4 ms·

This website wants to know your screen resolution. [allow] [deny] This website wants to know the list of fonts installed on your system [allow] [deny] This we

• blowski 10y ago
  What about being able to say "Block everything" or "Allow everything", and allow the user to default to one or the other. I would find it weird if a random blog or ecommerce website wanted to know my battery level or device temperature, but frequently I can only block them finding out by blocking JavaScript entirely, and that often means the site doesn't work at all. So I'm caught between giving them access to all sorts of stuff which they can use to identify for me (and I have no idea whether they're doing that or not), or not using the site at all. It would be nice to be able to say "let the site execute JavaScript, but don't give access to my machine or OS data".
• wyldfire 10y ago
  Right, and I can see times when I'd really prefer this behavior. Especially in incognito mode. But let's say at worst case we could categorize those or allow a settings page where I could switch these to opt-in-by-hostname/opt-out-by-hostname.
  • OMGWTF 10y ago
    Try using the uMatrix browser plugin for fine grained control of what external scripts/frames/etc a website may request. I'm using it (along with uBlock Origin, EFF Privacy Badger and custom Tampermonkey scripts), and while I like the sense of control, I also think it's obvious that fine grained control for such details or further details like battery status is not what most users want or even could handle. Sometimes it becomes really annoying and I give up on figuring out what minimal set of features a site needs, and I open it in an incognito tab where only uBlock Origin is active.
    • TeMPOraL 10y ago
      I run uMatrix too and I agree it gets annoying at times (and it gives you first-hand insight into how rotten the web industry is). That said, pretty much all the stuff from your comment upthread are things 99% of websites have no business accessing. So an uMatrix-like (default-deny) control for permissions should work well IMO, with only occasional cases when you need to whitelist something. I'm also thinking about another kind of plugin - one that simply monitors access to browser API calls required to get information like resolution, mouse pointer position, battery level, etc. and that would display you only the "spying level" of a site as an icon. Like the padlock icon, changing colors from green to yellow to red or something, and that would expand when clicked to show something like this: Spying level: MODERATE. This website has accessed following information about your system: - screen resolution - 256 requests - mouse pointer position - 8192 requests - location - 42 requests - battery level - 16 requests [CLICK] to send an e-mail to webmaster (webmaster@example.com) asking for information about how they're using your data. I'm not sure if current plugin infrastructure has enough power to hook JS APIs like that though.
• TeMPOraL 10y ago
  None of those things are what a typical website has any business accessing. Even the screen resolution for responsive layouts could (should) presumably be handled by correct application of CSS.
• Jordrok 10y ago
  You're exactly right that this would be incredibly annoying, but I think that should be the point. 99% of sites have no business accessing a lot of that stuff and popping up warnings every time they try to would make it a whole lot more obvious when a site is taking advantage of your personal data. Popups like this act kind of like side effect disclaimers in pharmaceutical advertisements. The ad tries to gloss over them as quickly as possible because they're confusing and scary to the potential customers - for good reason! It's annoying to have to hear that list of crazy side effects in every commercial, but it serves a purpose and it would be a mistake to remove it in the name of "convenience".
  • detal 10y ago
    As a side note, I've often noticed that the disclaimers in the pharmaceutical advertisements state the side effects in a slow, calm voice while the actor calmly walks though an abstract world which functions as a metaphor for living with the disease in question. In the end, the effect is that the listener stops paying attention to the words being said. The speed reading of the disclaimer is especially prevalent other types of advertisements though.
  • OMGWTF 10y ago
    > 99% of sites have no business accessing a lot of that stuff and popping up warnings every time they try to would make it a whole lot more obvious when a site is taking advantage of your personal data. I agree, sites should not have access to that data. I would prefer if those features would be removed again instead of introducing more popups.
• jasonkostempski 10y ago
  This would cause site designers to consider if they really need the access (they don't). Problem is, as soon as one browser stops asking, the idiots would flock to it and site designers will stop supporting the good browsers.