6 ms·

Hi all, I'm an engineer working on Firefox Platform (Gecko). In the linked blog post, the author recommends Firefox (thanks!) and links to a "privacy recommend

Hi all, I'm an engineer working on Firefox Platform (Gecko). In the linked blog post, the author recommends Firefox (thanks!) and links to a "privacy recommendations" for it, which include items such as "resistFingerprinting" settings. I'd like to remind everyone that turning on this setting has far fetched consequences to how you experience the Web. Your dates, timezones, preferred languages will all be masked which will result in weird experiences. The option is behind a flag and without UI precisely because it is a pretty complex feature, that we didn't iron out yet, and which should be well understood before being used. It concerns me to see it being references and recommended without any explanation whatsoever. Of course I'm likely biased because I'm on the receiving end of bug reports from people who experience the Web in weird languages and with wrong timezones because they followed some tutorial that recommended it. :(

chime 8y ago
Is there a moderate resistFingerprinting setting? I don't mind my date/tz/language being known. There are 150m+ people living in my timezone who use en-US. I don't want my fonts, plugins, user agent, or detailed HW/graphics features (e.g. canvas/WebGL hash) being known. Those can uniquely identify me according to https://panopticlick.eff.org https://panopticlick.eff.org.
- shawn 8y ago
  Those can uniquely identify me So does your resolution. And that's hard to mask because JS usually needs to know it. If you're not using the browser fullscreen, chances are that you're using a unique innerWidth+innerHeight. As unsatisfying as it is, the current best solution seems to be not to care about privacy most of the time, and then take privacy seriously when you do. Whonix is excellent for this.
  - hueving 8y ago
    Your resolution alone will not likely uniquely identify you. The idea is to eliminate many of the data points that make it easy to track you across IPs. Resolution is very common if you're browsing with a maximized window so it's not in the same league as these others that quickly diverge amongst users.
    - shawn 8y ago
      No, not alone. But if you're not masking your IP address, it probably will. Weirdly, I tried to measure how unique my window.innerWidth/Height was, but panopticlick no longer seems to measure this. It only uses my full screen resolution, which of course is much less unique than canvas dimensions.
      - tenpaiyomi 8y ago
        > No, not alone. But if you're not masking your IP address, it probably will. If you're not masking your IP, resolution and anything else is largely irrelevant for tracking you.
  - oneeyedpigeon 8y ago
    > JS usually needs to know it What do you mean by this?
    - icebraining 8y ago
      JS is often used to change the position of elements based on the window size. If you give it wrong info, it will break the layout.
      - beagle3 8y ago
        True, but if you round it down to the closest multiple of (say) 32, you significantly reduce the information content while leaving JS/CSS layout essentially the same. Indeed, it will surely make resize look less sexy (jumping by 32s instead of pixels), and you might waste a few pixels of screen real estate on some sites at some times -- but it's the kind of tradeoff that some people happily do for more privacy. Related, does anyone know if privacy badger include "screen size determination" in its heuristics?
        deleted 8y ago
        [deleted]
      - oneeyedpigeon 8y ago
        I can't imagine that's 'usual'; most sites will do absolute positioning in css, if at all. As you suggest, trying to layout pixel-by-pixel designs is notoriously awkward and best avoided.
        michaelmior 8y ago
        You could still do fingerprinting for resolution based on media queries in CSS.
        icebraining 8y ago
        I'm not talking about absolute positioning, but calculating positions and width/length based on rules (like the browser does with CSS, but for stuff the browser can't do). For example: https://css-tricks.com/scaled-proportional-blocks-with-css-and-javascript/ https://css-tricks.com/scaled-proportional-blocks-with-css-a...
  - Xylakant 8y ago
    The Tor Plugin sets the window sizes to predefined values that match various fullscreen resolutions. So there are options, but they all involve tradeoffs.
  - amelius 8y ago
    If fingerprinting uses a hash based on a number of input criteria, then you only need to perturb one of those inputs to make the entire hash unusable. Perhaps Firefox is perturbing the other inputs (?) such that screen resolution doesn't matter much. (Just guessing and looking for a positive angle here).
    - duggan 8y ago
      True, but that's assuming inputs go to a hash rather than something more robust like a probability function.
    - nothrabannosir 8y ago
      I had to work on fingerprinting (not my proudest moment) and disabling hashing to avoid this problem was literally the very first thing we did. Just a datapoint, of course.
    - ska 8y ago
      It's hard to imagine any non-toy implementation of fingerprinting doing anything that naive, really.
  - Ntrails 8y ago
    But I resize my browser all the time? Even with timezone + language surely it's a very short lived fingerprint? When it's not manually sized it's snapped to either side of a standard screen. idk - it seems like that can't be enough?
  - everdrive 8y ago
