8 ms·

Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can. When we get to critical mass, the advertising networks w

Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can. When we get to critical mass, the advertising networks will come back with a new deal. I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us?

Aoyagi 10y ago
When we get to critical mass? More like "if". I doubt the majority (crushing majority even) of active web browsers will ever get to that length. Especially noscript, which makes some sites completely useless.
- coldpie 10y ago
  It makes many more completely usable. Floating headers and footers? Dead. Survey pop-ups? Dead. Pop-ups begging for your email address? Dead. Dumb fading in text and images? Dead. Needless whiz-bang animations? Dead. Site load times? Dramatically reduced. Browsing the web with NoScript is far more pleasant, even if I have to sometimes open a menu to enable a couple domains to make a poorly developed website usable. I'd highly recommend it to anyone even remotely technical.
  - pc86 10y ago
    TIL utilizing the most widely available programming language in the world makes a website "poorly developed."
    - coldpie 10y ago
      If your website requires active content in order to display plaintext, images and navigation, then yes, it is poorly developed. You failed to use the right tool for the job.
      - pc86 10y ago
        Navigation is typically comprised of text and/or images. Some websites need more than text or images.
        zzzcpan 10y ago
        Very few websites, maybe 1 out of 100, most offenders are just rendering content in the browser for some reason. Although even bigger offenders are not individuals, but companies, outright blocking access to client's websites without javascript. So far it's mostly Cloudflare, I think most people using the web without javascript hate them the most, hopefully the trend won't continue.
        OJFord 10y ago
        Cloudflare blocks access to sites behind it to users with JS enabled? Even if there's no JS on the site? 1. Is there anything the site owner can do to turn that off? 2. Is it because they inject some kind of DDoS prevention/tracking thing? This suggests crawlers load JS, which I wouldn't have necessarily assumed.
        throwaway2048 10y ago
        cloudflare can whitelist crawlers like google. The fact it blocks other automatic robots is more of a feature than a flaw.
        OJFord 10y ago
        Requiring visitors to have JS enabled isn't (a very good) feature.
        deleted 10y ago
        [deleted]
    - digler999 10y ago
      abusing the most widely available language to destroy the UX makes a website poorly developed.
    - logfromblammo 10y ago
      The worst offender I have seen in this respect is blog sites that won't even load static text without scripts enabled. The complaint isn't with the scripting language, but with the blatantly unnecessary use of it. One of the principles of human-friendly design is graceful degradation. For instance, you might design a museum for people that can walk. But some visitors might not be able to walk, so for them you install ramps and elevators when the stairs are not usable. At the very minimum level, where someone is manually typing in HTTP requests, over a direct TCP connection to port 80 of your site, you should be returning something that can be read. Some people (or bots) may be fetching your site with curl or wget or links. Some people may be using screen readers. Some people may need machine assistance with pointer movement or scrolling. Some people may have extremely limited bandwidth, and won't automatically download images or frame contents. If you can't degrade gracefully, your website is "poorly developed". So if you are utterly reliant on scripting to display anything at all, that certainly qualifies.
    - coin 10y ago
      Why do I need to run executable code in order to read static content?
  - Jailout2000 10y ago
    I'd love to use NoScript, but even being as technical as I am, the UI/UX for it makes it completely unusable for me. I'm not a Firefox primary user, I primarily am on Chromium Opera these days. The equivalent of NoScript is an extension called NoScript Suite Lite: https://chrome.google.com/webstore/detail/no-script-suite-lite/ahnanjpbkghcdgmlchbcfoiefnifjeni https://chrome.google.com/webstore/detail/no-script-suite-li...
- a_imho 10y ago
  Well, afaik Opera has content blocking by default, Firefox should do the same. MS and Apple could potentially add it.
dest 10y ago
As stated in the article, the Tor Browser Bundle seems a good candidate of a widely adopted fingerprint. But it's just Tor of course, not browsers in general.
- xkxx 10y ago
  Hmm, a good idea would be to make it possible to use Tor Browser without Tor, for those who don't need strong anonymity, but still want to resist browser fingerprinting.
  - sleepychu 10y ago
    I really want to just use my browser though, if it's possible to make it work without confessing all the bits that make my fingerprint.
    - dest 10y ago
      I think those bits of information are closely tied to your browser functionalities. E.g. resolution, plugins installed. Keeping those bits for you would degrade your browsing experience. Have a look at the parameters that bring the highest amount of fingerprinting bits in your config https://panopticlick.eff.org/ https://panopticlick.eff.org/ then see if it possible to disable them. I think it's just plain hard.
