7 ms·

Mozilla, if you ever read this: - when will you stop twitter from knowing all about youporn's user ? yes HN user, open your developer console and look out for

Mozilla, if you ever read this: - when will you stop twitter from knowing all about youporn's user ? yes HN user, open your developer console and look out for the cookie coming from syndication.twitter.com. If you ever try to visit http://syndication.twitter.com http://syndication.twitter.com, you end up on "Sorry, that page doesn’t exist!". - when will you ask for user permission before revealing hardware related information (via the screen object and navigator object)? I can't think of any use case to reveal how many core my computer has when js only use 1. Same for the screen object as we already have the window object. - when will you create a feature to dynamically update the user agent ? - when will you create a feature to trick browser fingerprinting ? - when will you enforce a no third party cookie by default? Especially for website that don't comply with the do not track header. Unfortunatly, our entire industry don't seem to care about the do not track header (funnily google is the rare good student in this area) I guess there's a lot more "industry standard" I'm not aware.

bzbarsky 8y ago
> when js only use 1. That's not true with web workers. And "How many workers should I spin up?" is a common question people actually using them want to answer... I'm highly sympathetic to reducing fingerprinting attack area, by the way; we should just be clear that providing sites less information does mean they can't do various performance optimizations, and in some cases can't even provide correct functionality. That tension is at the heart of all the anti-fingerprinting efforts browsers are involved in... Asking users for permission isn't really a solution either, unfortunately: all the bad actors will just spam permission prompts continuously. I've browsed before in a "prompt for attempts to set cookies" mode, back when Firefox had this feature. It wasn't pretty, even in the mid-2000s. > when will you enforce a no third party cookie by default? When it can be done without breaking too many users' day-to-day browsing. > Especially for website that don't comply with the do not track header How does one go about determining that? This is an honest question; I'm not aware of any database of sites that classifies them along this dimension. Dicslosure: I work on Firefox and various people including myself have been pushing for various anti-tracking bits for a while now. Some of them have shipped; others are in the works.
- tokyodude 8y ago
  I'm actually curious how useful fingerprinting is. One the one hand maybe your average enthusiast has a unique fingerprint. On the other every model of iPad/iPhone on the same OS version should have the same fingerprint as every other of the same model/OS. Also >> when will you enforce a no third party cookie by default? > > When it can be done without breaking too many users' day-to-day browsing. Doesn't Safari do this already? Isn't that proof that millions of users (every iPhone, iPad, and greater than 30% of all mac users) are having no real issues using the web with that in place?
  - Whitestrake 8y ago
    Are you asking how useful fingerprinting is, or are you asking how effective it is? For the former, any amount of fingerprinting lets ad companies make the case that their ads are better or worth more money. For the latter, the EFF Panopticlick research project seems to be pretty good at giving you an idea: https://panopticlick.eff.org/ https://panopticlick.eff.org/ I don't have an iPad/iPhone etc. to test Safari with; seems like they'd be amongst the most homogeneous of devices. Perhaps someone with one of those devices could tell us if the EFF can uniquely identify their device. It was able to uniquely identify all of my devices.
    - tokyodude 8y ago
      The panopticlick site is hyperbole (or in other words poorly implemented). Since no one visits it it will tell you an iPhoneX in Los Angeles is 1 in a million. Their site doesn't take IP into account it's only the taking what it can get from the phone. Timezone for example and then all the normal fingerprints. And yet every iPhoneX is exactly the same. Calculate the penetration of iPhoneX and it should be more like 1 in 100 or 1 in 33 or even one in 20 not 1 in a million. It expires data which make sense but any site wanting to actually track you would need to be on popular sites. As such it would need a unique fingerprint. It won't get one for an iPhoneX which I'm just using as an example. you can choose any popular device.