    Don't huge swaths of people have the same resolution, though? Yes, I understand other things come into play here (OS, Browser, available plugins, etc) but I am skeptical that people are really building UUIDs based on someone's screen resolution. Or, if they are, that such IDs are meaningfully accurate.
    - uxp100 8y ago
      Not if the browser is not full screen, this is resolution/size of browser window.
      - helb 8y ago
        Nope, you can get the screen size, too: > window.outerWidth 1168 > screen.width 1920
    - tripzilch 8y ago
      It's all about the bits. You need 33 bits to identify 8 billion people. All that is required is for these bits to be independently uniformly distributed. Say everybody uses one of four resolutions equally. That's two bits: 00, 01, 10 and 11. Now let's say that people's gender is also binary, distributed 50/50 and independent from what resolution someone uses. You can just tack that bit onto the two you already got and now you have three (the ability to distinguish between 2^3 = 8 individuals). I won't go into the details, but if you have an estimate for the probability distribution of browser resolutions, it's fairly easy to extract the proper amount of bits of entropy. Being independent is a bit harder to make sure of, but as long as you pick things which aren't too obviously correlated, you can just take a safety margin and use, say, 40 bits to identify people, and it's probably fine (and for tracking purposes, a false positive isn't the end of the world, either). That said, while I support the concept and idea behind panopticlick, I've always felt it overestimated the unicity of my browser. Or maybe I just really underestimate it myself. I don't know.
  - C4stor 8y ago
    Assuming there's 4k possibilities for width and 2k for height, that's 8 millions possibilities right here. Compared to ~2 billions of people accessing the internet, the odds of having a unique one seems really really low.
    - CydeWeys 8y ago
      It's one of many different data points that can be used to identify you though, and if you aren't full screen at a standard resolution then it's a very good one.
    - michaelmior 8y ago
      Of course keeping in mind that a good number of those will rarely be seen. (e.g. anything less than 100px)
  - _jal 8y ago
    > As unsatisfying as it is, the current best solution seems to be not to care about privacy most of the time, and then take privacy seriously when you do. Whonix is excellent for this. No offense, but advice like this is useless. It reduces to, "someone I don't know thinks the average person with no special risk factors should think this way about their personal privacy based on who knows what priors." Different people have different reactions to risk, have different actual exposures to risks, different competencies, and different tolerances for the hassles of opsec. And potential future risks of data slopping about are unknown. There is no such thing as a "best solution" when talking about this.
- gregn610 8y ago
  That https://panopticlick.eff.org https://panopticlick.eff.org link was interesting, but I don't see what about my user agent string makes it so unique (1: 76540.09) ? Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.62 Safari/537.36 Looks fairly generic, I think I'm running a mainstream chrome browser on a mainstream OS.
  - Tepix 8y ago
    Using Javascript the page can query more details about the environment including installed plugins, addons, configuration settings (language etc), certificates and fonts. That combination is often unique.
  - Matt3o12_ 8y ago
    One problem is that your user agent is matched against all tested user agents from all times. This includes very old ones. If the user agent was used to track you online, they would account for that it frequently updates and for a lot of users (considering that most browsers update automatically these days). So the site should really only take into account your OS, maybe its major version, and browser version (which changes frequently so trackers can’t rely on that). Or at least not count any that are not used anymore.
  - RobertRoberts 8y ago
    This is amazing, I use Ghostery, Privacy Badger and Scriptsafe in Firefox, and I was MORE private in non-private window! wth? I suspect it's partly because these plugins don't function fully in a private window?
craftyguy 8y ago
Yea, maybe you should prioritize 'ironing' it out.
- Xylakant 8y ago
  I’m certain they’ll accept help. So maybe go test, report bugs and issues and get involved if that’s a priority for you. Triage some of those weird bug reports. Write a guide on how to properly enable the feature, what it does and what to expect if it’s enabled. Explain what’s a bug and what’s just part of the expected - and sometimes annoying - behavior. Or just donate if you can’t do any of those things.
- edanm 8y ago
  Prioritize it over the probably 1,000s of other things they have to do, which we might not have any idea about? Just because one person was kind enough to try to help people with a short cautionary message, therefore bringing this specific issue to our attention?
- some_account 8y ago
  This feature is not even part of the UI yet. It's in progress. I really don't understand why technical people would start recommending its use to others on blogs in its current state. All you create is lots of bug reports coming in to Mozilla, forcing them to put resources into responding to users who blindly followed the blog and now their Firefox is "not working" anymore.
