23 ms·

Block Fingerprinting with Firefox

1292 points by rendall 7y ago

OJFord 7y ago
> You probably wouldn’t appreciate someone tracking your moves in real life. There’s no reason to accept it online. Great to read something like this on mozilla.org.
- deleted 7y ago
  [deleted]
- tacosx 7y ago
  The revolt against surveillance capitalism seems to just be starting in earnest. I think a lot of smart people are finally realizing they have wasted their considerable talents on advertising tech while pretending it was something else and are now very angry.
  - TaylorAlexander 7y ago
    I’d like to believe this, but I think it will take more time.
- ngokevin 7y ago
  Kind of funny though, the vast majority of Mozilla's money comes from the ads and tracking industry, just one step removed.
  - Drdrdrq 7y ago
    Yes, but that is just because they represent a risk for Google. Their incentives are quite different than Google's, and that is what matters.
    - ngokevin 7y ago
      Not as much as risk. More of not wanting to be seen as a monopoly. Giving up 1% of the browser market share and a few pennies is worth it to not be seen as the virtual dictator of the Web.
      - Drdrdrq 7y ago
        Also true.
  - ChrisSD 7y ago
    The irony is they tried diversifying their income. But people don't want their browser to ask for donations (that's nagging). They don't want their new tab page pre-populated with websites on a new install (even if their browsing overwrites them). They don't want "fun" additions to advertise TV shows (even if they're opt-in). But they're happy to pay via google's search and tracking. Mozilla doesn't have a lot of options open to them.
    - ademup 7y ago
      Firefox has ~250M users as of about 9 months ago and $562M revenue for 2017. I'd honestly pay $2 per month (12 times "my share") for a Firefox that completely disavows the ad model and produces a truly user-centric experience sans ads, fingerprinting, etc. However, given that over 95% of their revenue comes from Royalties, I don't see that turning around any time soon.
      - thethirdone 7y ago
        > Firefox has ~250M users as of about 9 months ago and $562M revenue for 2017 I think nearly everyone would be willing to pay the ~$2/year to use Firefox if all browsers weren't free. At that price, the main reason not to pay is the hassle rather than just downloading. Thanks for the context about the revenue of Firefox. I had never given it any though.
        godelski 7y ago
        They have on their donations a monthly donation. That's hassle free. You can also donate to them through Amazon smile.
        Fnoord 7y ago
        > I think nearly everyone would be willing to pay the ~$2/year to use Firefox if all browsers weren't free. Don't forget $2 in USA buys you different things than in Russia, China, India, or Africa.
      - simias 7y ago
  - TheRealPomax 7y ago
    And? I used to work for a defense contractor, using the military complex money to instead pay for civil projects that actually benefit normal people. You can take money that comes from "I don't like this thing", and then spend it on "this benefits everyone".
    - ngokevin 7y ago
      Does the defense contractor rag on the military afterwards? You can take money from something, use it for good, but it's kinda funny when you start to claim the hands that feeds you is evil and bad.
      - Fnoord 7y ago
        This is how OpenBSD lost their DARPA funding. [1] [1] https://lwn.net/Articles/29937/ https://lwn.net/Articles/29937/
      - TheRealPomax 7y ago
        Given that they were a 60k employee company: yeah, some parts of them probably were.
    - pbhjpbhj 7y ago
      If that's truly your rationale then you're deluding yourself: you can take money, for sure, but as soon as you act to aid the source of the money then you're complicit in whatever that source is doing. You might consider the positive aspects of your use of the money out with the negative aspects of your aiding murder, say, but that's not quite what you outlined.
      - TheRealPomax 7y ago
        And that's why everyone who works for Google or Facebook should quit, too, but in the real world there are an insane amount of jobs that ultimately do really bad things, and we need work. So find somewhere that your particular skillset makes a net positive contribution instead of going homeless because almost every single big company is responsible for suffering in the world. The defense contract I worked for also has a strong civil presence and makes things like turn stiles, card readers, and emergency alert systems, and those directly benefit people rather than help murder folks. The idea that "my work directly benefits the part of the company that murders people", given how budgets actually work in large companies, is arguably far more delusional here.
  - derefr 7y ago
    What’s wrong with using the resources of evil (freely given, oddly enough) to destroy evil? If someone you hate offers you a billion dollars, you should take it—because in doing so you’ve made someone you hate a billion dollars poorer! It’s like stealing the money from them, with less work! Imagine, analogously: a lottery whose proceeds go to a charity supporting statistics education.
    - pbhjpbhj 7y ago
      If someone you hate gives you $1 million though, and says "I'll pay you again next year if you do well for me, you might even get more" then you're going to find that if you take the money in a few years all your decisions are centred around the happiness of the person you once hated. If you keep taking their money you're morally complicit in their actions too.
      - derefr 7y ago
        > all your decisions are centred around the happiness of the person you once hated You’re essentially talking about the https://en.wikipedia.org/wiki/Cobra_effect https://en.wikipedia.org/wiki/Cobra_effect. (The government sets a bounty on snakes? Bounty hunters realize that the cheapest way to get snakes to turn in to the government, is by breeding them themselves. Now you’ve got more live snakes, not fewer.) When greed or need-for-money is an incentive (such as in a for-profit corporation), you’ll be driven to do whatever perpetuates the income stream; and, if someone is paying you to do something, it’s cheaper to just do that thing because you get to continue working with them in the future (so your marketing costs for finding new work are zero.) But, importantly, the Cobra effect doesn’t apply if your goal (as a person, or as an organization) isn’t to make money, but rather to use up money (i.e. to bankrupt your ‘patron.’) If you’re not a bounty hunter, but simply someone who hates snakes, you won’t ever bother to breed them. You’re not in it for the money. You’re in it for there being fewer cobras. There are, of course, organizations which are not for-profit corporations. Mozilla itself is a non-profit, despite there also existing a Mozilla Corporation. As well, even with a for-profit corporation, the income of such an organization can be completely divorced from how it deals with an arbitrary stream of money. Banks, for example, despite being for-profit corporations, do not spend the money you deposit with them. Your money is not an asset on their balance sheet; in fact, it’s a liability. Mozilla Corporation could, for example, just donate all the money it receives from unsavoury sources over to Mozilla-the-nonprofit, and keep none for itself. This would remove its profit motive vis. this income source. Analogies: Police confiscate stuff from criminals, and then sell that stuff at auction. They aren’t driven to confiscate as much stuff as possible, because they don’t directly see the proceeds from those auctions (it goes into the city budget, which does eventually fund them back, but in some inscrutable, non-motivating way.) Instead, the police department usually just has a mandate to take the stuff and sell it. (There is a broken incentive around police confiscation of drugs and cash, because these are so hard to trace that police can and do directly profit from these confiscations. But money wired between corporations as a result of an invoice is not untraceable like cash, so the confiscation of cash isn’t really analogous. A closer analogy is the confiscation of pimped-out cars—the police do not, and cannot, make personal use of these. So they don’t really care how many they find.) Oil-and-gas engineers aren’t driven to flare as much natural gas out of oil fields as possible, because there’s no useful purpose to flaring natural gas (for now); they’re just trying to use it up and get it out of the way of the stuff they do want. Building renovation contractors aren’t driven to collect as much asbestos as possible. They only collect and remove it because they can’t certify the building until it’s all gone. (Imagine an alternative world where you could turn in asbestos to the government for a reward. We’d get a Cobra effect so fast.) In all these cases, you’re not driven by your need to collect the thing; and there’s no element of greed driving you to collect the thing; it’s just part of your job to collect the thing. As you diminish the number of illegal weapons out there, or amount of natural gas in the oil field, or the amount of asbestos left in buildings... you can simply do less sequestering. Nobody is put out when criminals run out of guns, not even the police. The oil-and-gas engineers who did the burn-offs are done their work at that oil field, sure, but they just move on to another oil field. The renovators have plenty of other jobs to do, and the people who specifically handle asbestos removal will just retrain to remove the next thing people want gone from buildings, toxic mould or what-have-you. —— What we’re essentially talking about, here, is a ‘parasitic’ nonprofit—the organizational equivalent of a mosquito, something that wanders around sucking its ‘hosts’ dry, but which doesn’t expect (or attempt) to subsist indefinitely on a single ‘host’. It expects to either kill its host; be killed by its host; or be “swatted away” by its host, at which point it can find a new host. And, because a parasitic organization serves no useful purpose to its host—it offers no attempt at symbiosis—the host will eventually become aware of its nature, though how fast this happens can vary dramatically, depending on how bureaucratic the host is, and the time-scale of the deal the host and parasite originally made. (Imagine how long it would take the US government to figure out that a weapons subcontractor is a foreign-government led operation with the aim of “siphoning money out of the US defense budget while avoiding actually satisfying the demand for a given weapon”, purely through the regular business-side interactions between the government and the contractor, without the assistance of the government’s background-checking process. Unlike governments, private companies do not generally do background checks on their contractors’ employees, so an IBM, or a GE, is not safe from this attack.) Of course, unlike in the animal realm where every animal at some point deals with a parasite from a state of complete ignorance, parasitic organizations can get reputations that precede them everywhere. This is what I’d call the host “killing” the parasite nonprofit. But, well, the same people can form as many organizations as they want... and perhaps even use successive organizational vehicles to drain the same host companies repeatedly, if they just ensure to put a different face (different figurehead CEOs, etc.) on the parasite each time. These are the same proven strategies that “fake” charities use every day to line their own pockets! Just turned to a purpose other than selfishness.
  - BlueTemplar 7y ago