  - bzbarsky 8y ago
    > On the other every model of iPad/iPhone on the same OS version should have the same fingerprint Not quite. For example, they might be on different networks, have different zoom levels set, etc. > Doesn't Safari do this already? Last I checked, Safari "blocks" (not quite; it's double-keying, not actually blocking) some third-party cookies, but not all. In particular, it doesn't block third-party cookies from sites you have visited in a first-party context. So for example it doesn't block Facebook or Google trackers. The Firefox "no third party cookies" mode, which actually blocks all third-party cookies, is quite different from the Safari behavior...
staticassertion 8y ago
Have you filed bugs for these? Are you aware of open bugs?
- mickael-kerjean 8y ago
  No, no. When I did my research, I simply investigate on those "privacy extensions" but wasn't happy with any of those once you put them in the bench. I ended up in my garage for a week end making my own extension that was never publish as it makes my laptop running high in temperature everytime I end up on a streaming platform
  - Scottn1 8y ago
    Check out the newly released Privacy Possum. It is a "fork" of Privacy Badger and the author was also part of the Privacy Badger development. He makes a good case of why his form is different here: https://github.com/cowlicks/privacypossum https://github.com/cowlicks/privacypossum . I've been testing it out for few days now and it is doing something, though can't vouch for how much. I've also had good effect with Canvas Blocker. Decentraleyes is another good concept privacy add-on to look into as well.
the8472 8y ago
privacy.firstparty.isolate = true privacy.resistFingerprinting = true Throw in content blockers if you don't want the 3rd-party requests to happen at all instead of just compartmentalizing the tracking. > when will you create a feature to dynamically update the user agent ? Extensions can do that. Not everything needs to be in the core browser, does it?
- mickael-kerjean 8y ago
  Wasn't aware about those options, thanks! I think those features should be build by browser vendor. Why? Because pretty much all the existing extensions claiming to "protect privacy" are doing a poor job at it. They all rely on an internal database of "bad guys" as if it's technically possible to even build such a database. For example, Cloudflare already control a large amount of website through their CDN. They are sending cookies regardless of the do not track headers. I haven't seen 1 of those extensions blocking website using Cloudflare. The do not track header is also a funny joke that even the W3C doesn't respect (https://pbs.twimg.com/media/DWtqPzFUQAExO2h.jpg https://pbs.twimg.com/media/DWtqPzFUQAExO2h.jpg)
  - the8472 8y ago
    > They all rely on an internal database of "bad guys" Not all do. uMatrix comes with a whitelist-based approach, so all 3rd party requests (modulo images and CSS if you so choose) are blocked and need to be whitelisted to unbreak sites.
    - mickael-kerjean 8y ago
      I had quite a bit of those popular "privacy extensions" in the test bench: DuckDuckGo Privacy Essentials, Ghostery, Privacy Badger, Stealth mode and none of them were blocking things as I'd have expected. Thank you for proposing uMatrix it just pass the cookie test none of the above succeed, I might have found my new internet condom.
      - x0x 8y ago
Sylos 8y ago
Probably when they have large enough marketshare that they can afford to piss off webpage owners without those being able to stop supporting them.
- John_KZ 8y ago
  If they stopped trying to be like Chrome maybe the old users would return. Abruptly ending NPAPI support rubbed a lot of people the wrong way.
reitanqild 8y ago
> - when will you enforce a no third party cookie by default? In another comment you say: > on Chromium and Chrome there's a nice feature to block third party cookies. For obvious reason, it's not enabled by default but it's there and doesn't affect the performances. Why is this a problem when we are talking about Firefox but it's "obvious reason" with Chrome? Or am I misreading you?
- mickael-kerjean 8y ago
  Third party cookies is probably the most usefull technical foundation for creating trackers making mass surveillance a reality that's supposed to benefit the advertising industry. As opposed to Chrome, This industry isn't Mozilla business

