17 ms·

Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

720 points by commoner 8y ago

angel_j 8y ago
> Firefox's letterboxing support doesn't only work when resizing a browser window but also works when users are maximizing the browser window, or entering in fullscreen mode Brilliant. All you have to do is change your window size for every site you visit.
- dymk 8y ago
  The reason it's fingerprint resistant is because lots of other people will have the same reported screen size. Not because a different screen size is reported to different sites.
regecks 8y ago
I try enabling this occasionally, but it causes my zoom preference to be forgotten for each site after I close the tab. Seems to be intentional (https://bugzilla.mozilla.org/show_bug.cgi?id=1369357 https://bugzilla.mozilla.org/show_bug.cgi?id=1369357). I need zoom to not ruin my eyes - is it just too hard to mask the true zoom? With the letterboxing, it seems like it would mostly not do anything when using a tiling WM with fixed splits. Does that sound right?
- Vinnl 8y ago
  > it seems like it would mostly not do anything when using a tiling WM with fixed splits In the bug report [1] it says: > We haven't yet landed this feature in Tor Browser for at a few reasons: > - ... > - * Tiling window managers on Linux are hard to detect. Any implementation will need to behave appropriately for those. So it appears they are still working on that. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1407366 https://bugzilla.mozilla.org/show_bug.cgi?id=1407366
franky47 8y ago
While I welcome another way to fight the constant tracking that we've come to know and love, this is, in my case, a break of workflow [1]. I do responsive web design, and spend a considerable amount of time resizing my browser window as a "cheap" way of previewing how it would look on narrower screens. Having the resize snap to multiples of 100 or 200px would make this experience horrible. Disabling it on localhost (where you're supposedly in control of what goes in and out the browser) could be a solution. [1] https://xkcd.com/1172/ https://xkcd.com/1172/
- curiousgal 8y ago
  Why not use the built-in mobile preview tool that allows you to set custom dimensions?
  - franky47 8y ago
    I also use that, but I find it faster and more straightforward to just drag the window edge, especially when devtools are not opened. One example is using browser and editor side-by-side on a single macOS split-full-screen.
    - chrismorgan 8y ago
      You can open responsive mode via a keyboard shortcut without needing the dev tools open; on Windows it’s Ctrl+Shift+M, no idea about macOS but it’s doubtless easy to look up.
      - meruru 8y ago
        It's the same shortcut on Linux and *BSD and probably everywhere.
    - rhizome 8y ago
      I know you're not asking for advice, but in this case I would use LiveReload against multiple windows covering the breakpoints. Then you'll only need to wiggle edges to check breakpoint transitions.
cronix 8y ago
> The general idea is that "letterboxing" will mask the window's real dimensions by keeping the window width and height at multiples of 200px and 100px during the resize operation --generating the same window dimensions for all users-- and then adding a "gray space" at the top, bottom, left, or right of the current page. > The advertising code, which listens to window resize events, then reads the generic dimensions, sends the data to its server, and only after does Firefox remove the "gray spaces" using a smooth animation a few milliseconds later. Would using a setTimeout() on the window resize event bypass this? Send the data 20-50ms after resize is completed giving enough time for the letterboxing stuff to go away revealing the actual dimensions, or something? They say it only blocks the dimensions during the resize event and FF removes the letterboxing "a few ms later"
- trumped 8y ago
  Havent they thought about not broadcasting the window size... wtf. We are doomed apparently.
  - burtonator 8y ago
    Apps need it to determine where to place elements. If it wasn't you would still be able to reverse engineer it by sticking elements outside the viewport and seeing if they're hidden or not. Turns out anonymity is super freaking hard. :-/
    - CharlesColeman 8y ago
      > Apps need it to determine where to place elements. Could they hide the actual window dimensions from website javascript by only allowing a special kind of sandboxed function to access it? The website's code only really needs to do arithmetic on those values, so the browser could deny access to the actual values and force the code to manipulate them symbolically.
      - tedunangst 8y ago
        Are you also going to download every resource listed in every @media section of the CSS regardless of screen size?
deleted 8y ago
[deleted]
meruru 8y ago
I recommend the privacy.resistFingerpriting about:config mentioned. It's been available for a while and does other things too, like changing your user agent.
- chipperyman573 8y ago
  Is there any reason this isn't on by default? I don't know exactly how it works, but to my understanding anti fingerprinting tech generally works better when everyone uses it (otherwise you stick out as the "anti fingerprinting" browser)
  - shakna 8y ago
    It can decimate useability for the average user. Every time you see a Captcha, you may have to do four or five to be considered "human" because the system struggles to determine who you are.
    - darkpuma 8y ago
      > "because the system struggles to determine who you are. " Is the tile fade-in also the system struggling to figure out who you are? No, it's vindictive. Punishment for not browsing the web the way google wants you to.
      - SquareWheel 8y ago
        Or maybe it's to make it obvious that a tile has changed...
        darkpuma 8y ago
