3 ms·
An opinion: The most serious threats to user privacy from advertising companies are the "features" of the browser that allow data to be sent to or from the user
by feelin_googley 9y ago
An opinion: The most serious threats to user privacy from advertising companies are the "features" of the browser that allow data to be sent to or from the users computer without any input from the user. In other words, the features that let developers of websites trigger GET and POST, to "push" media to the users computer and allowing "pulling" user data indiscrinately, without explicit consent and sometimes without the knowledge of the user.
For example, there is the feature of automatically loading resources, such as images. No user input required. There is the feature of automatically loading the contents of iframes. No user input required. There is the feature of cookie headers sent automatically. No user input required. There is the feature of XMLHttpRequest triggered through Javascript. No user input required. There is support for HTTP/2. Imagine websites pushing media to users computers with greater efficiency than ever before (advertisers rejoice). No user input required.
If one is serious about regaining control over the sending of user data to these corporations and websites ("privacy"), then IMO one needs a browser that either lacks or can disable the features above and any others that allow media to be "pushed" to the user without any user input. Such a browser would only execute GET or POST upon user input, not upon input from other sources, such as websites.
Perhaps users could have two browsers: one for commercial activity and running "web apps" and another for non-commercial activity, which may not need to be default compatible with "web apps" that push media to the user. This is an alternative to having to become an expert in browser settings.
Instead of disabling features or installing add-ons, the later browser is incapable of pushing unsolicited media or leaking user data because it lacks the necessary features to do so. (I have been using such a browser for many years now. While this is probably not for everybody, I like it.)
- cjcfjrf 9y agoCheck out umatrix, from the creator of unlock origin and original creator of unlock
- lucideer 9y agoThis is a great post, and is exactly the line I've been thinking along for a long time. I currently use uMatrix for this and it implements this almost perfectly. However, it's scope is too narrow: it only controls requests within the webpage, so doesn't have access to it many requests the browser will make outside of that scope. If you start by broadening the scope from webpage to browser, you eventually get to the operating system level, at which point we're really just talking about a firewall/proxy tool with granular control. I've used things like privoxy and proxomitron for this in the past; little snitch is the best I've used in terms of UX and control, but it's still nowhere near as good as the uMatrix interface. There are a number of challenges with making such a tool, the primary two being: (1) mitming secure connections, (2) contextual control, differentiating iframe, js, css, image, etc. requests becomes more difficult once you're working at a global level. Given these limitations, uMatrix in combination with a good, strict about:config that allows granular control over everything may be the best we can ask for in the short term.
- cinquemb 9y ago>… so doesn't have access to it many requests the browser will make outside of that scope. You have access if you chose to modify/recompile the .cpp/.rs files that deal with sending requests that those higher level functions use, this is what I do. Some particular places of interest on /mozilla-central/: - /servo/components/style/gecko/urls.rs, will pertain to calls called from css image functions - /netwerk/protocol/http/nsHttpHandler.cpp, some classess that deal with handling things related to sending all http requests
- feelin_googley 9y agoTo clarify, you are modifying and recompiling a Mozilla browser from source?
- cinquemb 9y agoCorrect. If anyone else is interested you can get started here and modify things for yourself for your own purposes [0]. [0] https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions https://developer.mozilla.org/en-US/docs/Mozilla/Developer_g...
- severine 9y ago>it only controls requests within the webpage, so doesn't have access to it many requests the browser will make outside of that scope. You also have the "behind the scene" settings: https://github.com/gorhill/uBlock/wiki/Behind-the-scene-network-requests https://github.com/gorhill/uBlock/wiki/Behind-the-scene-netw... That's for uBlock Origin but I seem to recall it works similarly in uMatrix (can't check now).
- lucideer 9y agoWow. That's not a feature I was aware of at all. My only concern here is: does the extensions API used by this feature definitely cover all requests made by the browser. e.g. I don't see requests to geolocation services from the Navigator.geolocation API, Google Safe Browsing or CT auditing included in the list of example request types there.