4 ms·

>> broad compatibility with websites > a browser which has privacy as a core principle Sorry, but sad truth is, those two things are mutually exclusive. The

>> broad compatibility with websites > a browser which has privacy as a core principle Sorry, but sad truth is, those two things are mutually exclusive. The modern web is all about running pieces of code. Websites give you a code and expect you to run it (or they'll break). You can throw in some heuristics (e.g. blacklist known offenders and replace them with do-nothing shims) and try to keep up with the ever-changing world, but here is just no way to have this guesswork as a core principle and expect things to not break.

snakeanus 9y ago
Wouldn't it be possible for a browser to implement js but simply not implement any functions that can be used to track you?
- drdaeman 9y ago
  Like not implementing cookies, LocalStorage, screen resolution info, font enumeration, canvas, WebGL, WebRTC, etc etc? It's probably realistically possible to disable those with the existing browsers. Problem is, that will also break sites that expect you to have all those available. And it's said that there are too many of those (I never saw a proper analysis, though) Just consider: there are sites (one of my favorite pizza delivery sites does that) that break if you just block Google Analytics ga.js (or their newer versions, whatever they're called) scripts. Just because they have stuff like `_gaq.push` hardcoded into click handlers and if those raise exceptions, they fail.
  - snakeanus 9y ago
    Cookies are still needed for site logins so it would be quite difficult to get rid of them, it would be possible however to enable them only for the sites that you are planing to log into. As for local storage, I only needed it for some greasemonkey extensions. Do legit sites actually use it? > font enumeration, canvas, WebGL, WebRTC I have all of these disabled for the last 2 years or so actually and I don't feel like I miss anything. Only a few non-important sites need these. > Just consider: there are sites (one of my favorite pizza delivery sites does that) that break if you just block Google Analytics ga.js (or their newer versions, whatever they're called) scripts. Just because they have stuff like `_gaq.push` hardcoded into click handlers and if those raise exceptions, they fail. I think that uBlock Origin avoids that if you have the experimental filter enabled.
    - mutant77 9y ago
      You need localStorage to login in your mozilla account - I block it and lost access to my account.
  - marcosdumay 9y ago
    Firefox has an extension called "self destructing cookies" that implements those the way they should be done everywhere. There is absolutely no need for font enumeration. A browser can decide do download fonts it does not have from the site (what will indeed open it to some tracking), or use another cache (with other, different tracking possibilities). But any way it chooses, it just needs to cache the fonts locally to avoid most of the tracking. There's no reason for local storage to permit 3rd party tracking. WebRTC was a mistake, and WebGL although well meant is so complex that will never work well. A lot of out javascript signature could be simply removed without any ill effects.
    - icebraining 9y ago
      it just needs to cache the fonts locally to avoid most of the tracking. Caching is one of the ways of tracking you. If site A says it needs some custom font, the browser will have to download it. If then site B (affiliated with A) asks for the same font, and the browser loads it from cache instead of asking site B, then it knows that you've been to site A.
- gcp 9y ago
  Firstly, it's not entirely clear how big this subset is, and not implementing known parts of it for sure breaks the web. What's the status of blocking third-party cookies again? (cries)
- lucideer 9y ago
  Yes, but by "functions that can be used to track you", you're including user accounts, logins, forms, surveys, &c. The term "tracking" has become abstracted to a point where many forget that they usually want to be "tracked" (by hitting "reply" here on HN, YCombinator is "tracking" who I am - user account - and what I've written). If you'd be happy with a browser exclusively to view public, static content, then it could be done. For selectively disabling tracking, you need uMatrix[0], but a component of the Firefox bug being reported here is that the extensions API used by uMatrix is failing to block GA in this particular case. [0] https://addons.mozilla.org/en-US/firefox/addon/umatrix/ https://addons.mozilla.org/en-US/firefox/addon/umatrix/
  - snakeanus 9y ago
    > Yes, but by "functions that can be used to track you", you're including user accounts, logins, forms, surveys, &c. These are not javascript functions. All of these can be (and are) implemented without JS. > but a component of the Firefox bug being reported here is that the extensions API used by uMatrix is failing to block GA in this particular case. uMatrix and uBlock Origin fail to block GA only when using their web extension versions.