        No, sorry but that's nonsense. reCAPTCHAv2 doesn't do the tile fade in unless your v3 score is low. The fade in I'm talking about can take one to five seconds per tile, plainly designed to annoy the user. Here is a video of the fade-in in action: https://youtu.be/zGW7TRtcDeQ?t=89 https://youtu.be/zGW7TRtcDeQ?t=89 (Note that you do not need to be on a shared IP to experience this. Merely using firefox with resist fingerprinting and a adblocker is enough to trigger this behavior on an IP google normally 'trusts' when using chrome.)
meruru 8y ago
This is awesome. Other things I'd like to see added directly to Firefox are things like Ad and script blocking, HTTPS everywhere, and maybe something like a Tor button so that I don't have to rely on third parties for these critical privacy features.
thatsaguy 8y ago
I've been using FF with resistFinterprinting on since it was available. Letterboxing does break a lot of websites and apps, sometimes making them unusable due to incorrect positioning and scaling of the elements.
newscracker 8y ago
Every time there's something about online privacy with browsers, it's mostly Firefox or Safari. I wondered if Chrome had resisting fingerprinting on its radar (guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online), and I found this [1] confirming my guess (emphasis mine): > Since we don't believe it's feasible to provide some mode of Chrome that can truly prevent passive fingerprinting, we will mark all related bugs and feature requests as WontFix. I haven't read all the analyses in the links in that article, but this sounds defeatist and lazy, much unlike a stance that Chromium would take on security or performance on the web. Contrast the above with what this article says about Firefox: > Firefox's upcoming letterboxing feature is part of a larger project that started in 2016, called Tor Uplift. > Part of Tor Uplift, Mozilla developers have been slowly porting privacy-hardening features developed originally for the Tor Browser and integrating them into Firefox. If you value online privacy, your best choice is Firefox (though it requires some additional manual configuration). Safari comes second (its extensions directory could use more love). The choice where you can add more of your influence to is Firefox — by using it, evangelizing it and by donating (if feasible) to it. [1]: https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#Why-isnt-passive-browser-fingerprinting-including-passive-cookies_in-Chromes-threat-model https://chromium.googlesource.com/chromium/src/+/master/docs...
- godelski 8y ago
  > guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online I would actually think the opposite. Wouldn't it be better because then only Google would have that information? Only Google would be able to fingerprint. This is of course under the assumption (which is currently accurate) that Google has the majority share of browsers. But maybe it wouldn't be, because it would teach others how to thwart their fingerprinting.
  - baroffoos 8y ago
    Yeah, with a google account and google login on every website they still can track everyone even without all these other methods.
  - 8y ago
godelski 8y ago
What's the canvas fingerprinting one do? From what I (very poorly) understand, Tor returns a constant number for fingerprint requests. Can this be done for other requests?
- commoner 8y ago
  It prompts the user to decline a site from accessing data from the Canvas API. This data can uniquely identify the user's computer. The Firefox feature is identical to the one from the Tor Browser. Screenshot: https://thehackernews.com/2017/10/canvas-browser-fingerprint-blocker.html https://thehackernews.com/2017/10/canvas-browser-fingerprint... https://www.torproject.org/projects/torbrowser/design/ https://www.torproject.org/projects/torbrowser/design/ (see the "HTML5 Canvas Image Extraction" section) https://gitweb.torproject.org/tor-browser.git/commit/?h=tor-browser-52.5.2esr-7.0-2&id=196354d7951a48b4e6f5309d2a8e46962fff9d5f https://gitweb.torproject.org/tor-browser.git/commit/?h=tor-... https://developer.mozilla.org/en-US/docs/Web/API/Canvas_API https://developer.mozilla.org/en-US/docs/Web/API/Canvas_API
  - godelski 8y ago
    Thanks, those look like good reads. So I see in my version of FF that it is enabled as true but I don't recall ever seeing a prompt. I would love to see a blog post about some of these features and why things are difficult.
lxe 8y ago
Why not simply allow the user to control the js apis that are available/enabled, kind of like the camera/mic permissions? If sites simply cannot use the mouse events or window size events, they won’t be able to fingerprint. This grey box alternative seems like a complicated hack.
- mLuby 8y ago
  The problem is this will straight up crash many important sites. In the battle between usability and privacy, usability wins. Just try disabling javascript or cookies and see how long you last.
fxfan 8y ago
Maybe firefox should also install ublock origin by default? This isn't just for some power users- it will increase their share among regular people whose pages will load even faster making Firefox popular. Or are they waiting until the user share falls below 5%? Maybe they should listen to Andy grove and prepare now.
- nilolo 8y ago
  I'm guessing they would lose their financing from Google by adding UBlock.
  - fxfan 8y ago
    I don't know the terms but surely there are enough parties willing to pay them- MS would love to shoot with gun on fx shoulders. The engineering effort required to implement this feature is better spent in doing useful things.
    - zaarn 8y ago
      That's just a bet, I doubt Mozilla is willing to blast google on the chance there is someone willing to pay them, they'd probably rather have a sound financial cushion from non-google before going after google.
    - aerique 8y ago