  - Sir_Substance 8y ago
    >I really don't understand why technical people would start recommending its use to others on blogs in its current state. Because when ordinary users ask "what can I do to protect my privacy?" you have two possible answers: a) "Nothing, you're not smart enough to do this, you're screwed" b) "These things" B has a high learning curve, but telling people about it scares them off. If you care about your friends privacy and want to get them past that learning curve, it's better to let them stumble into issues and be there to answer questions.
Tepix 8y ago
If Firefox really cared more about privacy than about its money flow they would have disabled 3rd party cookies by default instead of explicitly hiding¹ that setting. Apple can do it. There's no reason why Firefox can't. And if there is a reason, it should have been dealt with years ago. -- ¹ i just noticed that in Firefox 60, the setting is no longer as hidden as it used to be. Good!
- cm2012 8y ago
  Most casual users would be quite upset if cookies stopped working. "Why does this site not stay logged in"? Etc.
  - cosarara 8y ago
    Not all cookies, just 3rd party ones.
  - aljones 8y ago
    You think Apple is upsetting casual users?
amelius 8y ago
By the way, what does GDPR say about fingerprinting? Is it legal? (Asking because the EU explicitly made cookies an opt-in technique, but not sure if they considered fingerprinting).
- 4ad 8y ago
  The EU did not make cookies an opt-in technique. The EU made irrelevant cookies opt-in. Cookies that are essential for the functioning of the service do not need a notice. If you require user accounts, you don't need to show a cookie notice. If you implement a shopping cart without user accounts, you also don't need to show a cookie notice. Unfortunately most websites don't understand this simple idea and show the cookie notice indiscriminately (or, perhaps, they just all use cookies for tracking in which case the notice should be there).
  - jazoom 8y ago
    Probably most websites use Google Analytics or an alternative.
    - seanwilson 8y ago
      > Probably most websites use Google Analytics or an alternative. How is this not essential though? You can't effectively run a business without some understanding of your traffic and where it's coming from. Also, you can use Google Analytics in a way that doesn't store PII.
      - jazoom 8y ago
        I could run the business just fine without Google Analytics. Would just be in the dark a bit more. I'm not associated with EU so I haven't pondered on this as much as others. My first thought is that this should really be up to the browsers and their users on what info Analytics software is able to work out just from the user being on the page. Users should just assume that every business will absorb all available information. At least then we wouldn't see those ridiculous cookie notices everywhere. As a web developer, I'm kinda surprised 3rd party cookies ever became a thing in the first place.
deleted 8y ago
[deleted]
oldcynic 8y ago
After the constant succession of revelations of the sorry state of privacy, along with myriad data breaches, all I want a browser to do is lie and obfuscate. So I'll gladly take the sledgehammer boolean of resistFingerprinting for now. I've yet to come across an extension that does something like this so I'm presuming it's not possible via extensions? Are Mozilla working to make this more granular and let me whitelist individual features on a per site basis? I'd far rather lose tracking than get the very minor benefit of a (slow loading) web font or en-GB over en-US. Especially if I can opt in the few I trust or need those features.
- Skunkleton 8y ago
  > After the constant succession of revelations of the sorry state of privacy, along with myriad data breaches... I remember reading an article about how Richard Stallman interacts with the internet a while back. I remember thinking that it seemed totally insane. But in light of the reality of 2018, I am coming around. The way I see it, I can keep tweaking privacy settings in a browser, or opting out of collection, or doing any number of other things to attempt to protect my privacy, _or_ I could just stop using services that do not respect my privacy in the first place. Perhaps certain aspects of modern life have taken too much, and they need to be abandoned until they are reformed?
  - pieterr 8y ago
    > I remember reading an article about how Richard Stallman interacts with the internet a while back. One of these you mean? [1] https://news.ycombinator.com/item?id=16869515 https://news.ycombinator.com/item?id=16869515 [2] https://stallman.org/stallman-computing.html https://stallman.org/stallman-computing.html
    - Skunkleton 8y ago
      It was directly related to #2, but I only made it there as a result of reading some other article. It has been a while and I don't remember the source.
  - 8y ago
prophesi 8y ago
I don't know, I think if a user is following all of the steps in this article, they likely know what fingerprinting is. Running an Android device without the Play Store, for example, is by far a much more difficult & complicated thing to do than just toggling a flag in a Firefox browser. That, and the user is likely used to having less-than-ideal browsing experiences if they run any adblockers. I do agree that the article should outline what the consequences would be for disabling browser fingerprinting; they simply have one sentence recommending it, and nothing else.