snakeanus 9y ago

Wouldn't it be possible for a browser to implement js but simply not implement any functions that can be used to track you?

drdaeman 9y ago
Like not implementing cookies, LocalStorage, screen resolution info, font enumeration, canvas, WebGL, WebRTC, etc etc? It's probably realistically possible to disable those with the existing browsers. Problem is, that will also break sites that expect you to have all those available. And it's said that there are too many of those (I never saw a proper analysis, though) Just consider: there are sites (one of my favorite pizza delivery sites does that) that break if you just block Google Analytics ga.js (or their newer versions, whatever they're called) scripts. Just because they have stuff like `_gaq.push` hardcoded into click handlers and if those raise exceptions, they fail.
- snakeanus 9y ago
  Cookies are still needed for site logins so it would be quite difficult to get rid of them, it would be possible however to enable them only for the sites that you are planing to log into. As for local storage, I only needed it for some greasemonkey extensions. Do legit sites actually use it? > font enumeration, canvas, WebGL, WebRTC I have all of these disabled for the last 2 years or so actually and I don't feel like I miss anything. Only a few non-important sites need these. > Just consider: there are sites (one of my favorite pizza delivery sites does that) that break if you just block Google Analytics ga.js (or their newer versions, whatever they're called) scripts. Just because they have stuff like `_gaq.push` hardcoded into click handlers and if those raise exceptions, they fail. I think that uBlock Origin avoids that if you have the experimental filter enabled.
  - mutant77 9y ago
    You need localStorage to login in your mozilla account - I block it and lost access to my account.
- marcosdumay 9y ago
  Firefox has an extension called "self destructing cookies" that implements those the way they should be done everywhere. There is absolutely no need for font enumeration. A browser can decide do download fonts it does not have from the site (what will indeed open it to some tracking), or use another cache (with other, different tracking possibilities). But any way it chooses, it just needs to cache the fonts locally to avoid most of the tracking. There's no reason for local storage to permit 3rd party tracking. WebRTC was a mistake, and WebGL although well meant is so complex that will never work well. A lot of out javascript signature could be simply removed without any ill effects.
  - icebraining 9y ago
    it just needs to cache the fonts locally to avoid most of the tracking. Caching is one of the ways of tracking you. If site A says it needs some custom font, the browser will have to download it. If then site B (affiliated with A) asks for the same font, and the browser loads it from cache instead of asking site B, then it knows that you've been to site A.
gcp 9y ago
Firstly, it's not entirely clear how big this subset is, and not implementing known parts of it for sure breaks the web. What's the status of blocking third-party cookies again? (cries)
lucideer 9y ago
Yes, but by "functions that can be used to track you", you're including user accounts, logins, forms, surveys, &c. The term "tracking" has become abstracted to a point where many forget that they usually want to be "tracked" (by hitting "reply" here on HN, YCombinator is "tracking" who I am - user account - and what I've written). If you'd be happy with a browser exclusively to view public, static content, then it could be done. For selectively disabling tracking, you need uMatrix[0], but a component of the Firefox bug being reported here is that the extensions API used by uMatrix is failing to block GA in this particular case. [0] https://addons.mozilla.org/en-US/firefox/addon/umatrix/ https://addons.mozilla.org/en-US/firefox/addon/umatrix/
- snakeanus 9y ago
  > Yes, but by "functions that can be used to track you", you're including user accounts, logins, forms, surveys, &c. These are not javascript functions. All of these can be (and are) implemented without JS. > but a component of the Firefox bug being reported here is that the extensions API used by uMatrix is failing to block GA in this particular case. uMatrix and uBlock Origin fail to block GA only when using their web extension versions.