5 ms·

Are there any usable solutions for end-users besides wholesale blocking of ad/analytics/tracker services? With all this, it seems pretty reasonable to assume al

Are there any usable solutions for end-users besides wholesale blocking of ad/analytics/tracker services? With all this, it seems pretty reasonable to assume all third-party elements on the web are hostile.

kevin_thibedeau 9y ago
NoScript + self destructing cookies.
the8472 9y ago
All solutions break things to some extent by design. So "usable" would be quite subjective.
ve55 9y ago
Those sound like the perfect usable solutions. Do not run code on your machine (Javascript) unless you want it to be ran. The only good way to do that if you use a modern browser is using extensions to help you do it. It's definitely true that most third-party Javascript is not good for you, and just tracks you in malicious ways, slowing down your browser and putting your data at risk.
watsocd 9y ago
Never use the "Login with Facebook" or any other 3rd party login method. Create a separate account on the site if you need to log in.
- underwater 9y ago
  If a script running on the page wants to scrape your data then creating a new account isn’t going to protect you. In fact it’s probably worse, because the malicious script can sniff your login details.
- albemuth 9y ago
  There's a few sites I continue to log in with facebook, I just make sure to use an incognito window and close it when I'm done.
  - wheelie_boy 9y ago
    Same here, I always use an incognito window for facebook.
scrupulusalbion 9y ago
>it seems pretty reasonable to assume all third-party elements on the web are hostile. The trouble is that a lot of good and bad JS/CSS/content is gotten from third-party sites. Some websites are simply useless unless your browser loads third-party JS (e.g. Bootstrap). The ability to load third-party code/content is built into HTML and web developers naturally take advantage of that capability.
- paulie_a 9y ago
  Then it is time to stop using those websites.
  - IncRnd 9y ago
    Every time this subject has come up on this site, and someone has mentioned to use the extension NoScript, they've been down voted to oblivion.
    - pferde 9y ago
      Maybe because uMatrix is much better at the job than NoScript? :) But yeah, there seems to be a lot of animosity towards the idea of blocking javascript here. Maybe because there is a lot of webdevelopers visiting this site, and they instinctively react when someone is trying to take their toys away.
      - robin_reala 9y ago
        #notallwebdevelopers. Progressive enhancement is a reliability mechanism, not a throwback.
      - IncRnd 9y ago
        Yep, I wrote NoScript, but I actually meant script blocking. :) For some time now, I've used ublock origin, which I find better overall than umatrix.
- acqq 9y ago
andrewaylett 9y ago
Firefox's multi-account containers (and/or first-party isolation) would go some way towards helping, in that Facebook's cookies wouldn't be available to tabs not opened in that container. That helps with the "embed an iframe to steal data" case, but not with the "user logged into a site that includes malicious third-party JS" case. Privacy Badger assumes that third-party scripts used by more than one first party are potential trackers and blocks them by default, except common CDNs which just get cookies blocked. It's pretty usable: doesn't break nearly as much stuff as NoScript et al, and unlike an ad-blocker only blocks ads that track.

kevin_thibedeau 9y ago

NoScript + self destructing cookies.

the8472 9y ago

All solutions break things to some extent by design. So "usable" would be quite subjective.

ve55 9y ago

Those sound like the perfect usable solutions. Do not run code on your machine (Javascript) unless you want it to be ran. The only good way to do that if you use a modern browser is using extensions to help you do it. It's definitely true that most third-party Javascript is not good for you, and just tracks you in malicious ways, slowing down your browser and putting your data at risk.

watsocd 9y ago

Never use the "Login with Facebook" or any other 3rd party login method. Create a separate account on the site if you need to log in.

underwater 9y ago
If a script running on the page wants to scrape your data then creating a new account isn’t going to protect you. In fact it’s probably worse, because the malicious script can sniff your login details.
albemuth 9y ago
There's a few sites I continue to log in with facebook, I just make sure to use an incognito window and close it when I'm done.
- wheelie_boy 9y ago
  Same here, I always use an incognito window for facebook.

scrupulusalbion 9y ago

>it seems pretty reasonable to assume all third-party elements on the web are hostile. The trouble is that a lot of good and bad JS/CSS/content is gotten from third-party sites. Some websites are simply useless unless your browser loads third-party JS (e.g. Bootstrap). The ability to load third-party code/content is built into HTML and web developers naturally take advantage of that capability.

paulie_a 9y ago
Then it is time to stop using those websites.
- IncRnd 9y ago
  Every time this subject has come up on this site, and someone has mentioned to use the extension NoScript, they've been down voted to oblivion.
  - pferde 9y ago
    Maybe because uMatrix is much better at the job than NoScript? :) But yeah, there seems to be a lot of animosity towards the idea of blocking javascript here. Maybe because there is a lot of webdevelopers visiting this site, and they instinctively react when someone is trying to take their toys away.
    - robin_reala 9y ago
      #notallwebdevelopers. Progressive enhancement is a reliability mechanism, not a throwback.
    - IncRnd 9y ago
      Yep, I wrote NoScript, but I actually meant script blocking. :) For some time now, I've used ublock origin, which I find better overall than umatrix.
acqq 9y ago

andrewaylett 9y ago

Firefox's multi-account containers (and/or first-party isolation) would go some way towards helping, in that Facebook's cookies wouldn't be available to tabs not opened in that container. That helps with the "embed an iframe to steal data" case, but not with the "user logged into a site that includes malicious third-party JS" case. Privacy Badger assumes that third-party scripts used by more than one first party are potential trackers and blocks them by default, except common CDNs which just get cookies blocked. It's pretty usable: doesn't break nearly as much stuff as NoScript et al, and unlike an ad-blocker only blocks ads that track.