4 ms·

Hidden prefs are hidden for a reason and can be a foot-gun. The warning when opening about:config is no exaggeration, and copying-and-pasting a bunch of hidden

by dao- 10y ago

Hidden prefs are hidden for a reason and can be a foot-gun. The warning when opening about:config is no exaggeration, and copying-and-pasting a bunch of hidden prefs from an untrusted source is not a good idea. For instance: > user_pref("network.cookie.cookieBehavior", 1); If I remember correctly, this may break some sites. > user_pref("dom.battery.enabled", false); Questionable value for privacy / fingerprinting. If you plug-in your computer or pull the plug (a pretty common scenario), the site trying to identify you will suddenly think you're a different users. > user_pref("general.buildID.override", "20100101"); Pointless since 20100101 is already the default used in the user agent string. Makes me think this list is severely outdated or the author doesn't know what he's doing. > user_pref("browser.newtabpage.enabled", false); Little impact on privacy (is this about the "somebody opens a new tab in my profile and sees what sites I frequently visit" scenario?), no impact on fingerprinting. The readme says "Impacts on user experience should be minimized, erring on the side of convenience." How does disabling the new tab page satisfy that?

marco1 10y ago
> The warning when opening about:config is no exaggeration If you feel uncomfortable in that section, feel free to avoid touching it. But if you know what you do, there are zero problems. Want to change your user agent? Do it there. No problems. The warning is for your average non-technical user, justifiably. Well, perhaps you need to read up on those a little bit again. > If I remember correctly, this may break some sites. Sure, everything may break some sites. But this is about blocking third party cookies, which blocks not a single site I know (Do you know a popular one?) while being one of the most effective measures against tracking (which uses fingerprinting) out there. > Questionable value for privacy / fingerprinting. If you plug-in your computer ... Sure, agreed for privacy. > Pointless since 20100101 is already the default used in the user agent string Yes, since late 2015 only, and keeping a default hardly does any harm. By the way, try outputting `navigator.buildID` in your JavaScript console -- oops, not even this setting helped. The real ID is right there. So it's not as easy as you might think. > is this about the "stranger opens a new tab in my profile and sees what sites I frequently visit" scenario? No. If I remember correctly, the "new tab" page is about the ads.
- dao- 10y ago
  > If you feel uncomfortable in that section, feel free to avoid touching it. I feel very comfortable touching hidden prefs in Firefox. That's not my point. My point is that random users stumbling upon your github page may not know what they're doing. > Sure, everything may break some sites. But this is about blocking third party cookies, which blocks not a single site I know (Do you know a popular one?) I quickly googled this for you, found this: https://bugzilla.mozilla.org/show_bug.cgi?id=849948 https://bugzilla.mozilla.org/show_bug.cgi?id=849948 https://news.ycombinator.com/item?id=5272069 https://news.ycombinator.com/item?id=5272069 https://getsatisfaction.com/getsatisfaction/topics/bad_user_experience_with_third_party_cookies_disabled https://getsatisfaction.com/getsatisfaction/topics/bad_user_... https://planapple.uservoice.com/knowledgebase/articles/509652-blocking-third-party-cookies-breaks-the-save-butto https://planapple.uservoice.com/knowledgebase/articles/50965... > No. If I remember correctly, the "new tab" page is about the ads. The new tab page displays frequently visited sites. In new profiles without a browsing history, it would also suggest sites, some of which would be "sponsored" (i.e. ads). If I remember correctly, Firefox would pick the ads locally without leaking information about you. So what's the privacy impact? Also, it doesn't even do that anymore: http://arstechnica.com/information-technology/2015/12/firefox-retires-much-maligned-sponsored-tiles-hunts-for-new-revenue-streams/ http://arstechnica.com/information-technology/2015/12/firefo...
  - marco1 10y ago
    > I quickly googled this for you, found this Right, "1292 days ago". Now that we've just talked about information that is out-of-date. > Blocking 3rd party cookies breaks surprisingly few things Agreed. A comment from the post that you linked to. Disqus being one of the few exceptions that don't work (because it's embedded as a third-party on first-party sites), personally, I can live with that. Everybody has to decide for themselves. If some setting doesn't work, it can simply be undone.
    - dao- 10y ago
      > Disqus being one of the few exceptions that don't work (because it's embedded as a third-party on first-party sites), Just like e.g. Facebook Login and github accounts, right? > personally, I can live with that. Everybody has to decide for themselves. If some setting doesn't work, it can simply be undone. Except that the list that you promoted here has no detailed documentation and doesn't put users in the position to make an informed decision.
gcp 10y ago
>> user_pref("dom.battery.enabled", false); In current Firefox this is AFAIK whitened exactly to prevent fingerprinting. Disabling it will increase your footprint because it's not the default.