chime 8y ago

Is there a moderate resistFingerprinting setting? I don't mind my date/tz/language being known. There are 150m+ people living in my timezone who use en-US. I don't want my fonts, plugins, user agent, or detailed HW/graphics features (e.g. canvas/WebGL hash) being known. Those can uniquely identify me according to https://panopticlick.eff.org https://panopticlick.eff.org.

shawn 8y ago
Those can uniquely identify me So does your resolution. And that's hard to mask because JS usually needs to know it. If you're not using the browser fullscreen, chances are that you're using a unique innerWidth+innerHeight. As unsatisfying as it is, the current best solution seems to be not to care about privacy most of the time, and then take privacy seriously when you do. Whonix is excellent for this.
- hueving 8y ago
  Your resolution alone will not likely uniquely identify you. The idea is to eliminate many of the data points that make it easy to track you across IPs. Resolution is very common if you're browsing with a maximized window so it's not in the same league as these others that quickly diverge amongst users.
  - shawn 8y ago
    No, not alone. But if you're not masking your IP address, it probably will. Weirdly, I tried to measure how unique my window.innerWidth/Height was, but panopticlick no longer seems to measure this. It only uses my full screen resolution, which of course is much less unique than canvas dimensions.
    - tenpaiyomi 8y ago
      > No, not alone. But if you're not masking your IP address, it probably will. If you're not masking your IP, resolution and anything else is largely irrelevant for tracking you.
- oneeyedpigeon 8y ago
  > JS usually needs to know it What do you mean by this?
  - icebraining 8y ago
    JS is often used to change the position of elements based on the window size. If you give it wrong info, it will break the layout.
    - beagle3 8y ago
      True, but if you round it down to the closest multiple of (say) 32, you significantly reduce the information content while leaving JS/CSS layout essentially the same. Indeed, it will surely make resize look less sexy (jumping by 32s instead of pixels), and you might waste a few pixels of screen real estate on some sites at some times -- but it's the kind of tradeoff that some people happily do for more privacy. Related, does anyone know if privacy badger include "screen size determination" in its heuristics?
      - deleted 8y ago
        [deleted]
    - oneeyedpigeon 8y ago
      I can't imagine that's 'usual'; most sites will do absolute positioning in css, if at all. As you suggest, trying to layout pixel-by-pixel designs is notoriously awkward and best avoided.
      - michaelmior 8y ago
        You could still do fingerprinting for resolution based on media queries in CSS.
      - icebraining 8y ago
        I'm not talking about absolute positioning, but calculating positions and width/length based on rules (like the browser does with CSS, but for stuff the browser can't do). For example: https://css-tricks.com/scaled-proportional-blocks-with-css-and-javascript/ https://css-tricks.com/scaled-proportional-blocks-with-css-a...
- Xylakant 8y ago
  The Tor Plugin sets the window sizes to predefined values that match various fullscreen resolutions. So there are options, but they all involve tradeoffs.
- amelius 8y ago
  If fingerprinting uses a hash based on a number of input criteria, then you only need to perturb one of those inputs to make the entire hash unusable. Perhaps Firefox is perturbing the other inputs (?) such that screen resolution doesn't matter much. (Just guessing and looking for a positive angle here).
  - duggan 8y ago
    True, but that's assuming inputs go to a hash rather than something more robust like a probability function.
  - nothrabannosir 8y ago
    I had to work on fingerprinting (not my proudest moment) and disabling hashing to avoid this problem was literally the very first thing we did. Just a datapoint, of course.
  - ska 8y ago
    It's hard to imagine any non-toy implementation of fingerprinting doing anything that naive, really.
- Ntrails 8y ago
  But I resize my browser all the time? Even with timezone + language surely it's a very short lived fingerprint? When it's not manually sized it's snapped to either side of a standard screen. idk - it seems like that can't be enough?
- everdrive 8y ago
  Don't huge swaths of people have the same resolution, though? Yes, I understand other things come into play here (OS, Browser, available plugins, etc) but I am skeptical that people are really building UUIDs based on someone's screen resolution. Or, if they are, that such IDs are meaningfully accurate.
  - uxp100 8y ago
    Not if the browser is not full screen, this is resolution/size of browser window.
    - helb 8y ago
      Nope, you can get the screen size, too: > window.outerWidth 1168 > screen.width 1920
  - tripzilch 8y ago
    It's all about the bits. You need 33 bits to identify 8 billion people. All that is required is for these bits to be independently uniformly distributed. Say everybody uses one of four resolutions equally. That's two bits: 00, 01, 10 and 11. Now let's say that people's gender is also binary, distributed 50/50 and independent from what resolution someone uses. You can just tack that bit onto the two you already got and now you have three (the ability to distinguish between 2^3 = 8 individuals). I won't go into the details, but if you have an estimate for the probability distribution of browser resolutions, it's fairly easy to extract the proper amount of bits of entropy. Being independent is a bit harder to make sure of, but as long as you pick things which aren't too obviously correlated, you can just take a safety margin and use, say, 40 bits to identify people, and it's probably fine (and for tracking purposes, a false positive isn't the end of the world, either). That said, while I support the concept and idea behind panopticlick, I've always felt it overestimated the unicity of my browser. Or maybe I just really underestimate it myself. I don't know.
- C4stor 8y ago
  Assuming there's 4k possibilities for width and 2k for height, that's 8 millions possibilities right here. Compared to ~2 billions of people accessing the internet, the odds of having a unique one seems really really low.
  - CydeWeys 8y ago
    It's one of many different data points that can be used to identify you though, and if you aren't full screen at a standard resolution then it's a very good one.
  - michaelmior 8y ago
    Of course keeping in mind that a good number of those will rarely be seen. (e.g. anything less than 100px)
- _jal 8y ago
  > As unsatisfying as it is, the current best solution seems to be not to care about privacy most of the time, and then take privacy seriously when you do. Whonix is excellent for this. No offense, but advice like this is useless. It reduces to, "someone I don't know thinks the average person with no special risk factors should think this way about their personal privacy based on who knows what priors." Different people have different reactions to risk, have different actual exposures to risks, different competencies, and different tolerances for the hassles of opsec. And potential future risks of data slopping about are unknown. There is no such thing as a "best solution" when talking about this.
gregn610 8y ago
That https://panopticlick.eff.org https://panopticlick.eff.org link was interesting, but I don't see what about my user agent string makes it so unique (1: 76540.09) ? Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.62 Safari/537.36 Looks fairly generic, I think I'm running a mainstream chrome browser on a mainstream OS.
- Tepix 8y ago
  Using Javascript the page can query more details about the environment including installed plugins, addons, configuration settings (language etc), certificates and fonts. That combination is often unique.
- Matt3o12_ 8y ago
  One problem is that your user agent is matched against all tested user agents from all times. This includes very old ones. If the user agent was used to track you online, they would account for that it frequently updates and for a lot of users (considering that most browsers update automatically these days). So the site should really only take into account your OS, maybe its major version, and browser version (which changes frequently so trackers can’t rely on that). Or at least not count any that are not used anymore.
- RobertRoberts 8y ago
  This is amazing, I use Ghostery, Privacy Badger and Scriptsafe in Firefox, and I was MORE private in non-private window! wth? I suspect it's partly because these plugins don't function fully in a private window?

