computers, operating systems and browsers. My worry was always about browser fingerprinting

I have used the previous version several times over the years across computers, operating systems and browsers. My worry was always about browser fingerprinting, which meant that using a popular configuration like Windows XP/7 with IE 6/7/8 would help "hide in the crowds and not stand out" better than other choices would. Even with this new version of Panopticlick and its associated help pages, it's disturbing to know that browser fingerprinting cannot be completely defeated. In the help page, the recommended limited effect approaches to handle browser fingerprinting are: 1. Use Tor - this is probably useless for most people due to the low speed of browsing (I know everyone has to pitch in to share bandwidth with others, but this is not an easy compromise at all). 2. Use Privacy Badger - I do use it with Firefox and Chrome, but it's not available for other browsers, which is not ideal for me. 3. Use NoScript - I tried this a long time ago and found that it crippled almost every site I regularly visited. I realized this was too heavy and cumbersome a solution. I can easily recommend uBlock Origin and Privacy Badger to other non-technical people, knowing that those wouldn't usually cause issues with websites. But it's not possible to recommend NoScript to non-technical users who just want to get things done. My earlier conclusion on browser fingerprinting was that ironically, it usually traps the more technical and privacy oriented people who may use more of the unpopular solutions in order to derive privacy and security related benefits. I wish there were easier ways to defeat browser fingerprinting, because we may not even know which sites are using it to track us (unlike say, cookies or super cookies, where the evidence is usually visible).

jandrese 11y ago
I use NoScript daily and while it requires a bit of interaction the first time you visit a website it really isn't that hard to use. Just allowing the TLD and any obvious CDNs covers about 95% of all websites. If you do run across some website that is just horribly busted, there's always the "allow all temporarily" button, but I find it is extremely rare that I have to resort to that. And the times that I have I usually discover that it is in fact the website that is broken, not my browser settings.
- myztic 11y ago
  We are talking about the general public, yes it is hard to use and incredibly cumbersome for those people. Imagine explaining your grandma how to use it, we are not talking about people browsing HN ;)
- newscracker 11y ago
  > Just allowing the TLD and any obvious CDNs covers about 95% of all websites. I know about the options NoScript provides, but I see this statement itself as part of the problem. If we just whitelist sites that we use and see (to have them work), we're not really stopping tracking, are we? We're just guarding against unknown sites. Most people visit perhaps 10 major sites on a regular basis everyday, and all the popular ones that people would whitelist use trackers. I'm not denying the benefit of being protected from unknown, obscure and malicious sites that we may land in once in a while and things like XSS protection, but that alone is not enough in this context. What we need is either a trusted block-list for NoScript that's updated periodically, similar to block-lists that exist for ad-blockers, or some other mechanism that can curb the tracking potential of scripts (I don't know the answer for the latter).
  - jandrese 11y ago
    You obviously don't whitelist google-analytics.com or facebook.net.
myztic 11y ago
It's very easy to change your user agent / every type of header, you can send any string you want to a server, even an empty one. There are extensions/add-ons to very easily change your user-agent on the fly, on Firefox I can recommend https://addons.mozilla.org/en-US/firefox/addon/user-agent-switcher/ https://addons.mozilla.org/en-US/firefox/addon/user-agent-sw... There should be an extension to randomize headers / and strings in a certain interval by itself, or maybe just based on a number of possibilities provided by the user. So it would never (well at least not often) brake anything, because it would never say "I don't have flash, I don't have java" but it would always report different versions and mix it up. Sounds quite possible, any Firefox Add-On Developer reading this? ;)
jandrese 11y ago
Tor is useless at preventing this kind of browser based tracking unless you're using a canned distribution like Tails.

jandrese 11y ago

I use NoScript daily and while it requires a bit of interaction the first time you visit a website it really isn't that hard to use. Just allowing the TLD and any obvious CDNs covers about 95% of all websites. If you do run across some website that is just horribly busted, there's always the "allow all temporarily" button, but I find it is extremely rare that I have to resort to that. And the times that I have I usually discover that it is in fact the website that is broken, not my browser settings.

myztic 11y ago
We are talking about the general public, yes it is hard to use and incredibly cumbersome for those people. Imagine explaining your grandma how to use it, we are not talking about people browsing HN ;)
newscracker 11y ago
> Just allowing the TLD and any obvious CDNs covers about 95% of all websites. I know about the options NoScript provides, but I see this statement itself as part of the problem. If we just whitelist sites that we use and see (to have them work), we're not really stopping tracking, are we? We're just guarding against unknown sites. Most people visit perhaps 10 major sites on a regular basis everyday, and all the popular ones that people would whitelist use trackers. I'm not denying the benefit of being protected from unknown, obscure and malicious sites that we may land in once in a while and things like XSS protection, but that alone is not enough in this context. What we need is either a trusted block-list for NoScript that's updated periodically, similar to block-lists that exist for ad-blockers, or some other mechanism that can curb the tracking potential of scripts (I don't know the answer for the latter).
- jandrese 11y ago
  You obviously don't whitelist google-analytics.com or facebook.net.

myztic 11y ago

It's very easy to change your user agent / every type of header, you can send any string you want to a server, even an empty one. There are extensions/add-ons to very easily change your user-agent on the fly, on Firefox I can recommend https://addons.mozilla.org/en-US/firefox/addon/user-agent-switcher/ https://addons.mozilla.org/en-US/firefox/addon/user-agent-sw... There should be an extension to randomize headers / and strings in a certain interval by itself, or maybe just based on a number of possibilities provided by the user. So it would never (well at least not often) brake anything, because it would never say "I don't have flash, I don't have java" but it would always report different versions and mix it up. Sounds quite possible, any Firefox Add-On Developer reading this? ;)

jandrese 11y ago

Tor is useless at preventing this kind of browser based tracking unless you're using a canned distribution like Tails.