      Microsoft just switched the rendering engine for Edge to Google's rendering engine, helping increase the monoculture. Despite all Microsoft's posing and snuggling up to the Open Source world, they're just as bad as Google and Facebook if given the chance. (And they have been as bad in the past.)
- alkonaut 8y ago
  They should turn fingerprinting to max and install uBlock origin by default. It might mean millions of FF users would suddenly struggle with captchas, but it might also mean that site creators just stop using reCaptcha and similar.
known 8y ago
Why not just download/use Tor Browser?
- adrianN 8y ago
  If changes are included upstream, that reduces the maintenance burden.
osrec 8y ago
If Firefox could make their Dev tools as good as Chrome's, I would switch immediately.
- medecau 8y ago
  You using dev tools on all websites you visit?
- antpls 8y ago
  Firefox is already valuable for browsing on mobile phone, where there is not much space on screen to have Dev console anyway. I recommend trying Firefox Mobile
  - Kuraj 8y ago
    Firefox on Android won my heart with extension support, which means I can have an ad blocker (uBlock Origin, no less) without root
scotty79 8y ago
How will that not break most of js positioning done on window.resize?
- thepangolino 8y ago
  Is there any legitimate reason for it? Besides playing pong with browser windows.
FavouriteColour 8y ago
If it helps defeat tracking then I’d like an option to snap to pre-defined sizes as I resize the window.
tjpnz 8y ago
Why can't the ad industry just accept that there are some people out there who don't want to see ads and wouldn't click on one to begin with? Then they can honor Do Not Track and those who choose to work in adtech can start working on things that are more productive to their business.
- daveFNbuck 8y ago
  That might have worked if Microsoft hadn't enabled Do Not Track by default.
- scarejunba 8y ago
  The ad industry was ready to honour DNT. MS killed it by going default.
  - slezyr 8y ago
    Sure, they gave their pinky promise do not track those, who will set it.
    - scarejunba 8y ago
      You can opt out of ads, actually, and those will be respected. And companies in the industry knew they'd play by the rules or suffer. I was in favour of DNT and made a little browser extension that would allow you to DNT some sites and not others. My hope was that eventually we'd be in a state where you could signal to the site right away whether you'd accept tracking or not and the site could paywall you if you didn't. That way it's a "pay with your data or money" loaded into the User Agent and I think I like that. It respects user choice.
- HunOL 8y ago
  Ads are not always for clicking. If you don't want to see ads than you should pay for content or leave.
  - deleted 8y ago
    [deleted]
mindslight 8y ago
But I've already got code in my xmonad.hs that clamps firefox windows to common monitor sizes? It's truly unfortunate that browsers just punted on security, dumping endless amounts of sensitive information into a purported sandbox. Why bother developing something with a secure mindset to begin with, when you can just band-aid on patches later?! It's the sendmail/ActiveX philosophy all over again, only now with network effects.
Tsubasachan 8y ago
Nice but the more you want privacy the more CAPTCHA Google will throw at you.
- tinus_hn 8y ago
  Google isn't going to bother the general public like that, that’s limited to small groups like techs who block the canvas fingerprinting. Do you think Google is going to spam people that use the Safari default intelligent tracking protection?
patrickaljord 8y ago
At this point Firefox should just merge with Tor if they want to market themselves as the pro-privacy browser. Right now I just use Chrome when I'm using my real identity for work and shopping and social media anyway as it's a very good browser and supported everywhere and has an open source version through Chromium. When I need actual privacy, I just use Tor which supports most sites and is way more protective of my privacy than firefox. May switch to Brave in the future for this use case as they're adding Tor support but right now Chrome + Tor every once in a while works best for me.
- maxencecornet 8y ago
  >May switch to Brave in the future In the futur? Tor tabs are already a feature of Brave, as of today
  - patrickaljord 8y ago
    It wasn't last time I tried on Linux. Thanks for the headsup.
kowdermeister 8y ago
This is horrible from a UX perspective. There are many fingerprinting techniques besides this. I don't see how adding a user hostile behaviour will help.
- commoner 8y ago
  Fortunately, this is entirely optional. The "privacy.resistFingerprinting" option bundles a set of features that make it more difficult for sites to uniquely identify the user at a cost to usability. It's up to each user to determine whether that usability cost is worth the privacy improvements. On Firefox, it's an opt-in setting, off by default.
- move-on-by 8y ago
  What else can they do to decrease the effectiveness of increasingly hostile trackers?
  - kowdermeister 8y ago
    Easy way to do ad networks host blocking. The real problem is canvas fingerprinting, but that's an inherent issue of the whole graphics stack so everything depends on your freak-out factor.
Yuval_Halevi 8y ago
I'm using Brave for a while they have a function to surf the web through Tor network which seems pretty safe I'm glad to hear the Firefox also give a lot of value to privacy
techvellacom 8y ago
The Tor Uplift process later continued in Firefox 55 when Mozilla added a Tor Browser feature known as First-Party Isolation (FPI), which worked by separating cookies on a per-domain basis, preventing ad trackers from using cookies to track users across the Internet. This feature is now at the heart of Project Fission and will morph into a Chrome-like "site isolation" feature for Firefox. This is just factually incorrect.