    Well, we could change that. I've subscribed for a monthly donation to Mozilla after learning about that. I've also been giving through Flattr as an alternative to ads for micro-funding on the Web - anyone knows why their plugin/extension/addon isn't listed on addons.mozilla.org anymore ? (You can still install it from their official website.) Might it be due to a conflict of interest between Google and Eyeo ?
- ngold 7y ago
  “A lot of the scripts that are run to enable tracking delay webpage load times while all these tracking scripts fire and run in the background,” said Peter Dolanjski, Firefox Product Lead. Over at Google they are trying to sell fingerprinting as a feature.
  - skybrian 7y ago
    What do you mean? Link?
    - RonanTheGrey 7y ago
      Fingerprinting is the primary way that Captcha decides whether to block you or not. Fingerprinting == security is the parallel they are drawing.
      - skybrian 7y ago
        Ok, that makes sense. Not ideal, but captchas need to be written somehow.
        akerro 7y ago
        Modern captchas are designed to be anti-human and use as for free training of their AI algorithms. We're slaves for free while Google benefits from this, both technologically and financially. Next captcha from google will be even more aggressive, you're not logged to Google = you're a bot, you can't access that content.
        CaptainZapp 7y ago
        Next captcha from google will be even more aggressive, you're not logged to Google = you're a bot, you can't access that content. You may be right. But you know what: If I encounter captchas nowadays and unless I really need to get to that site it's "Fuck you very much!" time. I'm just not that interested in most of the web to make it woth my while and provide free work for Google.
- msla 7y ago
  Ironic, though, given their stance on opt-out-only telemetry.
  - dralley 7y ago
    99% of what telemetry tracks has nothing to do with user actions. It's mostly stuff like this: https://metrics.mozilla.com/webrender/dashboard_nvidia.html https://metrics.mozilla.com/webrender/dashboard_nvidia.html
    - pbhjpbhj 7y ago
      99% of a thugs day is not smashing people in the face so that must mean there entirely benign, right? In short your metric doesn't work.
Despegar 7y ago
As always when it comes to Firefox and privacy, the question is why isn't it on by default?
- stuff4ben 7y ago
  Because it may cause some websites to break and they're aiming to provide a good user-experience for the majority of the population. If they turn this on by default without users knowing the risks of sites not working correctly, they'll unfairly blame Firefox, bad mouth it, and switch to Chrome/Edge/Safari/etc.
  - Despegar 7y ago
    That's the stated reason but it's pretty weak to me. Safari hasn't had to make similar compromises.
    - deleted 7y ago
      [deleted]
    - deleted 7y ago
      [deleted]
    - mevile 7y ago
      I don't think you've turned on very strict anti-tracking in a browser if you think that's a weak reason. The setting can really break websites, making them unusable or whole blocks of content don't load. Before this update I used to use Privacy Badger and it also broke websites all the time. I don't believe Safari has anything like what Firefox or Privacy Badger offers built in. So you wouldn't be able to use your default experience with Safari as a comparison.
      - benoliver999 7y ago
        I had to turn it off in Firefox. It was breaking stuff like image uploaders on ebay.
emptyparadise 7y ago
Google Recaptcha becomes absolutely unbearable once you use this and also block Google cookies on non-Google sites. Given all that, features like this will not make their way to Chrome.
lcao 7y ago
Yes, the same browser that sent the raw browsing history of a portion of users to a third party. Talk about tracking! >Users who receive a version of Firefox with Cliqz will have their browsing activity sent to Cliqz servers, including the URLs of pages they visit. https://blog.mozilla.org/press-uk/2017/10/06/testing-cliqz-in-firefox/ https://blog.mozilla.org/press-uk/2017/10/06/testing-cliqz-i...
- jszymborski 7y ago
  Damned if you disclose your responsible stewardship of user data, damned if you don't. > Less than one percent of users in Germany installing Firefox from our main download page will receive a version of Firefox with Cliqz recommendations enabled out of the box. > Cliqz does not build browsing profiles for individual users and discards the user’s IP address once the data is collected. > One of Mozilla’s core privacy principles is No Surprises: we will use and share data in ways that are transparent and benefit our users. That is why we are telling you about this today. We > We hope that users will appreciate the improved experience, but if users want to turn it off, they can always disable data collection or remove the Cliqz add-on entirely.
  - jimmaswell 7y ago
    It was done to less than 1% of users so it's okay? Obviously Chrome is worse but this still sounds bad to me.
  - sdoering 7y ago
    Sorry. If I want my data somewhere else I can stay with Chrome. I switched years ago because of performance reasons. Whenever I tried to switch back I felt stabbed in the back shortly thereafter by Mozilla.
    - JoshMnem 7y ago
      Chrome is much worse. It seems like chopping a leg off because someone stepped on a toe.
xvector 7y ago
Can someone paste their results (or at least bits of fingerprinting entropy) from https://panopticlick.eff.org https://panopticlick.eff.org with the latest Firefox? With the fancy new anti-fingerprinting Safari on macOS Mojave I get just over 14.5 bits of entropy with the most entropic source being my canvas fingerprint (1 in 600). With Safari on iOS I get 11.71 bits of entropy, with the most entropic value being my screen size and color depth.
- numakerg 7y ago
  Panopticlick says I have "strong protection against Web tracking" but amiunique.org says I'm unique. Though amiunique also claims my TOR is fingerprint is one of six.
  - godelski 7y ago
    I get very different results from each. Some don't quite make sense to me. For example, amiunique says Timezone 3.37%. Panopticlick says 1 in 16, so half as bad. But how the hell is that timezone so identifying? I live on the west coast, how is that timezone so identifying?
- gruez 7y ago
  >With the fancy new anti-fingerprinting Safari on macOS Mojave I get just over 14.5 bits of entropy with the most entropic source being my canvas fingerprint (1 in 600). That's actually pretty good, considering tor browser (which has resistfingerprinting enabled) with default window size (1000x1000) has 14.82 bits of entropy.
- mlok 7y ago
  I have 3 more bits of identifying information than you. (block fingerprinting enabled)
- Twirrim 7y ago
  Interestingly enough, uBlock Origin actually stops that site from working, seems to break the fingerprinting step. If i disable uBlock, I get 16.63 bits of identifying information. Likewise the canvas fingerprint is the biggest, in my case 1 in 101154.
Causality1 7y ago
AdNauseam is an extension that clicks ads at random in the background, thus polluting your user data. It was useful enough to get banned from the Chrome web store.
- floatingatoll 7y ago
  It’s probably wise not to encourage interstate advertising fraud that the FBI might decide to investigate and arrest you for knowingly participating in. https://www.fastcompany.com/90273549/fbi-and-google-take-down-multi-million-dollar-ad-fraud-operation https://www.fastcompany.com/90273549/fbi-and-google-take-dow...
  - Causality1 7y ago
    They arrested people for making money by generating fake clicks on their own site. AdNauseam isn't ad fraud any more than running a web crawler bot is ad fraud.
    - floatingatoll 7y ago
      I’m sure you’ll be fine, eventually - but that’s not guaranteed to stop them initially, or without a digital search of your entire computer, for example.
      - Causality1 7y ago
        Do you have any evidence that any AdNauseam user has ever been arrested for ad fraud?
        SquareWheel 7y ago
        They said they "might decide to investigate". That suggests it's a real possibility but not something that has previously happened.
        floatingatoll 7y ago
amanzi 7y ago
I use the Strict blocking setting and have no need for a separate adblocker.
cypherpunks01 7y ago
Does this just turn on the privacy.resistFingerprinting flag? I liked that flag but it set all sites to UTC time which caused me random issues..
- cpeterso 7y ago
  No, this is different. This feature is a block list of known fingerprinting and cryptomining scripts. The privacy.resistFingerprinting flag changes Firefox settings that scripts use to fingerprint users, such as User-Agent string, window dimensions, and time zone (as you mentioned). The flag is enabled in Tor but not Firefox because the setting changes can break some websites or hurt performance.
ziddoap 7y ago
I find it really interesting that when a company is making moves in a direction that benefits privacy of consumers, everyone takes the opportunity to shit on them for past mistakes or how it isn't good enough or why isn't it on by default or any other thing they can find to shit on. Yes, every single company has made mistakes. FireFox is no exception. Some of them were pretty egregious. Mistakes are - hopefully - an opportunity to learn and adjust, move forward, and continue progress towards something we all want: privacy. We should absolutely call out companies when they make mistakes or ill-advised choices. I'm not saying we shouldn't. However, we should also _applaud_ efforts that are in-line with bringing privacy to consumers. Not just spend all of our time looking for something negative to be outraged at. This always-negative/outrage attitude just erodes any sort of meaningful discussion.
- flukus 7y ago
  Good reputations are hard to gain and easily lost, we shouldn't forget how we got to the sorry current state of the web and Mozillas mistakes are a large part of how that happened. Had mozilla not pissed away market share while they rewrote things in rust, broke extensions, built a horrible UI, etc, then they would have had enough weight to do things look push back against DRM. Obviously having a spyware company like google control the web is a bad thing, but that doesn't make mozilla good, they've been poor stewards for a long time and we should be looking toward others, the pale moon fork to name one example.
- roca 7y ago
  It also reduces incentives to actually make moves that benefit privacy. Because if the people who say they care about privacy aren't going to support you, why bother?
  - scarejunba 7y ago
    Nah, the people who care are happy. The problem is the guys who like to talk. It's the same with security. There's like an army of people who've learned about it from internet commentary exclusively and they bluster a lot as a substitute for competence.
dymk 7y ago
Is it possible to browse HackerNews without all these circlejerky posts? I'm talking about contextless direct links to the Firefox download page and documentation links. And now all the contextless "view your history on Google" links plaguing the front page. None of this is technical. If I wanted to read about today's social outrage, I'd go browse some tech group on Facebook. I miss actual interesting technical discussion and articles. This is worse than r/programming on a bad day, now.
ycombonator 7y ago
Is there a test to check whether a site is fingerprinting ?
- kube-system 7y ago
  There are likely some blacklists for known fingerprinting libraries. But, there's nothing that can tell you for sure, because it is also possible to fingerprint entirely server-side using the information your browser voluntarily transmits or contextual information about your connection.
banachtarski 7y ago