      - thinkling 10y ago
        It's plain hard because the moment the browser blocks some of the fingerprinting techniques, the fingerprint developers will look for something else and move on. Just like spam and ads, it's an arms race.
  - mirimir 10y ago
    That's not very hard.[0] > If you intend to test for leaks using other third-party sites, I recommend using Tor browser, because it's been hardened to block WebGL fingerprinting, and otherwise to report the same fingerprints for all users. But you obviously don't want to use Tor while testing your VPN. First, download Tor browser for your OS. Do that with your VPN connected, so your ISP doesn't see. After extracting, start Tor browser. You can probably accept all defaults. Go to advanced network settings, and select "No proxy". Browse about:config, and toggle both "extensions.torlauncher.starttor" and "network.proxy.socksremote_dns" to "false". Then browse check.torproject.org. You should see "Sorry. You are not using Tor." and your VPN exit IP address. 0) https://www.ivpn.net/privacy-guides/how-to-perform-a-vpn-leak-test https://www.ivpn.net/privacy-guides/how-to-perform-a-vpn-lea...
taf2 10y ago
I could be mistaken but doesn't the use of an adblocker make you even more obvious - e.g. Your fingerprint becomes more easily discernible from the rest of the Hurd, you become more obvious. Sure you could disable JavaScript but then you have basically disabled any website that depends on it which might equivalently disable the parts of the internet you wanted to access. Also it becomes obvious that your location has a broken experience. Perhaps there is a balance of blocking and blending in. My view on this is what kind of websites are you visiting that make you feel you need to disable parts of it?
- angry_octet 10y ago
  If the browser reports that your OS is GNU Hurd you could only be RMS, so fingerprinting would be redundant.
- dagenleg 10y ago
  You can just enable those parts that you need while still avoiding vast majority of bloat. At least for Firefox there's uMatrix that allows for finetuning of what exactly you want to enable/disable.
- sleepychu 10y ago
  So my two points are perhaps overlapping. I don't want people to track me on the internet, I think the main reason they bother is that they can show me ads that will be more interesting to me and make them more money. I can resist this by not showing the adverts to myself. I'd like to make it harder for them to track me at all, though this is always an arms war it seems like I'm labeling myself at the moment. I'm not familiar with the technology they use to detect adblockers, does it detect "U-Block Origin (Firefox) Ver 17.3" or does it just detect "I can't seem to see the ad I know should be here, this user is blocking my ads." if it's the latter then my proposal to adopt a blank/universal fingerprint is willing to confess the single bit of information of whether the user has decided to refuse adverts.
- stymaar 10y ago
  > I could be mistaken but doesn't the use of an adblocker make you even more obvious - e.g. Your fingerprint becomes more easily discernible from the rest of the Hurd, you become more obvious. In my generation (I'm 28), and even more in my cousins' (early twenties) it looks like the hurd is using an adblocker. And I'm talking about art students, acountants and chefs not IT engineers. You just can't spend hours on YouTube videos without an adblocker on …
ptero 10y ago
IMO the hope lies in the fact that many vendors do not depend on privacy invasions in their main business model, e.g. Amazon or Panera will sell me roughly the same stuff regardless of which photos I was staring at yesterday. Selling my info on the side is a profitable add-on, but not strictly required for their main business. Maybe unnecessary tracking will eventually be competed away (this does require that a much large fraction of users starts caring about privacy). One could also introduce confusers -- e.g., setup some "light anonymizing portals" that will add / swap / scramble non-critical cookie data. Done right it should be possible to keep almost all of web functionality intact without introducing a security nightmare, but to work well this also needs a viable business model.
- nojvek 10y ago
  For a lot of single page applications, javascript makes sense. Less data to load from server on subsequent requests. Your app is a lot richer. Sure you can disable js, but for the majority the Web would be really broken without js. As a culture, tracking is everywhere. Disabling js still logs your up, referrer and a bunch of other things. I do like what uorigin/adblock and other extensions are doing.
codingdave 10y ago
Not all of those identifying bits have anything to do with the web. For example, your OS, your monitor size and color depth, the fonts you have installed. Those things make your overall computing experience useful, whether or not they improve your web experience. It might be more practical to work towards browsers that do not have access to data that is not relevant to the web experience. I do need to know the size of your browser window. I do not need to know anything more about your video capabilities. In an ideal world, I wouldn't even need to know your browser, I would just need to know its capabilities. Your browser needs to know which fonts it can display, but my web server doesn't need to know that.
