3 ms·

Fingerprinting is mostly dependent on Javascript and presence of browser numerous detectable "features". What would happen to fingerprinting in the case of "la

by 3xblah 7y ago

Fingerprinting is mostly dependent on Javascript and presence of browser numerous detectable "features". What would happen to fingerprinting in the case of "large scale disabling of Javascript"? Even more, what would happen if there was large scale movement away from Chrome and other browsers with "features" that make fingerpinting possible?

danShumway 7y ago
It would greatly reduce the amount of fingerprinting, but not completely eliminate it. I've written about this before, but there's more than just Javascript we need to worry about -- we'd want to strip down CSS a bit, rethink how asset caching works, and potentially send less information in request headers. But it would certainly be a lot easier to do all of that without Javascript. The problem is that one of two things would happen: A) the majority of web apps would move to native platforms, where fingerprinting resistance is even worse. That would include a good many news sites, even though most news sites aren't really web-apps, and don't need Javascript to operate. They'd still do it. B) the majority of users would not use those browsers. We're playing a kind of weird game with fingerprinting right now -- we want to block it without breaking most websites. This is why adblocking is fantastic: it observably makes the web better to even an average user, so there's an incentive for users to adblock en-mass, and publishers can't really leave the web. Adblocking is a way to fight surveillance apparatuses without making sacrifices. It's a tricky situation to be in, and there's a lot more that could be said about the merits of different strategies. That being said, if you don't care about an en-mass policy, and you're just looking to increase your own privacy, it would definitely be a good idea right now to use something like UMatrix to disable at least 3rd-party Javascript by default. You'll have to do a lot of per-website tweaking, but if you're at all technical it's honestly not that bad.

by 3xblah 7y ago

danShumway 7y ago

It would greatly reduce the amount of fingerprinting, but not completely eliminate it. I've written about this before, but there's more than just Javascript we need to worry about -- we'd want to strip down CSS a bit, rethink how asset caching works, and potentially send less information in request headers. But it would certainly be a lot easier to do all of that without Javascript. The problem is that one of two things would happen: A) the majority of web apps would move to native platforms, where fingerprinting resistance is even worse. That would include a good many news sites, even though most news sites aren't really web-apps, and don't need Javascript to operate. They'd still do it. B) the majority of users would not use those browsers. We're playing a kind of weird game with fingerprinting right now -- we want to block it without breaking most websites. This is why adblocking is fantastic: it observably makes the web better to even an average user, so there's an incentive for users to adblock en-mass, and publishers can't really leave the web. Adblocking is a way to fight surveillance apparatuses without making sacrifices. It's a tricky situation to be in, and there's a lot more that could be said about the merits of different strategies. That being said, if you don't care about an en-mass policy, and you're just looking to increase your own privacy, it would definitely be a good idea right now to use something like UMatrix to disable at least 3rd-party Javascript by default. You'll have to do a lot of per-website tweaking, but if you're at all technical it's honestly not that bad.