Serious question. Suppose we have this. I suppose my expectation is that instead of seeing the same ad over and over again, now I'm seeing effectively a random one. Why is this necessarily better? I guess personally, I've always thought that regulating the content of the ads, rather than the usage of sufficiently anonymized data for ad targeting.
- jeena 7y ago
  Ads that are not targeted don't have such huge impact on you as the targeted ones and therefor they don't trick you to buy something you don't need as easily which is good for you and the environment.
- treve 7y ago
  Getting a targeted advertising that is likely relevant to you is probably one of the few positives of tracking. The issue people have with tracking is not 'what ad am I getting on a given website'. To get a targeted ad they need to maintain a database of privacy infringing information. 3rd parties having this data, and what they might do it with it (or who they might lose the data to) is what many people have an issue with. Being served a targetted ad is just a strong signal that someone out there has this private data on you. For example, chances are that google has a pretty rich database of your location history. If not you specifically, they do for most people. You can probably imagine a few different scenarios where someone else obtaining that data could be bad for someone. You're trusting google with it, but is that trust warranted?
  - chrisshroba 7y ago
    Serious follow-up: I've always been fairly apathetic towards companies tracking me because I don't see too many plausible situations that would end up truly affecting me negatively. Do you have any examples (preferably that have happened in the past, but hypothetical are okay too) of what can go wrong if the tracking information falls in the wrong hands? Sure, street addresses, SSN's, credit card numbers would be bad, but why should I care if someone finds out that I'm a male aged 24 interested in backpacking, Apple products, and programming?
wybiral 7y ago
I've been really impressed with Firefox Quantum for the steps they've taken towards privacy and transparency. This definitely seems like the edge that Mozilla will have when trying to stand out against Chromium-based browsers going forward (especially now that everyone else seems to base their browser off of Chromium).
- ojosilva 7y ago
  I'm a big user of Firefox since I switched from Chrome 1 year ago for these reasons, but I wonder why don't they base their underlying engine on Chromium then build all their safety, privacy and other niceness on top of that? I know Mozilla has been working hard on the engine (rewrite with Rust?) and new versions like Firefox Focus on mobile is blazing fast, but keeping a separate renderer (and developer tools!), with its own issues and discrepancies, seems like a lot of sweat and pain when the Chromium project seems decently sound OSS. I know being able to put in practice your own interpretation of standards is a great exercise in freedom and web diversity, which seems to reinforce their mission, but still... the end result is probably millions in economic impact worldwide to keep website codebases aligned with browser standards, even if the differences are apparently minimal and 99% of the time it just works. Is being a fully independent browser Mozilla's main raison d'être?
hinkley 7y ago
I'm starting to wonder what would happen if you made a proxy that made your web browsing look like bot traffic.
- jamiek88 7y ago
  Captchas. Lots of captchas.
SmokeGS 7y ago
This might make me download Firefox
securityfreak 7y ago
All of this is fantastic. I just hope the day comes, when Google is no longer the default search engine in Firefox. Safari is my default browser, but I use Firefox heavily for “social” media accounts. I love the extensions.
- vidyesh 7y ago
  You can change the default to any other search engine you want. Just a few clicks away.
  - nsomaru 7y ago
    In the context, most users do not change the default
  - securityfreak 7y ago
    Yes, that is true. But the hypocrisy is how Firefox criticises Google (either directly or indirectly), but is paid by Google to have them as the default search engine. The emphasis is on the word default, not that you can't change it. The same thing goes for Apple with Safari. They disabled 3rd party cookies and promote privacy, but Google is still the default browser, for which Google pays a very large amount of money each year.
    - jrochkind1 7y ago
      They (implicitly) critisize some of Google's behavior, while taking Google's money, yes. What makes that hypocrisy? It would be hypocrisy if they were doing what they are critisizing; it's not clear to me it's hypocrisy to take money from someone who is... while still critisizing them! not critisizing them because you are getting money from them might be hypocrisy...
tadzik_ 7y ago
> At the top left of your Firefox browser, you will see an icon that looks like an i inside a circle. Click on it and then click on Content Blocking ...did anyone figure out what the hell that is supposed to be, or look like? Why wouldn't they just put a screenshot. Apparently they just mean the security settings and selecting Custom in those. Except it's on the right. And it's stripes, not a circle. shrug
- detaro 7y ago
  ⓘ
- StavrosK 7y ago
  Left of the URL on the URL bar is an information icon. Click that and click "custom" next to Content Blocking, or just go into the options at Security & Privacy.
dessant 7y ago
Google's reCAPTCHA makes it impossible to use large portions of the web once you take reasonable measures to protect your privacy. The challenge will continuously fail, despite you spending time to carefully solve it. This cruel behavior is described in a patent [1] by Kyle Adams of Juniper Networks. [1] https://patents.google.com/patent/US9407661 https://patents.google.com/patent/US9407661
- StavrosK 7y ago
  The audio CAPTCHA always works first try for me. The image CAPTCHA can go eff itself, it would always take me five tries while the images loaded super slowly.
  - dessant 7y ago
    Yes, the audio CAPTCHA is easier to solve, but the audio challenge is blocked [1] if you are not in a good network neighbourhood or they can't collect enough tracking data to classify your visit. [1] https://github.com/w3c/apa/issues/25 https://github.com/w3c/apa/issues/25
    - danShumway 7y ago
      Can confirm, it's rare for me to be able to get at the audio captcha. Occasionally I'll find that tabbing onto the the button allows it load when clicking directly on it won't. I assume if Google is observing behavior that makes them think you're sighted, they'll block access. I kind of wonder if it would be possible to force the issue legally as an accessibility problem, but other people than me would need to do it, and in any case it feels a kind of dirty to me to use blind accessibility as a tool in the fight for privacy. On the other hand, it also feels dirty to me that being blind would mean you're not allowed to do as much on the web to protect your privacy. Blind people should be able to use Tor.
      - wtmt 7y ago
        > Can confirm, it's rare for me to be able to get at the audio captcha. Occasionally I'll find that tabbing onto the the button allows it load when clicking directly on it won't. I assume if Google is observing behavior that makes them think you're sighted, they'll block access. That'd be very cruel to ignore those with vision, but who don't have anything close to perfect vision or correctable vision through glasses. It would also ignore those who have poorer vision as well as have difficulties in recognizing patterns. There's a whole spectrum of accessibility issues, and trying to "fail people" who seem to have enough vision to click on an audio button would be the definition of being evil. > I kind of wonder if it would be possible to force the issue legally as an accessibility problem, but other people than me would need to do it, and in any case it feels a kind of dirty to me to use blind accessibility as a tool in the fight for privacy. Even if this is not possible legally in all jurisdictions, enough publicity and outrage could help. There should certainly be some journalists from major publications/site reading HN (or HN readers with journalist contacts) who can investigate and write about this.
stockkid 7y ago
> Keep in mind that blocking fingerprinting may cause some sites to break. This represents the sad state of Internet we are all living through. I have noticed that when I turn on privacy settings on Firefox, some major websites are broken and rendered unusable. It seems that the Internet is rampant with tracking and privacy violation, and we consumers are passively accepting it, by and large.
- kgwxd 7y ago
  I haven't had an issue, but I avoid "major websites" like the plague, as they are the modern equivalent (though measles is making a comeback). If a site breaks with good privacy settings, it's a decent indicator you're better off not visiting. If a breaking site shows up on my radar too much, I add the domain to an add-on I made to hide links to it on any page. My HN/reddit/search results/etc views usually have a few blank lines, they're links to domains I have determined I never want to visit ever again. My RSS reader gets a variation of the filter, so they don't show up there either. It feels really good to have the power to remove an entire site from my personal internet.
  - stockkid 7y ago
    > I add the domain to an add-on I made to hide links to it on any page. That sounds interesting. Have you published it or made source available? I'd love to try.
    - kgwxd 7y ago
      I published it [1], but only because I had to in order to use it without adding and approving it every time I started Firefox :/ I originally thought I had made the source available but eventually realized the code repo on Mozilla was only available to me (not sure what the point of that is). You just inspired me to get it up on github [2]. It's a pain to configure but the example JSON in the "Preferences" section of the add-on should be enough to get started. Just paste it into the textarea, save, then visit HN or Reddit, you'll probably see a few blank lines where links should be. Right now, the top post on HN is a WSJ link. I don't want to see their links because I don't ever want to click them just to hit a paywall I already know I'll never accept. So my HN page looks like this [3]. The tool uses regular expressions on text and element attribute values. Anything that matches gets a given CSS style applied. I think it would be great if uBlock Origin could do this but it doesn't allow the level of granularity needed to accomplish the end result. [1] https://addons.mozilla.org/en-US/firefox/addon/ssure/ https://addons.mozilla.org/en-US/firefox/addon/ssure/ [2] https://github.com/7w0/ssure https://github.com/7w0/ssure [3] https://i.imgur.com/pEV50xr.jpg https://i.imgur.com/pEV50xr.jpg
bitdeep 7y ago
Damn... I was using some fingerprint to prevent sensitive accounts to be stolen or misused, now moz guys is taking away my cake.
quickthrower2 7y ago
Are they are biting the hand that feeds them? Interesting relationship with Google - they get revenue from them, but are a competitor with conflicting ideals. I'd like to see Firefox premium services (like a dropbox clone etc.) to provide independent revenue, so they can be aggressive for privacy.
thomasfedb 7y ago
Recent progress in Firefox contrasts very strongly with Chrome. I know I'm very happy to be a FF user right now.
geekamongus 7y ago
It seems that almost weekly, I am reminded why I love Firefox because of some new thing Mozilla is doing. A lot of good decisions have been coming from them lately.
- codsane 7y ago