- rileymat2 10y ago
  > In an ideal world, I wouldn't even need to know your browser, I would just need to know its capabilities. Isn't that info still enough for finger printing the browser, if they have enough different capabilities?
spaceboy 10y ago
> I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us? https://anonymous-proxy-servers.net/en/jondofox.html https://anonymous-proxy-servers.net/en/jondofox.html JonDofox with JS turned off and uBlock origin installed. There's actually a small pool of users with this config but it needs to be bigger. As you said, as soon as we get consensus on what config to use, we can all switch to it en-masse.
samfisher83 10y ago
Unless you disable JavaScript it would be to hard to stop the fingerprinting. If you shut off JavaScript a lot of sites won't work
- inetknght 10y ago
  From firsthand experience, I've learned to live with broken websites and often end up _not_ using sites that rely heavily on javascript, and especially not sites that rely heavily on loading javascript from third-party domains. The worst offenders, by far, are news sites. Coming close are just about every startup that has a heavy focus on fancy web front end.
- logfromblammo 10y ago
  Since many of those sites "work" by tracking you and relentlessly analyzing your behavior, I'd say that's a good thing. If a site shows me nothing but a blank screen when I load it up with scripts disabled, I am very reluctant to enable 14 different script domains just to see a paged article, or worse, a slide show. Allowing scripts to run only from whitelisted domains makes the web a better place.
- pdkl95 10y ago
  If a website doesn't have at least minimal functionality (i.e. the article can be read), then the website is broken. Fortunately, most websites that aren't complete trash work ok without JS. Very few websites need to have their JS whitelisted, which only has to be done on the first visit. Running unknown programs from random hosts on the internet - even in a limited environment - is a bad idea. Fortunately, documents (including images, audio, video, etc.) do not need Turing completeness. A lot of people will react strongly against the idea of not using JS, often because their income depends on tricking users into running spyware/malware,
  - romaniv 10y ago
    >If a website doesn't have at least minimal functionality, then the website is broken. Curious. This goes completely against the sentiment in all of the discussions around modern SPA frameworks and JS libraries I've seen on this very website. It seems that for most fronted devs today JS is a natural prerequisite for using their product. Progressive enhancement is often sneered at[1] as impractical and unnecessary. This leads me to believe that there are two mostly disjoint groups of people commenting on this issue in different threads. --- [1] - Good example: https://www.viget.com/articles/the-case-against-progressive-enhancements-flimsy-moral-foundation https://www.viget.com/articles/the-case-against-progressive-...
Balgair 10y ago
This should help in addition to your suggestions: https://addons.mozilla.org/en-US/firefox/addon/random-agent-spoofer/ https://addons.mozilla.org/en-US/firefox/addon/random-agent-... https://addons.mozilla.org/en-US/firefox/addon/trackmenot/ https://addons.mozilla.org/en-US/firefox/addon/trackmenot/ https://addons.mozilla.org/en-US/firefox/addon/adnauseam/ https://addons.mozilla.org/en-US/firefox/addon/adnauseam/ (doesn't work well for me, though, YMMV)
rsync 10y ago
"Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can." For the fourth or fifth time this year, in response to a thread about browser privacy, I am reminded that what I really want is the ability to jail/chroot a browser. Firing up a full-blown VM for a browser ("banking profile", "twitter profile", "sketchy online store profile") is way too heavyweight and resource intensive. I want a totally, totally clean slate (restored to post-install defaults) to restart certain browsing sessions with (and dispose of when I am done) but a full virtual machine is too expensive in time and resources. But if I could jail a GUI application ... then there would be almost zero resource overhead and the jail would die quickly when you're done. jailing a GUI application is not that well developed of a use-case. Further, OSX doesn't even have a jail command. I wish this was an established use-case - I would really like a totally throwaway browser profile that I could reset and re-use.
- dreamcompiler 10y ago
  Logging in to the Guest account on OSX accomplishes what you want, no?
  - thinkling 10y ago
    Some of the fingerprinting involves not the user-controlled configuration of the machine, but hardware-related aspects like the canvas fingerprinting which looks at pixel level details of a small rendered figure. That combined with IP address will go a long way.
  - rsync 10y ago
    "Logging in to the Guest account on OSX accomplishes what you want, no?" No ... That is, unless I can easily script the destruction and recreation of the guest account, and automated install and configuration of my chrome setup ... The idea here is that I set up chrome just how I want it and deploy and redeploy that "container" over and over - destroying it and recreating it after each use. Possibly with multiple instances running simultaneously ...
    - 10y ago