720 points by commoner 8y ago

> Firefox's letterboxing support doesn't only work when resizing a browser window but also works when users are maximizing the browser window, or entering in fullscreen mode Brilliant. All you have to do is change your window size for every site you visit.

dymk 8y ago
The reason it's fingerprint resistant is because lots of other people will have the same reported screen size. Not because a different screen size is reported to different sites.

regecks 8y ago

I try enabling this occasionally, but it causes my zoom preference to be forgotten for each site after I close the tab. Seems to be intentional (https://bugzilla.mozilla.org/show_bug.cgi?id=1369357 https://bugzilla.mozilla.org/show_bug.cgi?id=1369357). I need zoom to not ruin my eyes - is it just too hard to mask the true zoom? With the letterboxing, it seems like it would mostly not do anything when using a tiling WM with fixed splits. Does that sound right?

Vinnl 8y ago
> it seems like it would mostly not do anything when using a tiling WM with fixed splits In the bug report [1] it says: > We haven't yet landed this feature in Tor Browser for at a few reasons: > - ... > - * Tiling window managers on Linux are hard to detect. Any implementation will need to behave appropriately for those. So it appears they are still working on that. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1407366 https://bugzilla.mozilla.org/show_bug.cgi?id=1407366

franky47 8y ago

While I welcome another way to fight the constant tracking that we've come to know and love, this is, in my case, a break of workflow [1]. I do responsive web design, and spend a considerable amount of time resizing my browser window as a "cheap" way of previewing how it would look on narrower screens. Having the resize snap to multiples of 100 or 200px would make this experience horrible. Disabling it on localhost (where you're supposedly in control of what goes in and out the browser) could be a solution. [1] https://xkcd.com/1172/ https://xkcd.com/1172/

curiousgal 8y ago
Why not use the built-in mobile preview tool that allows you to set custom dimensions?
- franky47 8y ago
  I also use that, but I find it faster and more straightforward to just drag the window edge, especially when devtools are not opened. One example is using browser and editor side-by-side on a single macOS split-full-screen.
  - chrismorgan 8y ago
    You can open responsive mode via a keyboard shortcut without needing the dev tools open; on Windows it’s Ctrl+Shift+M, no idea about macOS but it’s doubtless easy to look up.
    - meruru 8y ago
      It's the same shortcut on Linux and *BSD and probably everywhere.
  - rhizome 8y ago
    I know you're not asking for advice, but in this case I would use LiveReload against multiple windows covering the breakpoints. Then you'll only need to wiggle edges to check breakpoint transitions.