craftyguy 8y ago

Yea, maybe you should prioritize 'ironing' it out.

Xylakant 8y ago
I’m certain they’ll accept help. So maybe go test, report bugs and issues and get involved if that’s a priority for you. Triage some of those weird bug reports. Write a guide on how to properly enable the feature, what it does and what to expect if it’s enabled. Explain what’s a bug and what’s just part of the expected - and sometimes annoying - behavior. Or just donate if you can’t do any of those things.
edanm 8y ago
Prioritize it over the probably 1,000s of other things they have to do, which we might not have any idea about? Just because one person was kind enough to try to help people with a short cautionary message, therefore bringing this specific issue to our attention?
some_account 8y ago
This feature is not even part of the UI yet. It's in progress. I really don't understand why technical people would start recommending its use to others on blogs in its current state. All you create is lots of bug reports coming in to Mozilla, forcing them to put resources into responding to users who blindly followed the blog and now their Firefox is "not working" anymore.
- Sir_Substance 8y ago
  >I really don't understand why technical people would start recommending its use to others on blogs in its current state. Because when ordinary users ask "what can I do to protect my privacy?" you have two possible answers: a) "Nothing, you're not smart enough to do this, you're screwed" b) "These things" B has a high learning curve, but telling people about it scares them off. If you care about your friends privacy and want to get them past that learning curve, it's better to let them stumble into issues and be there to answer questions.