Aoyagi 10y ago

When we get to critical mass? More like "if". I doubt the majority (crushing majority even) of active web browsers will ever get to that length. Especially noscript, which makes some sites completely useless.

coldpie 10y ago
It makes many more completely usable. Floating headers and footers? Dead. Survey pop-ups? Dead. Pop-ups begging for your email address? Dead. Dumb fading in text and images? Dead. Needless whiz-bang animations? Dead. Site load times? Dramatically reduced. Browsing the web with NoScript is far more pleasant, even if I have to sometimes open a menu to enable a couple domains to make a poorly developed website usable. I'd highly recommend it to anyone even remotely technical.
- pc86 10y ago
  TIL utilizing the most widely available programming language in the world makes a website "poorly developed."
  - coldpie 10y ago
    If your website requires active content in order to display plaintext, images and navigation, then yes, it is poorly developed. You failed to use the right tool for the job.
    - pc86 10y ago
      Navigation is typically comprised of text and/or images. Some websites need more than text or images.
      - zzzcpan 10y ago
        Very few websites, maybe 1 out of 100, most offenders are just rendering content in the browser for some reason. Although even bigger offenders are not individuals, but companies, outright blocking access to client's websites without javascript. So far it's mostly Cloudflare, I think most people using the web without javascript hate them the most, hopefully the trend won't continue.
        OJFord 10y ago
        Cloudflare blocks access to sites behind it to users with JS enabled? Even if there's no JS on the site? 1. Is there anything the site owner can do to turn that off? 2. Is it because they inject some kind of DDoS prevention/tracking thing? This suggests crawlers load JS, which I wouldn't have necessarily assumed.
        throwaway2048 10y ago
        cloudflare can whitelist crawlers like google. The fact it blocks other automatic robots is more of a feature than a flaw.
        OJFord 10y ago
        Requiring visitors to have JS enabled isn't (a very good) feature.
      - deleted 10y ago
        [deleted]
  - digler999 10y ago
    abusing the most widely available language to destroy the UX makes a website poorly developed.
  - logfromblammo 10y ago
    The worst offender I have seen in this respect is blog sites that won't even load static text without scripts enabled. The complaint isn't with the scripting language, but with the blatantly unnecessary use of it. One of the principles of human-friendly design is graceful degradation. For instance, you might design a museum for people that can walk. But some visitors might not be able to walk, so for them you install ramps and elevators when the stairs are not usable. At the very minimum level, where someone is manually typing in HTTP requests, over a direct TCP connection to port 80 of your site, you should be returning something that can be read. Some people (or bots) may be fetching your site with curl or wget or links. Some people may be using screen readers. Some people may need machine assistance with pointer movement or scrolling. Some people may have extremely limited bandwidth, and won't automatically download images or frame contents. If you can't degrade gracefully, your website is "poorly developed". So if you are utterly reliant on scripting to display anything at all, that certainly qualifies.
  - coin 10y ago
    Why do I need to run executable code in order to read static content?
- Jailout2000 10y ago
  I'd love to use NoScript, but even being as technical as I am, the UI/UX for it makes it completely unusable for me. I'm not a Firefox primary user, I primarily am on Chromium Opera these days. The equivalent of NoScript is an extension called NoScript Suite Lite: https://chrome.google.com/webstore/detail/no-script-suite-lite/ahnanjpbkghcdgmlchbcfoiefnifjeni https://chrome.google.com/webstore/detail/no-script-suite-li...
a_imho 10y ago
Well, afaik Opera has content blocking by default, Firefox should do the same. MS and Apple could potentially add it.

dest 10y ago

As stated in the article, the Tor Browser Bundle seems a good candidate of a widely adopted fingerprint. But it's just Tor of course, not browsers in general.