bzbarsky 8y ago

> when js only use 1. That's not true with web workers. And "How many workers should I spin up?" is a common question people actually using them want to answer... I'm highly sympathetic to reducing fingerprinting attack area, by the way; we should just be clear that providing sites less information does mean they can't do various performance optimizations, and in some cases can't even provide correct functionality. That tension is at the heart of all the anti-fingerprinting efforts browsers are involved in... Asking users for permission isn't really a solution either, unfortunately: all the bad actors will just spam permission prompts continuously. I've browsed before in a "prompt for attempts to set cookies" mode, back when Firefox had this feature. It wasn't pretty, even in the mid-2000s. > when will you enforce a no third party cookie by default? When it can be done without breaking too many users' day-to-day browsing. > Especially for website that don't comply with the do not track header How does one go about determining that? This is an honest question; I'm not aware of any database of sites that classifies them along this dimension. Dicslosure: I work on Firefox and various people including myself have been pushing for various anti-tracking bits for a while now. Some of them have shipped; others are in the works.

tokyodude 8y ago
I'm actually curious how useful fingerprinting is. One the one hand maybe your average enthusiast has a unique fingerprint. On the other every model of iPad/iPhone on the same OS version should have the same fingerprint as every other of the same model/OS. Also >> when will you enforce a no third party cookie by default? > > When it can be done without breaking too many users' day-to-day browsing. Doesn't Safari do this already? Isn't that proof that millions of users (every iPhone, iPad, and greater than 30% of all mac users) are having no real issues using the web with that in place?
- Whitestrake 8y ago
  Are you asking how useful fingerprinting is, or are you asking how effective it is? For the former, any amount of fingerprinting lets ad companies make the case that their ads are better or worth more money. For the latter, the EFF Panopticlick research project seems to be pretty good at giving you an idea: https://panopticlick.eff.org/ https://panopticlick.eff.org/ I don't have an iPad/iPhone etc. to test Safari with; seems like they'd be amongst the most homogeneous of devices. Perhaps someone with one of those devices could tell us if the EFF can uniquely identify their device. It was able to uniquely identify all of my devices.
  - tokyodude 8y ago
    The panopticlick site is hyperbole (or in other words poorly implemented). Since no one visits it it will tell you an iPhoneX in Los Angeles is 1 in a million. Their site doesn't take IP into account it's only the taking what it can get from the phone. Timezone for example and then all the normal fingerprints. And yet every iPhoneX is exactly the same. Calculate the penetration of iPhoneX and it should be more like 1 in 100 or 1 in 33 or even one in 20 not 1 in a million. It expires data which make sense but any site wanting to actually track you would need to be on popular sites. As such it would need a unique fingerprint. It won't get one for an iPhoneX which I'm just using as an example. you can choose any popular device.
- bzbarsky 8y ago
  > On the other every model of iPad/iPhone on the same OS version should have the same fingerprint Not quite. For example, they might be on different networks, have different zoom levels set, etc. > Doesn't Safari do this already? Last I checked, Safari "blocks" (not quite; it's double-keying, not actually blocking) some third-party cookies, but not all. In particular, it doesn't block third-party cookies from sites you have visited in a first-party context. So for example it doesn't block Facebook or Google trackers. The Firefox "no third party cookies" mode, which actually blocks all third-party cookies, is quite different from the Safari behavior...

staticassertion 8y ago

Have you filed bugs for these? Are you aware of open bugs?

mickael-kerjean 8y ago
No, no. When I did my research, I simply investigate on those "privacy extensions" but wasn't happy with any of those once you put them in the bench. I ended up in my garage for a week end making my own extension that was never publish as it makes my laptop running high in temperature everytime I end up on a streaming platform
- Scottn1 8y ago
  Check out the newly released Privacy Possum. It is a "fork" of Privacy Badger and the author was also part of the Privacy Badger development. He makes a good case of why his form is different here: https://github.com/cowlicks/privacypossum https://github.com/cowlicks/privacypossum . I've been testing it out for few days now and it is doing something, though can't vouch for how much. I've also had good effect with Canvas Blocker. Decentraleyes is another good concept privacy add-on to look into as well.

the8472 8y ago

privacy.firstparty.isolate = true privacy.resistFingerprinting = true Throw in content blockers if you don't want the 3rd-party requests to happen at all instead of just compartmentalizing the tracking. > when will you create a feature to dynamically update the user agent ? Extensions can do that. Not everything needs to be in the core browser, does it?

mickael-kerjean 8y ago
Wasn't aware about those options, thanks! I think those features should be build by browser vendor. Why? Because pretty much all the existing extensions claiming to "protect privacy" are doing a poor job at it. They all rely on an internal database of "bad guys" as if it's technically possible to even build such a database. For example, Cloudflare already control a large amount of website through their CDN. They are sending cookies regardless of the do not track headers. I haven't seen 1 of those extensions blocking website using Cloudflare. The do not track header is also a funny joke that even the W3C doesn't respect (https://pbs.twimg.com/media/DWtqPzFUQAExO2h.jpg https://pbs.twimg.com/media/DWtqPzFUQAExO2h.jpg)
- the8472 8y ago
  > They all rely on an internal database of "bad guys" Not all do. uMatrix comes with a whitelist-based approach, so all 3rd party requests (modulo images and CSS if you so choose) are blocked and need to be whitelisted to unbreak sites.
  - mickael-kerjean 8y ago
    I had quite a bit of those popular "privacy extensions" in the test bench: DuckDuckGo Privacy Essentials, Ghostery, Privacy Badger, Stealth mode and none of them were blocking things as I'd have expected. Thank you for proposing uMatrix it just pass the cookie test none of the above succeed, I might have found my new internet condom.
    - x0x 8y ago

Sylos 8y ago

Probably when they have large enough marketshare that they can afford to piss off webpage owners without those being able to stop supporting them.

John_KZ 8y ago
If they stopped trying to be like Chrome maybe the old users would return. Abruptly ending NPAPI support rubbed a lot of people the wrong way.

reitanqild 8y ago

> - when will you enforce a no third party cookie by default? In another comment you say: > on Chromium and Chrome there's a nice feature to block third party cookies. For obvious reason, it's not enabled by default but it's there and doesn't affect the performances. Why is this a problem when we are talking about Firefox but it's "obvious reason" with Chrome? Or am I misreading you?

mickael-kerjean 8y ago
Third party cookies is probably the most usefull technical foundation for creating trackers making mass surveillance a reality that's supposed to benefit the advertising industry. As opposed to Chrome, This industry isn't Mozilla business