by dao- 10y ago

marco1 10y ago

> The warning when opening about:config is no exaggeration If you feel uncomfortable in that section, feel free to avoid touching it. But if you know what you do, there are zero problems. Want to change your user agent? Do it there. No problems. The warning is for your average non-technical user, justifiably. Well, perhaps you need to read up on those a little bit again. > If I remember correctly, this may break some sites. Sure, everything may break some sites. But this is about blocking third party cookies, which blocks not a single site I know (Do you know a popular one?) while being one of the most effective measures against tracking (which uses fingerprinting) out there. > Questionable value for privacy / fingerprinting. If you plug-in your computer ... Sure, agreed for privacy. > Pointless since 20100101 is already the default used in the user agent string Yes, since late 2015 only, and keeping a default hardly does any harm. By the way, try outputting `navigator.buildID` in your JavaScript console -- oops, not even this setting helped. The real ID is right there. So it's not as easy as you might think. > is this about the "stranger opens a new tab in my profile and sees what sites I frequently visit" scenario? No. If I remember correctly, the "new tab" page is about the ads.

dao- 10y ago
> If you feel uncomfortable in that section, feel free to avoid touching it. I feel very comfortable touching hidden prefs in Firefox. That's not my point. My point is that random users stumbling upon your github page may not know what they're doing. > Sure, everything may break some sites. But this is about blocking third party cookies, which blocks not a single site I know (Do you know a popular one?) I quickly googled this for you, found this: https://bugzilla.mozilla.org/show_bug.cgi?id=849948 https://bugzilla.mozilla.org/show_bug.cgi?id=849948 https://news.ycombinator.com/item?id=5272069 https://news.ycombinator.com/item?id=5272069 https://getsatisfaction.com/getsatisfaction/topics/bad_user_experience_with_third_party_cookies_disabled https://getsatisfaction.com/getsatisfaction/topics/bad_user_... https://planapple.uservoice.com/knowledgebase/articles/509652-blocking-third-party-cookies-breaks-the-save-butto https://planapple.uservoice.com/knowledgebase/articles/50965... > No. If I remember correctly, the "new tab" page is about the ads. The new tab page displays frequently visited sites. In new profiles without a browsing history, it would also suggest sites, some of which would be "sponsored" (i.e. ads). If I remember correctly, Firefox would pick the ads locally without leaking information about you. So what's the privacy impact? Also, it doesn't even do that anymore: http://arstechnica.com/information-technology/2015/12/firefox-retires-much-maligned-sponsored-tiles-hunts-for-new-revenue-streams/ http://arstechnica.com/information-technology/2015/12/firefo...
- marco1 10y ago
  > I quickly googled this for you, found this Right, "1292 days ago". Now that we've just talked about information that is out-of-date. > Blocking 3rd party cookies breaks surprisingly few things Agreed. A comment from the post that you linked to. Disqus being one of the few exceptions that don't work (because it's embedded as a third-party on first-party sites), personally, I can live with that. Everybody has to decide for themselves. If some setting doesn't work, it can simply be undone.
  - dao- 10y ago
    > Disqus being one of the few exceptions that don't work (because it's embedded as a third-party on first-party sites), Just like e.g. Facebook Login and github accounts, right? > personally, I can live with that. Everybody has to decide for themselves. If some setting doesn't work, it can simply be undone. Except that the list that you promoted here has no detailed documentation and doesn't put users in the position to make an informed decision.

gcp 10y ago

>> user_pref("dom.battery.enabled", false); In current Firefox this is AFAIK whitened exactly to prevent fingerprinting. Disabling it will increase your footprint because it's not the default.