xkxx 10y ago
Hmm, a good idea would be to make it possible to use Tor Browser without Tor, for those who don't need strong anonymity, but still want to resist browser fingerprinting.
- sleepychu 10y ago
  I really want to just use my browser though, if it's possible to make it work without confessing all the bits that make my fingerprint.
  - dest 10y ago
    I think those bits of information are closely tied to your browser functionalities. E.g. resolution, plugins installed. Keeping those bits for you would degrade your browsing experience. Have a look at the parameters that bring the highest amount of fingerprinting bits in your config https://panopticlick.eff.org/ https://panopticlick.eff.org/ then see if it possible to disable them. I think it's just plain hard.
    - thinkling 10y ago
      It's plain hard because the moment the browser blocks some of the fingerprinting techniques, the fingerprint developers will look for something else and move on. Just like spam and ads, it's an arms race.
- mirimir 10y ago
  That's not very hard.[0] > If you intend to test for leaks using other third-party sites, I recommend using Tor browser, because it's been hardened to block WebGL fingerprinting, and otherwise to report the same fingerprints for all users. But you obviously don't want to use Tor while testing your VPN. First, download Tor browser for your OS. Do that with your VPN connected, so your ISP doesn't see. After extracting, start Tor browser. You can probably accept all defaults. Go to advanced network settings, and select "No proxy". Browse about:config, and toggle both "extensions.torlauncher.starttor" and "network.proxy.socksremote_dns" to "false". Then browse check.torproject.org. You should see "Sorry. You are not using Tor." and your VPN exit IP address. 0) https://www.ivpn.net/privacy-guides/how-to-perform-a-vpn-leak-test https://www.ivpn.net/privacy-guides/how-to-perform-a-vpn-lea...

taf2 10y ago

I could be mistaken but doesn't the use of an adblocker make you even more obvious - e.g. Your fingerprint becomes more easily discernible from the rest of the Hurd, you become more obvious. Sure you could disable JavaScript but then you have basically disabled any website that depends on it which might equivalently disable the parts of the internet you wanted to access. Also it becomes obvious that your location has a broken experience. Perhaps there is a balance of blocking and blending in. My view on this is what kind of websites are you visiting that make you feel you need to disable parts of it?

angry_octet 10y ago
If the browser reports that your OS is GNU Hurd you could only be RMS, so fingerprinting would be redundant.
dagenleg 10y ago
You can just enable those parts that you need while still avoiding vast majority of bloat. At least for Firefox there's uMatrix that allows for finetuning of what exactly you want to enable/disable.
sleepychu 10y ago
So my two points are perhaps overlapping. I don't want people to track me on the internet, I think the main reason they bother is that they can show me ads that will be more interesting to me and make them more money. I can resist this by not showing the adverts to myself. I'd like to make it harder for them to track me at all, though this is always an arms war it seems like I'm labeling myself at the moment. I'm not familiar with the technology they use to detect adblockers, does it detect "U-Block Origin (Firefox) Ver 17.3" or does it just detect "I can't seem to see the ad I know should be here, this user is blocking my ads." if it's the latter then my proposal to adopt a blank/universal fingerprint is willing to confess the single bit of information of whether the user has decided to refuse adverts.
stymaar 10y ago
> I could be mistaken but doesn't the use of an adblocker make you even more obvious - e.g. Your fingerprint becomes more easily discernible from the rest of the Hurd, you become more obvious. In my generation (I'm 28), and even more in my cousins' (early twenties) it looks like the hurd is using an adblocker. And I'm talking about art students, acountants and chefs not IT engineers. You just can't spend hours on YouTube videos without an adblocker on …

ptero 10y ago

IMO the hope lies in the fact that many vendors do not depend on privacy invasions in their main business model, e.g. Amazon or Panera will sell me roughly the same stuff regardless of which photos I was staring at yesterday. Selling my info on the side is a profitable add-on, but not strictly required for their main business. Maybe unnecessary tracking will eventually be competed away (this does require that a much large fraction of users starts caring about privacy). One could also introduce confusers -- e.g., setup some "light anonymizing portals" that will add / swap / scramble non-critical cookie data. Done right it should be possible to keep almost all of web functionality intact without introducing a security nightmare, but to work well this also needs a viable business model.

nojvek 10y ago
For a lot of single page applications, javascript makes sense. Less data to load from server on subsequent requests. Your app is a lot richer. Sure you can disable js, but for the majority the Web would be really broken without js. As a culture, tracking is everywhere. Disabling js still logs your up, referrer and a bunch of other things. I do like what uorigin/adblock and other extensions are doing.

codingdave 10y ago

Not all of those identifying bits have anything to do with the web. For example, your OS, your monitor size and color depth, the fonts you have installed. Those things make your overall computing experience useful, whether or not they improve your web experience. It might be more practical to work towards browsers that do not have access to data that is not relevant to the web experience. I do need to know the size of your browser window. I do not need to know anything more about your video capabilities. In an ideal world, I wouldn't even need to know your browser, I would just need to know its capabilities. Your browser needs to know which fonts it can display, but my web server doesn't need to know that.