cronix 8y ago

> The general idea is that "letterboxing" will mask the window's real dimensions by keeping the window width and height at multiples of 200px and 100px during the resize operation --generating the same window dimensions for all users-- and then adding a "gray space" at the top, bottom, left, or right of the current page. > The advertising code, which listens to window resize events, then reads the generic dimensions, sends the data to its server, and only after does Firefox remove the "gray spaces" using a smooth animation a few milliseconds later. Would using a setTimeout() on the window resize event bypass this? Send the data 20-50ms after resize is completed giving enough time for the letterboxing stuff to go away revealing the actual dimensions, or something? They say it only blocks the dimensions during the resize event and FF removes the letterboxing "a few ms later"

trumped 8y ago
Havent they thought about not broadcasting the window size... wtf. We are doomed apparently.
- burtonator 8y ago
  Apps need it to determine where to place elements. If it wasn't you would still be able to reverse engineer it by sticking elements outside the viewport and seeing if they're hidden or not. Turns out anonymity is super freaking hard. :-/
  - CharlesColeman 8y ago
    > Apps need it to determine where to place elements. Could they hide the actual window dimensions from website javascript by only allowing a special kind of sandboxed function to access it? The website's code only really needs to do arithmetic on those values, so the browser could deny access to the actual values and force the code to manipulate them symbolically.
    - tedunangst 8y ago
      Are you also going to download every resource listed in every @media section of the CSS regardless of screen size?

deleted 8y ago

[deleted]

meruru 8y ago

I recommend the privacy.resistFingerpriting about:config mentioned. It's been available for a while and does other things too, like changing your user agent.

chipperyman573 8y ago
Is there any reason this isn't on by default? I don't know exactly how it works, but to my understanding anti fingerprinting tech generally works better when everyone uses it (otherwise you stick out as the "anti fingerprinting" browser)
- shakna 8y ago
  It can decimate useability for the average user. Every time you see a Captcha, you may have to do four or five to be considered "human" because the system struggles to determine who you are.
  - darkpuma 8y ago
    > "because the system struggles to determine who you are. " Is the tile fade-in also the system struggling to figure out who you are? No, it's vindictive. Punishment for not browsing the web the way google wants you to.
    - SquareWheel 8y ago
      Or maybe it's to make it obvious that a tile has changed...
      - darkpuma 8y ago
        No, sorry but that's nonsense. reCAPTCHAv2 doesn't do the tile fade in unless your v3 score is low. The fade in I'm talking about can take one to five seconds per tile, plainly designed to annoy the user. Here is a video of the fade-in in action: https://youtu.be/zGW7TRtcDeQ?t=89 https://youtu.be/zGW7TRtcDeQ?t=89 (Note that you do not need to be on a shared IP to experience this. Merely using firefox with resist fingerprinting and a adblocker is enough to trigger this behavior on an IP google normally 'trusts' when using chrome.)

meruru 8y ago

This is awesome. Other things I'd like to see added directly to Firefox are things like Ad and script blocking, HTTPS everywhere, and maybe something like a Tor button so that I don't have to rely on third parties for these critical privacy features.

thatsaguy 8y ago

I've been using FF with resistFinterprinting on since it was available. Letterboxing does break a lot of websites and apps, sometimes making them unusable due to incorrect positioning and scaling of the elements.