  I finally made the switch from Brave today and I'm never going back. Firefox is just as privacy-conscious, supports built-in tracker blocking, fingerprinting, and has full sync that Brave hasn't implemented yet.
  - rjf72 7y ago
    Just as privacy conscious is a misleading statement. Choosing to migrate their default search to Google was a money grab by Firefox and that money is, in turn, 100% dependent upon tracking. I think this is why what limited privacy options Firefox does offer are entirely opt-in, and often hidden behind menus that your average user will probably never visit. By contrast Brave has had things such as blocking of fingerprinting for months (years?), and also natively supports OPT-OUT ad blocking, script blocking, third party cookie blocking (which FireFox does also but once again in a less direct fashion), single click native TOR access + ID swapping anywhere, and more. And I think the biggest difference is that this is all directly exposed to the user. If a user clicks the big iconic Lion icon in the top right they get a popup that shows nothing but: - [x] Shields Up (adblocking/etc) - [x] Third party trackers blocked - [x] Connections forced to HTTPS - [x] Scripts blocked - [Third Party/All/None] Cookies blocked - [Third Party/All/None] Device recognition blocked So even users that know absolutely nothing and don't bother to navigate through menu options will almost definitely immediately be exposed to all of these privacy options, though again given the opt-out nature of much of it - even if they weren't, it would be less of an issue.
    - asenna 7y ago
      > Choosing to migrate their default search to Google was a money grab by Firefox and that money is, in turn, 100% dependent upon tracking Well it was not a bad decision to make since most of their users would set Google as their default anyway (no matter how privacy concerned you are, you still can't do without Google search unless you really really try hard, which most people don't). In my opinion it was a sensible decision.
terrycody 7y ago
Awesome feature, already activated it!
somezero 7y ago
Does using "User-Agent switcher" or similar extensions have any effect on this functionality?
shard972 7y ago
dang rapes children.
rhaksw 7y ago
I've had some issues maintaining reVddit.com while keeping Firefox's tracking protection in mind. I'd love some help if there is anyone who can provide insight. Basically, you can't load reVddit pages on Firefox because reVddit accesses reddit's API, and reddit is listed on Firefox's list of websites that are considered trackers [1]. In my uneducated opinion, this list is weird. I had some discussion about this with Mozilla devs [2]. In that message chain, devs acknowledged reVddit is not doing anything wrong, rather it is reddit who could infringe users' privacy. Yet it is the non-infringing site that breaks. Further, the devs' suggestions for remedy are not workable. They propose moving requests to the server so that reVddit.com makes the requests to reddit.com. There are multiple problems with this, * It would hide more code from users * Reddit rate-limits requests coming from a single source * Infrastructure becomes expensive on what is supposed to be a low cost website My conversation with devs was good but needs more. Is there any solution here, or do we just go our separate ways? [1] https://github.com/disconnectme/disconnect-tracking-protection/blob/master/services.json https://github.com/disconnectme/disconnect-tracking-protecti... [2] https://groups.google.com/d/msg/mozilla.dev.privacy/XO84EzrwWp0/t3cgc7H-AgAJ https://groups.google.com/d/msg/mozilla.dev.privacy/XO84Ezrw...
- Mathnerd314 7y ago
  There is a similar bug in Bugzilla for redditp.com, open since 2015: https://bugzilla.mozilla.org/show_bug.cgi?id=1235978 https://bugzilla.mozilla.org/show_bug.cgi?id=1235978 My general impression is that tracking protection is low-priority for Mozilla and anyone who actually cares is using uBlock Origin / uMatrix or similar extensions since those use filter lists that are actually updated.
  - rhaksw 7y ago
    > My general impression is that tracking protection is low-priority for Mozilla It is on by default, and as you point out, breaks many innocent sites. People may migrate elsewhere. That should bump up its priority.
Justsignedup 7y ago
I've used this feature in the past. There are some weirdneses. You lose your timezone and ALL dates appear in UTC. This is definitely not desirable. Fingerprinting cannot be allowed for some sites, and thus things like android messages cannot work because it cannot accurately identify the browser. Hopefully they'll do something about all this.
- kabacha 7y ago
  > You lose your timezone and ALL dates appear in UTC. Seems like an easy fix would be to have client based converter, even more simple than what fingerprint blocker does with screen resolution.
dingo_bat 7y ago
I'm tired of the daily spam from Mozilla on the front page.
ddffre 7y ago
What about them selling their data on the darkweb? They claimed that there was no breach, but yet all of their database is being sold on the darkweb. Is it so easy to gather their database and publish it?
- eVeechu7 7y ago
  Who is them? Whose database?
  - ddffre 7y ago
    Truecaller: https://techunalt.com/truecaller-data-sold-on-dark-web/ https://techunalt.com/truecaller-data-sold-on-dark-web/
hwj 7y ago
The German version of that article has a casual slang: > Clearly, you don't want to throw your computer out of the window and never use the internet again, just to get rid of ads. https://blog.mozilla.org/firefox/de/loesche-deinen-digitalen-fingerabdruck-in-firefox/ https://blog.mozilla.org/firefox/de/loesche-deinen-digitalen...
anoplus 7y ago
I am posting this again, because I still didn't get opinions about it and I think it is important. How much of Firefox success depends on donations? I have seen successful crowd-funding projects where the budget is always transparent and communicated to the public. I am certain this motivates the masses to donate. Wouldn't it be better for Mozilla to make their funding fully transparent to attract the masses?
- tngranados 7y ago
  I'm not sure how transparent they are about their finances, but most of Mozilla funding comes from search engines deals to make them default in certain regions (Yahoo, Google, Yandex and Baidu).
b-3-n 7y ago
Firefox is playing its trump, the privacy, very well lately. This is very smart as the competition has no good answer. Equalizing on privacy level would go against their business model so they won't ever do it wholeheartedly. Trying out Firefox now...
- jopsen 7y ago
  > Equalizing on privacy level would go against their business model... More importantly it would go against the mission statement. Mozilla isn't around to make money, it's around to make progress toward a mission. (Search revenue helps fund that, but revenue is not the end goal for Mozilla).
  - _bAp_ 7y ago
    He was talking about the competition, not Mozilla.
bojanvidanovic 7y ago
Firefox is really stepping up in the game of online privacy. I switched to Firefox almost 2 years ago and never looked back.
scoutt 7y ago
I wonder is there is the possibility (or if someone came across) of saving (and loading) all the data of a fingerprint state, or to be able to craft one, modify it, or share it. That is, all the metadata (cookies, history, etc.) that supposedly identifies a user-type. It could be interesting to have a drop-down in the browser to select a "who I want to be today" profile and be able to see the world from that perspective.
porky 7y ago
At first I read "block Fingering with Firefox"
kakkksaknmdm 7y ago
I worked in the ad industry. Every web-browser including brave, tor,safari is uniquely identifiable even on same hardware. All the public computer researchers and browser vendors are years behind the techniques to fingerprint devices (probably 5+). Canvas, WebGl etc are techniques of the past. There are much more advanced ones, than can identify devices with completely uniquely (on both desktop and mobile) Also we know when users fake their fingerprints, and the algorithm respects the decision even though we know who the user is despite faking with all state of the art methods. Latest methods dont even use JavaScript. Just CSS is enough to identify every device uniquely but you'd need JS to send the data back. Every public researcher I've seen are given honeypot techniques that they consider state of the art even thought the industry is way ahead of the researchers.
- senorjazz 7y ago
  If this is the case, then the millions if not billions of adfraud is put through by the ad companies knowingly and defrauding the ad-buyers surely?
  - kakkksaknmdm 7y ago
    Large companies have fixed ad spend budgets. If they dont spend they lose. Doesn't matter if its lost to fraud. Google, Facebook advertiser have more specific budgets, especially Facebook which has a large number of small advertisers. Large adnetworks however get large advertisers with advertising budgets in tens of millions on average. There is a larger pressure on Google and Facebook to be competitive then say smaller ad networks. Also the techniques that I mention of are not in use in wild after the POC on millions of devices few months ago. They're a backup plan. Also not every adtech company has them. Maybe 2 or 3 at the most are at the cutting edge of tracking. Google knows this very well. You really think Google couldn't counter fraud? Its a fake and manufactured outrage. No one wants to give away their "secret sauce" just yet. Also right now many adtech companies are going bankrupt. Many larger one are waiting for smaller ones to be gone after which the landscape changes.
    - soverance 7y ago
vxNsr 7y ago
As much as I hate more legislation I think the only way to solve this is to make it very onerous to own and compile this data and to level heavy fines (as in criminal charges and/or force the company into bankruptcy via 90% revenue fines) in cases when the database is breached. Everything else will just turn into an arms race between those who don't wanna be tracked and those who wanna track. If the US did something like the GDPR but in our constitution I wouldn't be surprised if a cottage industry opened up overnight in secure data-warehousing. I get that it would complicate things for small companies but we brought this on ourselves.
- joaobeno 7y ago
  These companies then lobby the government, asking to be relieved of the fines, because if they go down, so many workers will be out of jobs, and that they will comply (pinky promise), so the fines should be lifted to help these innocent people...
t0astbread 7y ago
How does this work? Does it just block domains known to host fingerprinting scripts? If no, how does it hide addons and settings that interfere with the website? And how does it prevent leaking information by itself that can assist fingerprinting?
mod_stretch 7y ago
Mozilla has been up to some questionable activity lately as well. They blocked the Dissenter extension.
muxator 7y ago
Whatsapp web does not show the authentication QR code if resistFingerprinting is on. This is annoying at minimum. I would happily use another IM, but the bad thing about network effect is that one would need to convince everyone else to make the switch, too. In order to take over, freedom-respecting services need to become _better_ than the non free ones not only on a technical level, but on a UX one, too.
- roboyoshi 7y ago
  which is basically impossible of you're a non-profit or donation based insitution versus a multi-billion dollar company. It's why Evernote is still unreplaced and dropbox has the best filesync. Anyy,way.. I've heard good stuff about matrix so will try to setup this over the weekend.
thejohnstone 7y ago
You should try Kameleo software manipulate your fingerprint!