Tepix 8y ago

If Firefox really cared more about privacy than about its money flow they would have disabled 3rd party cookies by default instead of explicitly hiding¹ that setting. Apple can do it. There's no reason why Firefox can't. And if there is a reason, it should have been dealt with years ago. -- ¹ i just noticed that in Firefox 60, the setting is no longer as hidden as it used to be. Good!

cm2012 8y ago
Most casual users would be quite upset if cookies stopped working. "Why does this site not stay logged in"? Etc.
- cosarara 8y ago
  Not all cookies, just 3rd party ones.
- aljones 8y ago
  You think Apple is upsetting casual users?

amelius 8y ago

By the way, what does GDPR say about fingerprinting? Is it legal? (Asking because the EU explicitly made cookies an opt-in technique, but not sure if they considered fingerprinting).

4ad 8y ago
The EU did not make cookies an opt-in technique. The EU made irrelevant cookies opt-in. Cookies that are essential for the functioning of the service do not need a notice. If you require user accounts, you don't need to show a cookie notice. If you implement a shopping cart without user accounts, you also don't need to show a cookie notice. Unfortunately most websites don't understand this simple idea and show the cookie notice indiscriminately (or, perhaps, they just all use cookies for tracking in which case the notice should be there).
- jazoom 8y ago
  Probably most websites use Google Analytics or an alternative.
  - seanwilson 8y ago
    > Probably most websites use Google Analytics or an alternative. How is this not essential though? You can't effectively run a business without some understanding of your traffic and where it's coming from. Also, you can use Google Analytics in a way that doesn't store PII.
    - jazoom 8y ago
      I could run the business just fine without Google Analytics. Would just be in the dark a bit more. I'm not associated with EU so I haven't pondered on this as much as others. My first thought is that this should really be up to the browsers and their users on what info Analytics software is able to work out just from the user being on the page. Users should just assume that every business will absorb all available information. At least then we wouldn't see those ridiculous cookie notices everywhere. As a web developer, I'm kinda surprised 3rd party cookies ever became a thing in the first place.

deleted 8y ago

[deleted]

oldcynic 8y ago

After the constant succession of revelations of the sorry state of privacy, along with myriad data breaches, all I want a browser to do is lie and obfuscate. So I'll gladly take the sledgehammer boolean of resistFingerprinting for now. I've yet to come across an extension that does something like this so I'm presuming it's not possible via extensions? Are Mozilla working to make this more granular and let me whitelist individual features on a per site basis? I'd far rather lose tracking than get the very minor benefit of a (slow loading) web font or en-GB over en-US. Especially if I can opt in the few I trust or need those features.

Skunkleton 8y ago
> After the constant succession of revelations of the sorry state of privacy, along with myriad data breaches... I remember reading an article about how Richard Stallman interacts with the internet a while back. I remember thinking that it seemed totally insane. But in light of the reality of 2018, I am coming around. The way I see it, I can keep tweaking privacy settings in a browser, or opting out of collection, or doing any number of other things to attempt to protect my privacy, _or_ I could just stop using services that do not respect my privacy in the first place. Perhaps certain aspects of modern life have taken too much, and they need to be abandoned until they are reformed?
- pieterr 8y ago
  > I remember reading an article about how Richard Stallman interacts with the internet a while back. One of these you mean? [1] https://news.ycombinator.com/item?id=16869515 https://news.ycombinator.com/item?id=16869515 [2] https://stallman.org/stallman-computing.html https://stallman.org/stallman-computing.html
  - Skunkleton 8y ago
    It was directly related to #2, but I only made it there as a result of reading some other article. It has been a while and I don't remember the source.
- 8y ago

prophesi 8y ago

I don't know, I think if a user is following all of the steps in this article, they likely know what fingerprinting is. Running an Android device without the Play Store, for example, is by far a much more difficult & complicated thing to do than just toggling a flag in a Firefox browser. That, and the user is likely used to having less-than-ideal browsing experiences if they run any adblockers. I do agree that the article should outline what the consequences would be for disabling browser fingerprinting; they simply have one sentence recommending it, and nothing else.