3 ms·

Wouldn't it be possible for a browser to implement js but simply not implement any functions that can be used to track you?

drdaeman 9y ago
Like not implementing cookies, LocalStorage, screen resolution info, font enumeration, canvas, WebGL, WebRTC, etc etc? It's probably realistically possible to disable those with the existing browsers. Problem is, that will also break sites that expect you to have all those available. And it's said that there are too many of those (I never saw a proper analysis, though) Just consider: there are sites (one of my favorite pizza delivery sites does that) that break if you just block Google Analytics ga.js (or their newer versions, whatever they're called) scripts. Just because they have stuff like `_gaq.push` hardcoded into click handlers and if those raise exceptions, they fail.
- snakeanus 9y ago
  Cookies are still needed for site logins so it would be quite difficult to get rid of them, it would be possible however to enable them only for the sites that you are planing to log into. As for local storage, I only needed it for some greasemonkey extensions. Do legit sites actually use it? > font enumeration, canvas, WebGL, WebRTC I have all of these disabled for the last 2 years or so actually and I don't feel like I miss anything. Only a few non-important sites need these. > Just consider: there are sites (one of my favorite pizza delivery sites does that) that break if you just block Google Analytics ga.js (or their newer versions, whatever they're called) scripts. Just because they have stuff like `_gaq.push` hardcoded into click handlers and if those raise exceptions, they fail. I think that uBlock Origin avoids that if you have the experimental filter enabled.
  - mutant77 9y ago
    You need localStorage to login in your mozilla account - I block it and lost access to my account.
- marcosdumay 9y ago
  Firefox has an extension called "self destructing cookies" that implements those the way they should be done everywhere. There is absolutely no need for font enumeration. A browser can decide do download fonts it does not have from the site (what will indeed open it to some tracking), or use another cache (with other, different tracking possibilities). But any way it chooses, it just needs to cache the fonts locally to avoid most of the tracking. There's no reason for local storage to permit 3rd party tracking. WebRTC was a mistake, and WebGL although well meant is so complex that will never work well. A lot of out javascript signature could be simply removed without any ill effects.
  - icebraining 9y ago
    it just needs to cache the fonts locally to avoid most of the tracking. Caching is one of the ways of tracking you. If site A says it needs some custom font, the browser will have to download it. If then site B (affiliated with A) asks for the same font, and the browser loads it from cache instead of asking site B, then it knows that you've been to site A.
gcp 9y ago
Firstly, it's not entirely clear how big this subset is, and not implementing known parts of it for sure breaks the web. What's the status of blocking third-party cookies again? (cries)
lucideer 9y ago
Yes, but by "functions that can be used to track you", you're including user accounts, logins, forms, surveys, &c. The term "tracking" has become abstracted to a point where many forget that they usually want to be "tracked" (by hitting "reply" here on HN, YCombinator is "tracking" who I am - user account - and what I've written). If you'd be happy with a browser exclusively to view public, static content, then it could be done. For selectively disabling tracking, you need uMatrix[0], but a component of the Firefox bug being reported here is that the extensions API used by uMatrix is failing to block GA in this particular case. [0] https://addons.mozilla.org/en-US/firefox/addon/umatrix/ https://addons.mozilla.org/en-US/firefox/addon/umatrix/
- snakeanus 9y ago
  > Yes, but by "functions that can be used to track you", you're including user accounts, logins, forms, surveys, &c. These are not javascript functions. All of these can be (and are) implemented without JS. > but a component of the Firefox bug being reported here is that the extensions API used by uMatrix is failing to block GA in this particular case. uMatrix and uBlock Origin fail to block GA only when using their web extension versions.

drdaeman 9y ago

Like not implementing cookies, LocalStorage, screen resolution info, font enumeration, canvas, WebGL, WebRTC, etc etc? It's probably realistically possible to disable those with the existing browsers. Problem is, that will also break sites that expect you to have all those available. And it's said that there are too many of those (I never saw a proper analysis, though) Just consider: there are sites (one of my favorite pizza delivery sites does that) that break if you just block Google Analytics ga.js (or their newer versions, whatever they're called) scripts. Just because they have stuff like `_gaq.push` hardcoded into click handlers and if those raise exceptions, they fail.

snakeanus 9y ago
Cookies are still needed for site logins so it would be quite difficult to get rid of them, it would be possible however to enable them only for the sites that you are planing to log into. As for local storage, I only needed it for some greasemonkey extensions. Do legit sites actually use it? > font enumeration, canvas, WebGL, WebRTC I have all of these disabled for the last 2 years or so actually and I don't feel like I miss anything. Only a few non-important sites need these. > Just consider: there are sites (one of my favorite pizza delivery sites does that) that break if you just block Google Analytics ga.js (or their newer versions, whatever they're called) scripts. Just because they have stuff like `_gaq.push` hardcoded into click handlers and if those raise exceptions, they fail. I think that uBlock Origin avoids that if you have the experimental filter enabled.
- mutant77 9y ago
  You need localStorage to login in your mozilla account - I block it and lost access to my account.
marcosdumay 9y ago
Firefox has an extension called "self destructing cookies" that implements those the way they should be done everywhere. There is absolutely no need for font enumeration. A browser can decide do download fonts it does not have from the site (what will indeed open it to some tracking), or use another cache (with other, different tracking possibilities). But any way it chooses, it just needs to cache the fonts locally to avoid most of the tracking. There's no reason for local storage to permit 3rd party tracking. WebRTC was a mistake, and WebGL although well meant is so complex that will never work well. A lot of out javascript signature could be simply removed without any ill effects.
- icebraining 9y ago
  it just needs to cache the fonts locally to avoid most of the tracking. Caching is one of the ways of tracking you. If site A says it needs some custom font, the browser will have to download it. If then site B (affiliated with A) asks for the same font, and the browser loads it from cache instead of asking site B, then it knows that you've been to site A.

gcp 9y ago

Firstly, it's not entirely clear how big this subset is, and not implementing known parts of it for sure breaks the web. What's the status of blocking third-party cookies again? (cries)

lucideer 9y ago

Yes, but by "functions that can be used to track you", you're including user accounts, logins, forms, surveys, &c. The term "tracking" has become abstracted to a point where many forget that they usually want to be "tracked" (by hitting "reply" here on HN, YCombinator is "tracking" who I am - user account - and what I've written). If you'd be happy with a browser exclusively to view public, static content, then it could be done. For selectively disabling tracking, you need uMatrix[0], but a component of the Firefox bug being reported here is that the extensions API used by uMatrix is failing to block GA in this particular case. [0] https://addons.mozilla.org/en-US/firefox/addon/umatrix/ https://addons.mozilla.org/en-US/firefox/addon/umatrix/

snakeanus 9y ago
> Yes, but by "functions that can be used to track you", you're including user accounts, logins, forms, surveys, &c. These are not javascript functions. All of these can be (and are) implemented without JS. > but a component of the Firefox bug being reported here is that the extensions API used by uMatrix is failing to block GA in this particular case. uMatrix and uBlock Origin fail to block GA only when using their web extension versions.