1292 points by rendall 7y ago

> You probably wouldn’t appreciate someone tracking your moves in real life. There’s no reason to accept it online. Great to read something like this on mozilla.org.

deleted 7y ago
[deleted]
tacosx 7y ago
The revolt against surveillance capitalism seems to just be starting in earnest. I think a lot of smart people are finally realizing they have wasted their considerable talents on advertising tech while pretending it was something else and are now very angry.
- TaylorAlexander 7y ago
  I’d like to believe this, but I think it will take more time.
ngokevin 7y ago
Kind of funny though, the vast majority of Mozilla's money comes from the ads and tracking industry, just one step removed.
- Drdrdrq 7y ago
  Yes, but that is just because they represent a risk for Google. Their incentives are quite different than Google's, and that is what matters.
  - ngokevin 7y ago
    Not as much as risk. More of not wanting to be seen as a monopoly. Giving up 1% of the browser market share and a few pennies is worth it to not be seen as the virtual dictator of the Web.
    - Drdrdrq 7y ago
      Also true.
- ChrisSD 7y ago
  The irony is they tried diversifying their income. But people don't want their browser to ask for donations (that's nagging). They don't want their new tab page pre-populated with websites on a new install (even if their browsing overwrites them). They don't want "fun" additions to advertise TV shows (even if they're opt-in). But they're happy to pay via google's search and tracking. Mozilla doesn't have a lot of options open to them.
  - ademup 7y ago
    Firefox has ~250M users as of about 9 months ago and $562M revenue for 2017. I'd honestly pay $2 per month (12 times "my share") for a Firefox that completely disavows the ad model and produces a truly user-centric experience sans ads, fingerprinting, etc. However, given that over 95% of their revenue comes from Royalties, I don't see that turning around any time soon.
    - thethirdone 7y ago
      > Firefox has ~250M users as of about 9 months ago and $562M revenue for 2017 I think nearly everyone would be willing to pay the ~$2/year to use Firefox if all browsers weren't free. At that price, the main reason not to pay is the hassle rather than just downloading. Thanks for the context about the revenue of Firefox. I had never given it any though.
      - godelski 7y ago
        They have on their donations a monthly donation. That's hassle free. You can also donate to them through Amazon smile.
      - Fnoord 7y ago
        > I think nearly everyone would be willing to pay the ~$2/year to use Firefox if all browsers weren't free. Don't forget $2 in USA buys you different things than in Russia, China, India, or Africa.
    - simias 7y ago
- TheRealPomax 7y ago
  And? I used to work for a defense contractor, using the military complex money to instead pay for civil projects that actually benefit normal people. You can take money that comes from "I don't like this thing", and then spend it on "this benefits everyone".
  - ngokevin 7y ago
    Does the defense contractor rag on the military afterwards? You can take money from something, use it for good, but it's kinda funny when you start to claim the hands that feeds you is evil and bad.
    - Fnoord 7y ago
      This is how OpenBSD lost their DARPA funding. [1] [1] https://lwn.net/Articles/29937/ https://lwn.net/Articles/29937/
    - TheRealPomax 7y ago
      Given that they were a 60k employee company: yeah, some parts of them probably were.
  - pbhjpbhj 7y ago
    If that's truly your rationale then you're deluding yourself: you can take money, for sure, but as soon as you act to aid the source of the money then you're complicit in whatever that source is doing. You might consider the positive aspects of your use of the money out with the negative aspects of your aiding murder, say, but that's not quite what you outlined.
    - TheRealPomax 7y ago
      And that's why everyone who works for Google or Facebook should quit, too, but in the real world there are an insane amount of jobs that ultimately do really bad things, and we need work. So find somewhere that your particular skillset makes a net positive contribution instead of going homeless because almost every single big company is responsible for suffering in the world. The defense contract I worked for also has a strong civil presence and makes things like turn stiles, card readers, and emergency alert systems, and those directly benefit people rather than help murder folks. The idea that "my work directly benefits the part of the company that murders people", given how budgets actually work in large companies, is arguably far more delusional here.
- derefr 7y ago
  What’s wrong with using the resources of evil (freely given, oddly enough) to destroy evil? If someone you hate offers you a billion dollars, you should take it—because in doing so you’ve made someone you hate a billion dollars poorer! It’s like stealing the money from them, with less work! Imagine, analogously: a lottery whose proceeds go to a charity supporting statistics education.
  - pbhjpbhj 7y ago
    If someone you hate gives you $1 million though, and says "I'll pay you again next year if you do well for me, you might even get more" then you're going to find that if you take the money in a few years all your decisions are centred around the happiness of the person you once hated. If you keep taking their money you're morally complicit in their actions too.
    - derefr 7y ago
      > all your decisions are centred around the happiness of the person you once hated You’re essentially talking about the https://en.wikipedia.org/wiki/Cobra_effect https://en.wikipedia.org/wiki/Cobra_effect. (The government sets a bounty on snakes? Bounty hunters realize that the cheapest way to get snakes to turn in to the government, is by breeding them themselves. Now you’ve got more live snakes, not fewer.) When greed or need-for-money is an incentive (such as in a for-profit corporation), you’ll be driven to do whatever perpetuates the income stream; and, if someone is paying you to do something, it’s cheaper to just do that thing because you get to continue working with them in the future (so your marketing costs for finding new work are zero.) But, importantly, the Cobra effect doesn’t apply if your goal (as a person, or as an organization) isn’t to make money, but rather to use up money (i.e. to bankrupt your ‘patron.’) If you’re not a bounty hunter, but simply someone who hates snakes, you won’t ever bother to breed them. You’re not in it for the money. You’re in it for there being fewer cobras. There are, of course, organizations which are not for-profit corporations. Mozilla itself is a non-profit, despite there also existing a Mozilla Corporation. As well, even with a for-profit corporation, the income of such an organization can be completely divorced from how it deals with an arbitrary stream of money. Banks, for example, despite being for-profit corporations, do not spend the money you deposit with them. Your money is not an asset on their balance sheet; in fact, it’s a liability. Mozilla Corporation could, for example, just donate all the money it receives from unsavoury sources over to Mozilla-the-nonprofit, and keep none for itself. This would remove its profit motive vis. this income source. Analogies: Police confiscate stuff from criminals, and then sell that stuff at auction. They aren’t driven to confiscate as much stuff as possible, because they don’t directly see the proceeds from those auctions (it goes into the city budget, which does eventually fund them back, but in some inscrutable, non-motivating way.) Instead, the police department usually just has a mandate to take the stuff and sell it. (There is a broken incentive around police confiscation of drugs and cash, because these are so hard to trace that police can and do directly profit from these confiscations. But money wired between corporations as a result of an invoice is not untraceable like cash, so the confiscation of cash isn’t really analogous. A closer analogy is the confiscation of pimped-out cars—the police do not, and cannot, make personal use of these. So they don’t really care how many they find.) Oil-and-gas engineers aren’t driven to flare as much natural gas out of oil fields as possible, because there’s no useful purpose to flaring natural gas (for now); they’re just trying to use it up and get it out of the way of the stuff they do want. Building renovation contractors aren’t driven to collect as much asbestos as possible. They only collect and remove it because they can’t certify the building until it’s all gone. (Imagine an alternative world where you could turn in asbestos to the government for a reward. We’d get a Cobra effect so fast.) In all these cases, you’re not driven by your need to collect the thing; and there’s no element of greed driving you to collect the thing; it’s just part of your job to collect the thing. As you diminish the number of illegal weapons out there, or amount of natural gas in the oil field, or the amount of asbestos left in buildings... you can simply do less sequestering. Nobody is put out when criminals run out of guns, not even the police. The oil-and-gas engineers who did the burn-offs are done their work at that oil field, sure, but they just move on to another oil field. The renovators have plenty of other jobs to do, and the people who specifically handle asbestos removal will just retrain to remove the next thing people want gone from buildings, toxic mould or what-have-you. —— What we’re essentially talking about, here, is a ‘parasitic’ nonprofit—the organizational equivalent of a mosquito, something that wanders around sucking its ‘hosts’ dry, but which doesn’t expect (or attempt) to subsist indefinitely on a single ‘host’. It expects to either kill its host; be killed by its host; or be “swatted away” by its host, at which point it can find a new host. And, because a parasitic organization serves no useful purpose to its host—it offers no attempt at symbiosis—the host will eventually become aware of its nature, though how fast this happens can vary dramatically, depending on how bureaucratic the host is, and the time-scale of the deal the host and parasite originally made. (Imagine how long it would take the US government to figure out that a weapons subcontractor is a foreign-government led operation with the aim of “siphoning money out of the US defense budget while avoiding actually satisfying the demand for a given weapon”, purely through the regular business-side interactions between the government and the contractor, without the assistance of the government’s background-checking process. Unlike governments, private companies do not generally do background checks on their contractors’ employees, so an IBM, or a GE, is not safe from this attack.) Of course, unlike in the animal realm where every animal at some point deals with a parasite from a state of complete ignorance, parasitic organizations can get reputations that precede them everywhere. This is what I’d call the host “killing” the parasite nonprofit. But, well, the same people can form as many organizations as they want... and perhaps even use successive organizational vehicles to drain the same host companies repeatedly, if they just ensure to put a different face (different figurehead CEOs, etc.) on the parasite each time. These are the same proven strategies that “fake” charities use every day to line their own pockets! Just turned to a purpose other than selfishness.
- BlueTemplar 7y ago
  Well, we could change that. I've subscribed for a monthly donation to Mozilla after learning about that. I've also been giving through Flattr as an alternative to ads for micro-funding on the Web - anyone knows why their plugin/extension/addon isn't listed on addons.mozilla.org anymore ? (You can still install it from their official website.) Might it be due to a conflict of interest between Google and Eyeo ?
ngold 7y ago
“A lot of the scripts that are run to enable tracking delay webpage load times while all these tracking scripts fire and run in the background,” said Peter Dolanjski, Firefox Product Lead. Over at Google they are trying to sell fingerprinting as a feature.
- skybrian 7y ago
  What do you mean? Link?
  - RonanTheGrey 7y ago
    Fingerprinting is the primary way that Captcha decides whether to block you or not. Fingerprinting == security is the parallel they are drawing.
    - skybrian 7y ago
      Ok, that makes sense. Not ideal, but captchas need to be written somehow.
      - akerro 7y ago
        Modern captchas are designed to be anti-human and use as for free training of their AI algorithms. We're slaves for free while Google benefits from this, both technologically and financially. Next captcha from google will be even more aggressive, you're not logged to Google = you're a bot, you can't access that content.
        CaptainZapp 7y ago
        Next captcha from google will be even more aggressive, you're not logged to Google = you're a bot, you can't access that content. You may be right. But you know what: If I encounter captchas nowadays and unless I really need to get to that site it's "Fuck you very much!" time. I'm just not that interested in most of the web to make it woth my while and provide free work for Google.
msla 7y ago
Ironic, though, given their stance on opt-out-only telemetry.
- dralley 7y ago
  99% of what telemetry tracks has nothing to do with user actions. It's mostly stuff like this: https://metrics.mozilla.com/webrender/dashboard_nvidia.html https://metrics.mozilla.com/webrender/dashboard_nvidia.html
  - pbhjpbhj 7y ago
    99% of a thugs day is not smashing people in the face so that must mean there entirely benign, right? In short your metric doesn't work.

