4 ms·

I think I have a better solution. How about keeping HTML/JS and lose the bidirectional protocols used to track you. As a side project I am starting to work on

I think I have a better solution. How about keeping HTML/JS and lose the bidirectional protocols used to track you. As a side project I am starting to work on a non-HTTP browser (and non-websocket, non-webrtc, etc). The first "protocol" will be IPFS. Download all of the HTML/JS/images and store all the cookies/localStorage you want, you can't send the information back to any server. Heck, you can't even know you have a page view. Now to make it more powerful, I will offer a JS API to pages that let's them use the mutation features of IPFS, but it is strictly opt-in and the permissions are very narrow and clear to the user (think specific oauth scopes).

glassx 10y ago
> I think I have a better solution. How about keeping HTML/JS and lose the bidirectional protocols used to track you. Is it that common for trackers to have Websocket/WebRTC as a requirement? Pretty much any trackers I see in the wild is using regular Ajax calls. And if you're a tracking service, it's not exactly hard to fallback to Ajax if Websockets aren't available... EDIT: My mistake, I misread the first mention of HTTP as HTML.
- kodablah 10y ago
  I also consider HTTP a bidirectional protocol used to track you.
  - nitrogen 10y ago
    You can be tracked without bidirectional calls, without JS, even without images or cookies. See the Panopticlick.
    - kodablah 10y ago
      > You can be tracked without bidirectional calls No, you can be fingerprinted and what not, but being tracked requires you send the data somewhere.
      - nitrogen 10y ago
        You can be tracked from page to page using your fingerprint, optionally with server-side checking of referrers and URL parameters.
        kodablah 10y ago
        > You can be tracked from page to page using your fingerprint That's not really tracking per se any more than any local stateful data is. > optionally with server-side checking of referrers and URL parameters Again, no, this requires sending data to the server (in the URL or as HTTP headers in this case) which is exactly what I am saying would NOT happen in my project.
        nitrogen 10y ago
        Saying that fingerprinting is not tracking "per se" is like saying that a series of pictures taken at evenly spaced sub-second intervals is not a movie "per se". How do you request data from a server without making any contact with the server? The initial page request is sending data to the server. That is unavoidable. A web browser sends (or doesn't send) lots of HTTP headers all the time. The particular headers sent (User-Agent, Referer[sic], Accept, etc.) or not sent are additional data that can be used to fingerprint, and thus track you (not to mention your request IP address).
        kodablah 10y ago
        > How do you request data from a server without making any contact with the server? I specifically mentioned IPFS > The initial page request is sending data to the server. That is unavoidable. Wrong. I specifically mentioned IPFS and would introduce storj, sia, maidsafe, etc as deemed worthy. > A web browser sends (or doesn't send) lots of HTTP headers all the time. Not the one I'm talking about. HTTP isn't even in the picture. Please please read my post that mentions non-HTTP.
wfn 10y ago
I was thinking, IPFS + Gopher or a Gopher-like system. But lose the damn JS, use Lua or something if so desired, and lose the JS web compatibility requirement. Allow public key encryption and signing on a per-document basis.
anonbanker 10y ago
got a mailing list or something we can subscribe to in order to stay updated on your project? it's extremely important.
- kodablah 10y ago
  I did some early work[0] but the project hasn't started in earnest (a big issue w/ electron and web views in separate partitions was just fixed). I made a POC for maidsafe also [1] 0 - https://github.com/cretz/shrewd https://github.com/cretz/shrewd 1 - https://github.com/cretz/safe-poc-browser https://github.com/cretz/safe-poc-browser

glassx 10y ago

> I think I have a better solution. How about keeping HTML/JS and lose the bidirectional protocols used to track you. Is it that common for trackers to have Websocket/WebRTC as a requirement? Pretty much any trackers I see in the wild is using regular Ajax calls. And if you're a tracking service, it's not exactly hard to fallback to Ajax if Websockets aren't available... EDIT: My mistake, I misread the first mention of HTTP as HTML.

kodablah 10y ago
I also consider HTTP a bidirectional protocol used to track you.
- nitrogen 10y ago
  You can be tracked without bidirectional calls, without JS, even without images or cookies. See the Panopticlick.
  - kodablah 10y ago
    > You can be tracked without bidirectional calls No, you can be fingerprinted and what not, but being tracked requires you send the data somewhere.
    - nitrogen 10y ago
      You can be tracked from page to page using your fingerprint, optionally with server-side checking of referrers and URL parameters.
      - kodablah 10y ago
        > You can be tracked from page to page using your fingerprint That's not really tracking per se any more than any local stateful data is. > optionally with server-side checking of referrers and URL parameters Again, no, this requires sending data to the server (in the URL or as HTTP headers in this case) which is exactly what I am saying would NOT happen in my project.
        nitrogen 10y ago
        Saying that fingerprinting is not tracking "per se" is like saying that a series of pictures taken at evenly spaced sub-second intervals is not a movie "per se". How do you request data from a server without making any contact with the server? The initial page request is sending data to the server. That is unavoidable. A web browser sends (or doesn't send) lots of HTTP headers all the time. The particular headers sent (User-Agent, Referer[sic], Accept, etc.) or not sent are additional data that can be used to fingerprint, and thus track you (not to mention your request IP address).
        kodablah 10y ago
        > How do you request data from a server without making any contact with the server? I specifically mentioned IPFS > The initial page request is sending data to the server. That is unavoidable. Wrong. I specifically mentioned IPFS and would introduce storj, sia, maidsafe, etc as deemed worthy. > A web browser sends (or doesn't send) lots of HTTP headers all the time. Not the one I'm talking about. HTTP isn't even in the picture. Please please read my post that mentions non-HTTP.

wfn 10y ago

I was thinking, IPFS + Gopher or a Gopher-like system. But lose the damn JS, use Lua or something if so desired, and lose the JS web compatibility requirement. Allow public key encryption and signing on a per-document basis.

anonbanker 10y ago

got a mailing list or something we can subscribe to in order to stay updated on your project? it's extremely important.

kodablah 10y ago
I did some early work[0] but the project hasn't started in earnest (a big issue w/ electron and web views in separate partitions was just fixed). I made a POC for maidsafe also [1] 0 - https://github.com/cretz/shrewd https://github.com/cretz/shrewd 1 - https://github.com/cretz/safe-poc-browser https://github.com/cretz/safe-poc-browser