newscracker 8y ago

Every time there's something about online privacy with browsers, it's mostly Firefox or Safari. I wondered if Chrome had resisting fingerprinting on its radar (guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online), and I found this [1] confirming my guess (emphasis mine): > Since we don't believe it's feasible to provide some mode of Chrome that can truly prevent passive fingerprinting, we will mark all related bugs and feature requests as WontFix. I haven't read all the analyses in the links in that article, but this sounds defeatist and lazy, much unlike a stance that Chromium would take on security or performance on the web. Contrast the above with what this article says about Firefox: > Firefox's upcoming letterboxing feature is part of a larger project that started in 2016, called Tor Uplift. > Part of Tor Uplift, Mozilla developers have been slowly porting privacy-hardening features developed originally for the Tor Browser and integrating them into Firefox. If you value online privacy, your best choice is Firefox (though it requires some additional manual configuration). Safari comes second (its extensions directory could use more love). The choice where you can add more of your influence to is Firefox — by using it, evangelizing it and by donating (if feasible) to it. [1]: https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#Why-isnt-passive-browser-fingerprinting-including-passive-cookies_in-Chromes-threat-model https://chromium.googlesource.com/chromium/src/+/master/docs...

godelski 8y ago
> guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online I would actually think the opposite. Wouldn't it be better because then only Google would have that information? Only Google would be able to fingerprint. This is of course under the assumption (which is currently accurate) that Google has the majority share of browsers. But maybe it wouldn't be, because it would teach others how to thwart their fingerprinting.
- baroffoos 8y ago
  Yeah, with a google account and google login on every website they still can track everyone even without all these other methods.
- 8y ago

godelski 8y ago

What's the canvas fingerprinting one do? From what I (very poorly) understand, Tor returns a constant number for fingerprint requests. Can this be done for other requests?

commoner 8y ago
It prompts the user to decline a site from accessing data from the Canvas API. This data can uniquely identify the user's computer. The Firefox feature is identical to the one from the Tor Browser. Screenshot: https://thehackernews.com/2017/10/canvas-browser-fingerprint-blocker.html https://thehackernews.com/2017/10/canvas-browser-fingerprint... https://www.torproject.org/projects/torbrowser/design/ https://www.torproject.org/projects/torbrowser/design/ (see the "HTML5 Canvas Image Extraction" section) https://gitweb.torproject.org/tor-browser.git/commit/?h=tor-browser-52.5.2esr-7.0-2&id=196354d7951a48b4e6f5309d2a8e46962fff9d5f https://gitweb.torproject.org/tor-browser.git/commit/?h=tor-... https://developer.mozilla.org/en-US/docs/Web/API/Canvas_API https://developer.mozilla.org/en-US/docs/Web/API/Canvas_API
- godelski 8y ago
  Thanks, those look like good reads. So I see in my version of FF that it is enabled as true but I don't recall ever seeing a prompt. I would love to see a blog post about some of these features and why things are difficult.

lxe 8y ago

Why not simply allow the user to control the js apis that are available/enabled, kind of like the camera/mic permissions? If sites simply cannot use the mouse events or window size events, they won’t be able to fingerprint. This grey box alternative seems like a complicated hack.

mLuby 8y ago
The problem is this will straight up crash many important sites. In the battle between usability and privacy, usability wins. Just try disabling javascript or cookies and see how long you last.

fxfan 8y ago

Maybe firefox should also install ublock origin by default? This isn't just for some power users- it will increase their share among regular people whose pages will load even faster making Firefox popular. Or are they waiting until the user share falls below 5%? Maybe they should listen to Andy grove and prepare now.

nilolo 8y ago
I'm guessing they would lose their financing from Google by adding UBlock.
- fxfan 8y ago
  I don't know the terms but surely there are enough parties willing to pay them- MS would love to shoot with gun on fx shoulders. The engineering effort required to implement this feature is better spent in doing useful things.
  - zaarn 8y ago
    That's just a bet, I doubt Mozilla is willing to blast google on the chance there is someone willing to pay them, they'd probably rather have a sound financial cushion from non-google before going after google.
  - aerique 8y ago
    Microsoft just switched the rendering engine for Edge to Google's rendering engine, helping increase the monoculture. Despite all Microsoft's posing and snuggling up to the Open Source world, they're just as bad as Google and Facebook if given the chance. (And they have been as bad in the past.)
alkonaut 8y ago
They should turn fingerprinting to max and install uBlock origin by default. It might mean millions of FF users would suddenly struggle with captchas, but it might also mean that site creators just stop using reCaptcha and similar.

known 8y ago

Why not just download/use Tor Browser?

adrianN 8y ago
If changes are included upstream, that reduces the maintenance burden.

osrec 8y ago

If Firefox could make their Dev tools as good as Chrome's, I would switch immediately.

medecau 8y ago
You using dev tools on all websites you visit?
antpls 8y ago
Firefox is already valuable for browsing on mobile phone, where there is not much space on screen to have Dev console anyway. I recommend trying Firefox Mobile
- Kuraj 8y ago
  Firefox on Android won my heart with extension support, which means I can have an ad blocker (uBlock Origin, no less) without root

scotty79 8y ago

How will that not break most of js positioning done on window.resize?

thepangolino 8y ago
Is there any legitimate reason for it? Besides playing pong with browser windows.