Despegar 7y ago

As always when it comes to Firefox and privacy, the question is why isn't it on by default?

stuff4ben 7y ago
Because it may cause some websites to break and they're aiming to provide a good user-experience for the majority of the population. If they turn this on by default without users knowing the risks of sites not working correctly, they'll unfairly blame Firefox, bad mouth it, and switch to Chrome/Edge/Safari/etc.
- Despegar 7y ago
  That's the stated reason but it's pretty weak to me. Safari hasn't had to make similar compromises.
  - deleted 7y ago
    [deleted]
  - deleted 7y ago
    [deleted]
  - mevile 7y ago
    I don't think you've turned on very strict anti-tracking in a browser if you think that's a weak reason. The setting can really break websites, making them unusable or whole blocks of content don't load. Before this update I used to use Privacy Badger and it also broke websites all the time. I don't believe Safari has anything like what Firefox or Privacy Badger offers built in. So you wouldn't be able to use your default experience with Safari as a comparison.
    - benoliver999 7y ago
      I had to turn it off in Firefox. It was breaking stuff like image uploaders on ebay.

emptyparadise 7y ago

Google Recaptcha becomes absolutely unbearable once you use this and also block Google cookies on non-Google sites. Given all that, features like this will not make their way to Chrome.

lcao 7y ago

Yes, the same browser that sent the raw browsing history of a portion of users to a third party. Talk about tracking! >Users who receive a version of Firefox with Cliqz will have their browsing activity sent to Cliqz servers, including the URLs of pages they visit. https://blog.mozilla.org/press-uk/2017/10/06/testing-cliqz-in-firefox/ https://blog.mozilla.org/press-uk/2017/10/06/testing-cliqz-i...

jszymborski 7y ago
Damned if you disclose your responsible stewardship of user data, damned if you don't. > Less than one percent of users in Germany installing Firefox from our main download page will receive a version of Firefox with Cliqz recommendations enabled out of the box. > Cliqz does not build browsing profiles for individual users and discards the user’s IP address once the data is collected. > One of Mozilla’s core privacy principles is No Surprises: we will use and share data in ways that are transparent and benefit our users. That is why we are telling you about this today. We > We hope that users will appreciate the improved experience, but if users want to turn it off, they can always disable data collection or remove the Cliqz add-on entirely.
- jimmaswell 7y ago
  It was done to less than 1% of users so it's okay? Obviously Chrome is worse but this still sounds bad to me.
- sdoering 7y ago
  Sorry. If I want my data somewhere else I can stay with Chrome. I switched years ago because of performance reasons. Whenever I tried to switch back I felt stabbed in the back shortly thereafter by Mozilla.
  - JoshMnem 7y ago
    Chrome is much worse. It seems like chopping a leg off because someone stepped on a toe.

xvector 7y ago

Can someone paste their results (or at least bits of fingerprinting entropy) from https://panopticlick.eff.org https://panopticlick.eff.org with the latest Firefox? With the fancy new anti-fingerprinting Safari on macOS Mojave I get just over 14.5 bits of entropy with the most entropic source being my canvas fingerprint (1 in 600). With Safari on iOS I get 11.71 bits of entropy, with the most entropic value being my screen size and color depth.

numakerg 7y ago
Panopticlick says I have "strong protection against Web tracking" but amiunique.org says I'm unique. Though amiunique also claims my TOR is fingerprint is one of six.
- godelski 7y ago
  I get very different results from each. Some don't quite make sense to me. For example, amiunique says Timezone 3.37%. Panopticlick says 1 in 16, so half as bad. But how the hell is that timezone so identifying? I live on the west coast, how is that timezone so identifying?
gruez 7y ago
>With the fancy new anti-fingerprinting Safari on macOS Mojave I get just over 14.5 bits of entropy with the most entropic source being my canvas fingerprint (1 in 600). That's actually pretty good, considering tor browser (which has resistfingerprinting enabled) with default window size (1000x1000) has 14.82 bits of entropy.
mlok 7y ago
I have 3 more bits of identifying information than you. (block fingerprinting enabled)
Twirrim 7y ago
Interestingly enough, uBlock Origin actually stops that site from working, seems to break the fingerprinting step. If i disable uBlock, I get 16.63 bits of identifying information. Likewise the canvas fingerprint is the biggest, in my case 1 in 101154.

Causality1 7y ago

AdNauseam is an extension that clicks ads at random in the background, thus polluting your user data. It was useful enough to get banned from the Chrome web store.

floatingatoll 7y ago
It’s probably wise not to encourage interstate advertising fraud that the FBI might decide to investigate and arrest you for knowingly participating in. https://www.fastcompany.com/90273549/fbi-and-google-take-down-multi-million-dollar-ad-fraud-operation https://www.fastcompany.com/90273549/fbi-and-google-take-dow...
- Causality1 7y ago
  They arrested people for making money by generating fake clicks on their own site. AdNauseam isn't ad fraud any more than running a web crawler bot is ad fraud.
  - floatingatoll 7y ago
    I’m sure you’ll be fine, eventually - but that’s not guaranteed to stop them initially, or without a digital search of your entire computer, for example.
    - Causality1 7y ago
      Do you have any evidence that any AdNauseam user has ever been arrested for ad fraud?
      - SquareWheel 7y ago
        They said they "might decide to investigate". That suggests it's a real possibility but not something that has previously happened.
      - floatingatoll 7y ago

amanzi 7y ago

I use the Strict blocking setting and have no need for a separate adblocker.

cypherpunks01 7y ago

Does this just turn on the privacy.resistFingerprinting flag? I liked that flag but it set all sites to UTC time which caused me random issues..

cpeterso 7y ago
No, this is different. This feature is a block list of known fingerprinting and cryptomining scripts. The privacy.resistFingerprinting flag changes Firefox settings that scripts use to fingerprint users, such as User-Agent string, window dimensions, and time zone (as you mentioned). The flag is enabled in Tor but not Firefox because the setting changes can break some websites or hurt performance.

ziddoap 7y ago

I find it really interesting that when a company is making moves in a direction that benefits privacy of consumers, everyone takes the opportunity to shit on them for past mistakes or how it isn't good enough or why isn't it on by default or any other thing they can find to shit on. Yes, every single company has made mistakes. FireFox is no exception. Some of them were pretty egregious. Mistakes are - hopefully - an opportunity to learn and adjust, move forward, and continue progress towards something we all want: privacy. We should absolutely call out companies when they make mistakes or ill-advised choices. I'm not saying we shouldn't. However, we should also _applaud_ efforts that are in-line with bringing privacy to consumers. Not just spend all of our time looking for something negative to be outraged at. This always-negative/outrage attitude just erodes any sort of meaningful discussion.

flukus 7y ago
Good reputations are hard to gain and easily lost, we shouldn't forget how we got to the sorry current state of the web and Mozillas mistakes are a large part of how that happened. Had mozilla not pissed away market share while they rewrote things in rust, broke extensions, built a horrible UI, etc, then they would have had enough weight to do things look push back against DRM. Obviously having a spyware company like google control the web is a bad thing, but that doesn't make mozilla good, they've been poor stewards for a long time and we should be looking toward others, the pale moon fork to name one example.
roca 7y ago
It also reduces incentives to actually make moves that benefit privacy. Because if the people who say they care about privacy aren't going to support you, why bother?
- scarejunba 7y ago
  Nah, the people who care are happy. The problem is the guys who like to talk. It's the same with security. There's like an army of people who've learned about it from internet commentary exclusively and they bluster a lot as a substitute for competence.

dymk 7y ago

Is it possible to browse HackerNews without all these circlejerky posts? I'm talking about contextless direct links to the Firefox download page and documentation links. And now all the contextless "view your history on Google" links plaguing the front page. None of this is technical. If I wanted to read about today's social outrage, I'd go browse some tech group on Facebook. I miss actual interesting technical discussion and articles. This is worse than r/programming on a bad day, now.

ycombonator 7y ago

Is there a test to check whether a site is fingerprinting ?

kube-system 7y ago
There are likely some blacklists for known fingerprinting libraries. But, there's nothing that can tell you for sure, because it is also possible to fingerprint entirely server-side using the information your browser voluntarily transmits or contextual information about your connection.