rileymat2 10y ago
> In an ideal world, I wouldn't even need to know your browser, I would just need to know its capabilities. Isn't that info still enough for finger printing the browser, if they have enough different capabilities?

spaceboy 10y ago

> I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us? https://anonymous-proxy-servers.net/en/jondofox.html https://anonymous-proxy-servers.net/en/jondofox.html JonDofox with JS turned off and uBlock origin installed. There's actually a small pool of users with this config but it needs to be bigger. As you said, as soon as we get consensus on what config to use, we can all switch to it en-masse.

samfisher83 10y ago

Unless you disable JavaScript it would be to hard to stop the fingerprinting. If you shut off JavaScript a lot of sites won't work

inetknght 10y ago
From firsthand experience, I've learned to live with broken websites and often end up _not_ using sites that rely heavily on javascript, and especially not sites that rely heavily on loading javascript from third-party domains. The worst offenders, by far, are news sites. Coming close are just about every startup that has a heavy focus on fancy web front end.
logfromblammo 10y ago
Since many of those sites "work" by tracking you and relentlessly analyzing your behavior, I'd say that's a good thing. If a site shows me nothing but a blank screen when I load it up with scripts disabled, I am very reluctant to enable 14 different script domains just to see a paged article, or worse, a slide show. Allowing scripts to run only from whitelisted domains makes the web a better place.
pdkl95 10y ago
If a website doesn't have at least minimal functionality (i.e. the article can be read), then the website is broken. Fortunately, most websites that aren't complete trash work ok without JS. Very few websites need to have their JS whitelisted, which only has to be done on the first visit. Running unknown programs from random hosts on the internet - even in a limited environment - is a bad idea. Fortunately, documents (including images, audio, video, etc.) do not need Turing completeness. A lot of people will react strongly against the idea of not using JS, often because their income depends on tricking users into running spyware/malware,
- romaniv 10y ago
  >If a website doesn't have at least minimal functionality, then the website is broken. Curious. This goes completely against the sentiment in all of the discussions around modern SPA frameworks and JS libraries I've seen on this very website. It seems that for most fronted devs today JS is a natural prerequisite for using their product. Progressive enhancement is often sneered at[1] as impractical and unnecessary. This leads me to believe that there are two mostly disjoint groups of people commenting on this issue in different threads. --- [1] - Good example: https://www.viget.com/articles/the-case-against-progressive-enhancements-flimsy-moral-foundation https://www.viget.com/articles/the-case-against-progressive-...

Balgair 10y ago

This should help in addition to your suggestions: https://addons.mozilla.org/en-US/firefox/addon/random-agent-spoofer/ https://addons.mozilla.org/en-US/firefox/addon/random-agent-... https://addons.mozilla.org/en-US/firefox/addon/trackmenot/ https://addons.mozilla.org/en-US/firefox/addon/trackmenot/ https://addons.mozilla.org/en-US/firefox/addon/adnauseam/ https://addons.mozilla.org/en-US/firefox/addon/adnauseam/ (doesn't work well for me, though, YMMV)

rsync 10y ago

"Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can." For the fourth or fifth time this year, in response to a thread about browser privacy, I am reminded that what I really want is the ability to jail/chroot a browser. Firing up a full-blown VM for a browser ("banking profile", "twitter profile", "sketchy online store profile") is way too heavyweight and resource intensive. I want a totally, totally clean slate (restored to post-install defaults) to restart certain browsing sessions with (and dispose of when I am done) but a full virtual machine is too expensive in time and resources. But if I could jail a GUI application ... then there would be almost zero resource overhead and the jail would die quickly when you're done. jailing a GUI application is not that well developed of a use-case. Further, OSX doesn't even have a jail command. I wish this was an established use-case - I would really like a totally throwaway browser profile that I could reset and re-use.

dreamcompiler 10y ago
Logging in to the Guest account on OSX accomplishes what you want, no?
- thinkling 10y ago
  Some of the fingerprinting involves not the user-controlled configuration of the machine, but hardware-related aspects like the canvas fingerprinting which looks at pixel level details of a small rendered figure. That combined with IP address will go a long way.
- rsync 10y ago
  "Logging in to the Guest account on OSX accomplishes what you want, no?" No ... That is, unless I can easily script the destruction and recreation of the guest account, and automated install and configuration of my chrome setup ... The idea here is that I set up chrome just how I want it and deploy and redeploy that "container" over and over - destroying it and recreating it after each use. Possibly with multiple instances running simultaneously ...
  - 10y ago