FavouriteColour 8y ago

If it helps defeat tracking then I’d like an option to snap to pre-defined sizes as I resize the window.

tjpnz 8y ago

Why can't the ad industry just accept that there are some people out there who don't want to see ads and wouldn't click on one to begin with? Then they can honor Do Not Track and those who choose to work in adtech can start working on things that are more productive to their business.

daveFNbuck 8y ago
That might have worked if Microsoft hadn't enabled Do Not Track by default.
scarejunba 8y ago
The ad industry was ready to honour DNT. MS killed it by going default.
- slezyr 8y ago
  Sure, they gave their pinky promise do not track those, who will set it.
  - scarejunba 8y ago
    You can opt out of ads, actually, and those will be respected. And companies in the industry knew they'd play by the rules or suffer. I was in favour of DNT and made a little browser extension that would allow you to DNT some sites and not others. My hope was that eventually we'd be in a state where you could signal to the site right away whether you'd accept tracking or not and the site could paywall you if you didn't. That way it's a "pay with your data or money" loaded into the User Agent and I think I like that. It respects user choice.
HunOL 8y ago
Ads are not always for clicking. If you don't want to see ads than you should pay for content or leave.
- deleted 8y ago
  [deleted]

mindslight 8y ago

But I've already got code in my xmonad.hs that clamps firefox windows to common monitor sizes? It's truly unfortunate that browsers just punted on security, dumping endless amounts of sensitive information into a purported sandbox. Why bother developing something with a secure mindset to begin with, when you can just band-aid on patches later?! It's the sendmail/ActiveX philosophy all over again, only now with network effects.

Tsubasachan 8y ago

Nice but the more you want privacy the more CAPTCHA Google will throw at you.

tinus_hn 8y ago
Google isn't going to bother the general public like that, that’s limited to small groups like techs who block the canvas fingerprinting. Do you think Google is going to spam people that use the Safari default intelligent tracking protection?

patrickaljord 8y ago

At this point Firefox should just merge with Tor if they want to market themselves as the pro-privacy browser. Right now I just use Chrome when I'm using my real identity for work and shopping and social media anyway as it's a very good browser and supported everywhere and has an open source version through Chromium. When I need actual privacy, I just use Tor which supports most sites and is way more protective of my privacy than firefox. May switch to Brave in the future for this use case as they're adding Tor support but right now Chrome + Tor every once in a while works best for me.

maxencecornet 8y ago
>May switch to Brave in the future In the futur? Tor tabs are already a feature of Brave, as of today
- patrickaljord 8y ago
  It wasn't last time I tried on Linux. Thanks for the headsup.

kowdermeister 8y ago

This is horrible from a UX perspective. There are many fingerprinting techniques besides this. I don't see how adding a user hostile behaviour will help.

commoner 8y ago
Fortunately, this is entirely optional. The "privacy.resistFingerprinting" option bundles a set of features that make it more difficult for sites to uniquely identify the user at a cost to usability. It's up to each user to determine whether that usability cost is worth the privacy improvements. On Firefox, it's an opt-in setting, off by default.
move-on-by 8y ago
What else can they do to decrease the effectiveness of increasingly hostile trackers?
- kowdermeister 8y ago
  Easy way to do ad networks host blocking. The real problem is canvas fingerprinting, but that's an inherent issue of the whole graphics stack so everything depends on your freak-out factor.

Yuval_Halevi 8y ago

I'm using Brave for a while they have a function to surf the web through Tor network which seems pretty safe I'm glad to hear the Firefox also give a lot of value to privacy

techvellacom 8y ago

The Tor Uplift process later continued in Firefox 55 when Mozilla added a Tor Browser feature known as First-Party Isolation (FPI), which worked by separating cookies on a per-domain basis, preventing ad trackers from using cookies to track users across the Internet. This feature is now at the heart of Project Fission and will morph into a Chrome-like "site isolation" feature for Firefox. This is just factually incorrect.