banachtarski 7y ago

Serious question. Suppose we have this. I suppose my expectation is that instead of seeing the same ad over and over again, now I'm seeing effectively a random one. Why is this necessarily better? I guess personally, I've always thought that regulating the content of the ads, rather than the usage of sufficiently anonymized data for ad targeting.

jeena 7y ago
Ads that are not targeted don't have such huge impact on you as the targeted ones and therefor they don't trick you to buy something you don't need as easily which is good for you and the environment.
treve 7y ago
Getting a targeted advertising that is likely relevant to you is probably one of the few positives of tracking. The issue people have with tracking is not 'what ad am I getting on a given website'. To get a targeted ad they need to maintain a database of privacy infringing information. 3rd parties having this data, and what they might do it with it (or who they might lose the data to) is what many people have an issue with. Being served a targetted ad is just a strong signal that someone out there has this private data on you. For example, chances are that google has a pretty rich database of your location history. If not you specifically, they do for most people. You can probably imagine a few different scenarios where someone else obtaining that data could be bad for someone. You're trusting google with it, but is that trust warranted?
- chrisshroba 7y ago
  Serious follow-up: I've always been fairly apathetic towards companies tracking me because I don't see too many plausible situations that would end up truly affecting me negatively. Do you have any examples (preferably that have happened in the past, but hypothetical are okay too) of what can go wrong if the tracking information falls in the wrong hands? Sure, street addresses, SSN's, credit card numbers would be bad, but why should I care if someone finds out that I'm a male aged 24 interested in backpacking, Apple products, and programming?

wybiral 7y ago

I've been really impressed with Firefox Quantum for the steps they've taken towards privacy and transparency. This definitely seems like the edge that Mozilla will have when trying to stand out against Chromium-based browsers going forward (especially now that everyone else seems to base their browser off of Chromium).

ojosilva 7y ago
I'm a big user of Firefox since I switched from Chrome 1 year ago for these reasons, but I wonder why don't they base their underlying engine on Chromium then build all their safety, privacy and other niceness on top of that? I know Mozilla has been working hard on the engine (rewrite with Rust?) and new versions like Firefox Focus on mobile is blazing fast, but keeping a separate renderer (and developer tools!), with its own issues and discrepancies, seems like a lot of sweat and pain when the Chromium project seems decently sound OSS. I know being able to put in practice your own interpretation of standards is a great exercise in freedom and web diversity, which seems to reinforce their mission, but still... the end result is probably millions in economic impact worldwide to keep website codebases aligned with browser standards, even if the differences are apparently minimal and 99% of the time it just works. Is being a fully independent browser Mozilla's main raison d'être?

hinkley 7y ago

I'm starting to wonder what would happen if you made a proxy that made your web browsing look like bot traffic.

jamiek88 7y ago
Captchas. Lots of captchas.

SmokeGS 7y ago

This might make me download Firefox

securityfreak 7y ago

All of this is fantastic. I just hope the day comes, when Google is no longer the default search engine in Firefox. Safari is my default browser, but I use Firefox heavily for “social” media accounts. I love the extensions.

vidyesh 7y ago
You can change the default to any other search engine you want. Just a few clicks away.
- nsomaru 7y ago
  In the context, most users do not change the default
- securityfreak 7y ago
  Yes, that is true. But the hypocrisy is how Firefox criticises Google (either directly or indirectly), but is paid by Google to have them as the default search engine. The emphasis is on the word default, not that you can't change it. The same thing goes for Apple with Safari. They disabled 3rd party cookies and promote privacy, but Google is still the default browser, for which Google pays a very large amount of money each year.
  - jrochkind1 7y ago
    They (implicitly) critisize some of Google's behavior, while taking Google's money, yes. What makes that hypocrisy? It would be hypocrisy if they were doing what they are critisizing; it's not clear to me it's hypocrisy to take money from someone who is... while still critisizing them! not critisizing them because you are getting money from them might be hypocrisy...

tadzik_ 7y ago

> At the top left of your Firefox browser, you will see an icon that looks like an i inside a circle. Click on it and then click on Content Blocking ...did anyone figure out what the hell that is supposed to be, or look like? Why wouldn't they just put a screenshot. Apparently they just mean the security settings and selecting Custom in those. Except it's on the right. And it's stripes, not a circle. shrug

detaro 7y ago
ⓘ
StavrosK 7y ago
Left of the URL on the URL bar is an information icon. Click that and click "custom" next to Content Blocking, or just go into the options at Security & Privacy.

dessant 7y ago

Google's reCAPTCHA makes it impossible to use large portions of the web once you take reasonable measures to protect your privacy. The challenge will continuously fail, despite you spending time to carefully solve it. This cruel behavior is described in a patent [1] by Kyle Adams of Juniper Networks. [1] https://patents.google.com/patent/US9407661 https://patents.google.com/patent/US9407661

StavrosK 7y ago
The audio CAPTCHA always works first try for me. The image CAPTCHA can go eff itself, it would always take me five tries while the images loaded super slowly.
- dessant 7y ago
  Yes, the audio CAPTCHA is easier to solve, but the audio challenge is blocked [1] if you are not in a good network neighbourhood or they can't collect enough tracking data to classify your visit. [1] https://github.com/w3c/apa/issues/25 https://github.com/w3c/apa/issues/25
  - danShumway 7y ago
    Can confirm, it's rare for me to be able to get at the audio captcha. Occasionally I'll find that tabbing onto the the button allows it load when clicking directly on it won't. I assume if Google is observing behavior that makes them think you're sighted, they'll block access. I kind of wonder if it would be possible to force the issue legally as an accessibility problem, but other people than me would need to do it, and in any case it feels a kind of dirty to me to use blind accessibility as a tool in the fight for privacy. On the other hand, it also feels dirty to me that being blind would mean you're not allowed to do as much on the web to protect your privacy. Blind people should be able to use Tor.
    - wtmt 7y ago
      > Can confirm, it's rare for me to be able to get at the audio captcha. Occasionally I'll find that tabbing onto the the button allows it load when clicking directly on it won't. I assume if Google is observing behavior that makes them think you're sighted, they'll block access. That'd be very cruel to ignore those with vision, but who don't have anything close to perfect vision or correctable vision through glasses. It would also ignore those who have poorer vision as well as have difficulties in recognizing patterns. There's a whole spectrum of accessibility issues, and trying to "fail people" who seem to have enough vision to click on an audio button would be the definition of being evil. > I kind of wonder if it would be possible to force the issue legally as an accessibility problem, but other people than me would need to do it, and in any case it feels a kind of dirty to me to use blind accessibility as a tool in the fight for privacy. Even if this is not possible legally in all jurisdictions, enough publicity and outrage could help. There should certainly be some journalists from major publications/site reading HN (or HN readers with journalist contacts) who can investigate and write about this.

stockkid 7y ago

> Keep in mind that blocking fingerprinting may cause some sites to break. This represents the sad state of Internet we are all living through. I have noticed that when I turn on privacy settings on Firefox, some major websites are broken and rendered unusable. It seems that the Internet is rampant with tracking and privacy violation, and we consumers are passively accepting it, by and large.

kgwxd 7y ago
I haven't had an issue, but I avoid "major websites" like the plague, as they are the modern equivalent (though measles is making a comeback). If a site breaks with good privacy settings, it's a decent indicator you're better off not visiting. If a breaking site shows up on my radar too much, I add the domain to an add-on I made to hide links to it on any page. My HN/reddit/search results/etc views usually have a few blank lines, they're links to domains I have determined I never want to visit ever again. My RSS reader gets a variation of the filter, so they don't show up there either. It feels really good to have the power to remove an entire site from my personal internet.
- stockkid 7y ago
  > I add the domain to an add-on I made to hide links to it on any page. That sounds interesting. Have you published it or made source available? I'd love to try.
  - kgwxd 7y ago
    I published it [1], but only because I had to in order to use it without adding and approving it every time I started Firefox :/ I originally thought I had made the source available but eventually realized the code repo on Mozilla was only available to me (not sure what the point of that is). You just inspired me to get it up on github [2]. It's a pain to configure but the example JSON in the "Preferences" section of the add-on should be enough to get started. Just paste it into the textarea, save, then visit HN or Reddit, you'll probably see a few blank lines where links should be. Right now, the top post on HN is a WSJ link. I don't want to see their links because I don't ever want to click them just to hit a paywall I already know I'll never accept. So my HN page looks like this [3]. The tool uses regular expressions on text and element attribute values. Anything that matches gets a given CSS style applied. I think it would be great if uBlock Origin could do this but it doesn't allow the level of granularity needed to accomplish the end result. [1] https://addons.mozilla.org/en-US/firefox/addon/ssure/ https://addons.mozilla.org/en-US/firefox/addon/ssure/ [2] https://github.com/7w0/ssure https://github.com/7w0/ssure [3] https://i.imgur.com/pEV50xr.jpg https://i.imgur.com/pEV50xr.jpg

bitdeep 7y ago

Damn... I was using some fingerprint to prevent sensitive accounts to be stolen or misused, now moz guys is taking away my cake.

quickthrower2 7y ago

Are they are biting the hand that feeds them? Interesting relationship with Google - they get revenue from them, but are a competitor with conflicting ideals. I'd like to see Firefox premium services (like a dropbox clone etc.) to provide independent revenue, so they can be aggressive for privacy.

thomasfedb 7y ago

Recent progress in Firefox contrasts very strongly with Chrome. I know I'm very happy to be a FF user right now.

geekamongus 7y ago

It seems that almost weekly, I am reminded why I love Firefox because of some new thing Mozilla is doing. A lot of good decisions have been coming from them lately.

codsane 7y ago
I finally made the switch from Brave today and I'm never going back. Firefox is just as privacy-conscious, supports built-in tracker blocking, fingerprinting, and has full sync that Brave hasn't implemented yet.
- rjf72 7y ago
  Just as privacy conscious is a misleading statement. Choosing to migrate their default search to Google was a money grab by Firefox and that money is, in turn, 100% dependent upon tracking. I think this is why what limited privacy options Firefox does offer are entirely opt-in, and often hidden behind menus that your average user will probably never visit. By contrast Brave has had things such as blocking of fingerprinting for months (years?), and also natively supports OPT-OUT ad blocking, script blocking, third party cookie blocking (which FireFox does also but once again in a less direct fashion), single click native TOR access + ID swapping anywhere, and more. And I think the biggest difference is that this is all directly exposed to the user. If a user clicks the big iconic Lion icon in the top right they get a popup that shows nothing but: - [x] Shields Up (adblocking/etc) - [x] Third party trackers blocked - [x] Connections forced to HTTPS - [x] Scripts blocked - [Third Party/All/None] Cookies blocked - [Third Party/All/None] Device recognition blocked So even users that know absolutely nothing and don't bother to navigate through menu options will almost definitely immediately be exposed to all of these privacy options, though again given the opt-out nature of much of it - even if they weren't, it would be less of an issue.
  - asenna 7y ago
    > Choosing to migrate their default search to Google was a money grab by Firefox and that money is, in turn, 100% dependent upon tracking Well it was not a bad decision to make since most of their users would set Google as their default anyway (no matter how privacy concerned you are, you still can't do without Google search unless you really really try hard, which most people don't). In my opinion it was a sensible decision.

terrycody 7y ago

Awesome feature, already activated it!

somezero 7y ago

Does using "User-Agent switcher" or similar extensions have any effect on this functionality?

shard972 7y ago

dang rapes children.

rhaksw 7y ago

I've had some issues maintaining reVddit.com while keeping Firefox's tracking protection in mind. I'd love some help if there is anyone who can provide insight. Basically, you can't load reVddit pages on Firefox because reVddit accesses reddit's API, and reddit is listed on Firefox's list of websites that are considered trackers [1]. In my uneducated opinion, this list is weird. I had some discussion about this with Mozilla devs [2]. In that message chain, devs acknowledged reVddit is not doing anything wrong, rather it is reddit who could infringe users' privacy. Yet it is the non-infringing site that breaks. Further, the devs' suggestions for remedy are not workable. They propose moving requests to the server so that reVddit.com makes the requests to reddit.com. There are multiple problems with this, * It would hide more code from users * Reddit rate-limits requests coming from a single source * Infrastructure becomes expensive on what is supposed to be a low cost website My conversation with devs was good but needs more. Is there any solution here, or do we just go our separate ways? [1] https://github.com/disconnectme/disconnect-tracking-protection/blob/master/services.json https://github.com/disconnectme/disconnect-tracking-protecti... [2] https://groups.google.com/d/msg/mozilla.dev.privacy/XO84EzrwWp0/t3cgc7H-AgAJ https://groups.google.com/d/msg/mozilla.dev.privacy/XO84Ezrw...

Mathnerd314 7y ago
There is a similar bug in Bugzilla for redditp.com, open since 2015: https://bugzilla.mozilla.org/show_bug.cgi?id=1235978 https://bugzilla.mozilla.org/show_bug.cgi?id=1235978 My general impression is that tracking protection is low-priority for Mozilla and anyone who actually cares is using uBlock Origin / uMatrix or similar extensions since those use filter lists that are actually updated.
- rhaksw 7y ago
  > My general impression is that tracking protection is low-priority for Mozilla It is on by default, and as you point out, breaks many innocent sites. People may migrate elsewhere. That should bump up its priority.

Justsignedup 7y ago

I've used this feature in the past. There are some weirdneses. You lose your timezone and ALL dates appear in UTC. This is definitely not desirable. Fingerprinting cannot be allowed for some sites, and thus things like android messages cannot work because it cannot accurately identify the browser. Hopefully they'll do something about all this.

kabacha 7y ago
> You lose your timezone and ALL dates appear in UTC. Seems like an easy fix would be to have client based converter, even more simple than what fingerprint blocker does with screen resolution.

dingo_bat 7y ago

I'm tired of the daily spam from Mozilla on the front page.

ddffre 7y ago

What about them selling their data on the darkweb? They claimed that there was no breach, but yet all of their database is being sold on the darkweb. Is it so easy to gather their database and publish it?

eVeechu7 7y ago
Who is them? Whose database?
- ddffre 7y ago
  Truecaller: https://techunalt.com/truecaller-data-sold-on-dark-web/ https://techunalt.com/truecaller-data-sold-on-dark-web/

hwj 7y ago

The German version of that article has a casual slang: > Clearly, you don't want to throw your computer out of the window and never use the internet again, just to get rid of ads. https://blog.mozilla.org/firefox/de/loesche-deinen-digitalen-fingerabdruck-in-firefox/ https://blog.mozilla.org/firefox/de/loesche-deinen-digitalen...

anoplus 7y ago

I am posting this again, because I still didn't get opinions about it and I think it is important. How much of Firefox success depends on donations? I have seen successful crowd-funding projects where the budget is always transparent and communicated to the public. I am certain this motivates the masses to donate. Wouldn't it be better for Mozilla to make their funding fully transparent to attract the masses?

tngranados 7y ago
I'm not sure how transparent they are about their finances, but most of Mozilla funding comes from search engines deals to make them default in certain regions (Yahoo, Google, Yandex and Baidu).

b-3-n 7y ago

Firefox is playing its trump, the privacy, very well lately. This is very smart as the competition has no good answer. Equalizing on privacy level would go against their business model so they won't ever do it wholeheartedly. Trying out Firefox now...

jopsen 7y ago
> Equalizing on privacy level would go against their business model... More importantly it would go against the mission statement. Mozilla isn't around to make money, it's around to make progress toward a mission. (Search revenue helps fund that, but revenue is not the end goal for Mozilla).
- _bAp_ 7y ago
  He was talking about the competition, not Mozilla.

bojanvidanovic 7y ago

Firefox is really stepping up in the game of online privacy. I switched to Firefox almost 2 years ago and never looked back.

scoutt 7y ago

I wonder is there is the possibility (or if someone came across) of saving (and loading) all the data of a fingerprint state, or to be able to craft one, modify it, or share it. That is, all the metadata (cookies, history, etc.) that supposedly identifies a user-type. It could be interesting to have a drop-down in the browser to select a "who I want to be today" profile and be able to see the world from that perspective.

porky 7y ago

At first I read "block Fingering with Firefox"

kakkksaknmdm 7y ago

I worked in the ad industry. Every web-browser including brave, tor,safari is uniquely identifiable even on same hardware. All the public computer researchers and browser vendors are years behind the techniques to fingerprint devices (probably 5+). Canvas, WebGl etc are techniques of the past. There are much more advanced ones, than can identify devices with completely uniquely (on both desktop and mobile) Also we know when users fake their fingerprints, and the algorithm respects the decision even though we know who the user is despite faking with all state of the art methods. Latest methods dont even use JavaScript. Just CSS is enough to identify every device uniquely but you'd need JS to send the data back. Every public researcher I've seen are given honeypot techniques that they consider state of the art even thought the industry is way ahead of the researchers.

senorjazz 7y ago
If this is the case, then the millions if not billions of adfraud is put through by the ad companies knowingly and defrauding the ad-buyers surely?
- kakkksaknmdm 7y ago
  Large companies have fixed ad spend budgets. If they dont spend they lose. Doesn't matter if its lost to fraud. Google, Facebook advertiser have more specific budgets, especially Facebook which has a large number of small advertisers. Large adnetworks however get large advertisers with advertising budgets in tens of millions on average. There is a larger pressure on Google and Facebook to be competitive then say smaller ad networks. Also the techniques that I mention of are not in use in wild after the POC on millions of devices few months ago. They're a backup plan. Also not every adtech company has them. Maybe 2 or 3 at the most are at the cutting edge of tracking. Google knows this very well. You really think Google couldn't counter fraud? Its a fake and manufactured outrage. No one wants to give away their "secret sauce" just yet. Also right now many adtech companies are going bankrupt. Many larger one are waiting for smaller ones to be gone after which the landscape changes.
  - soverance 7y ago

vxNsr 7y ago

As much as I hate more legislation I think the only way to solve this is to make it very onerous to own and compile this data and to level heavy fines (as in criminal charges and/or force the company into bankruptcy via 90% revenue fines) in cases when the database is breached. Everything else will just turn into an arms race between those who don't wanna be tracked and those who wanna track. If the US did something like the GDPR but in our constitution I wouldn't be surprised if a cottage industry opened up overnight in secure data-warehousing. I get that it would complicate things for small companies but we brought this on ourselves.

joaobeno 7y ago
These companies then lobby the government, asking to be relieved of the fines, because if they go down, so many workers will be out of jobs, and that they will comply (pinky promise), so the fines should be lifted to help these innocent people...

t0astbread 7y ago

How does this work? Does it just block domains known to host fingerprinting scripts? If no, how does it hide addons and settings that interfere with the website? And how does it prevent leaking information by itself that can assist fingerprinting?

mod_stretch 7y ago

Mozilla has been up to some questionable activity lately as well. They blocked the Dissenter extension.

muxator 7y ago

Whatsapp web does not show the authentication QR code if resistFingerprinting is on. This is annoying at minimum. I would happily use another IM, but the bad thing about network effect is that one would need to convince everyone else to make the switch, too. In order to take over, freedom-respecting services need to become _better_ than the non free ones not only on a technical level, but on a UX one, too.

roboyoshi 7y ago
which is basically impossible of you're a non-profit or donation based insitution versus a multi-billion dollar company. It's why Evernote is still unreplaced and dropbox has the best filesync. Anyy,way.. I've heard good stuff about matrix so will try to setup this over the weekend.

thejohnstone 7y ago

You should try Kameleo software manipulate your fingerprint!