3 ms·

>We need the ability to not only disable browser APIs but also make them return fake data to fool the website. Browsers have been trying this for a long time b

>We need the ability to not only disable browser APIs but also make them return fake data to fool the website. Browsers have been trying this for a long time but its not simple. Chrome has had multiple attempts at making it impossible to detect incognito mode but people keep finding ways. The old way was checking if the API to store data was available so chrome made it so that there is an emulated data store for incognito mode and then websites just check how fast the local data store is to check if it is on disk or in memory. It would be an extraordinary effort to remove all of these issues since many of them are outside of the browser like what exact gpu and driver is in use could slightly change how the page is rendered or how long certain things take.

matheusmoreira 7y ago
> Browsers have been trying this for a long time but its not simple. I didn't say it was gonna be easy. I said it was necessary. This is a perpetual arms race. If content blockers can maintain their huge blocklists, browsers should also be able to maintain their own counter-measures to abusive websites. Browser vendors created and standardized the APIs that websites are now exploiting. I expect them to clean it up. > then websites just check how fast the local data store is to check if it is on disk or in memory. Making both calls equally slow should prevent this particular side channel attack.
- baroffoos 7y ago
  What is very simple is just creating a law stating that you may only use exactly the data needed for the purpose of providing the service and any extra data must be requested from the user with the easy ability to decline. Now rather than years of cat and mouse where advertisers always have the upper hand, the advertisers suffer massive fines for misuse.
  - matheusmoreira 7y ago
    They'll just say the tracking is part of the business model and therefore needed to provide the service. The law's purpose is to allow users to negotiate the terms so it is worthless if it doesn't force websites to provide a "give me access to the service without any tracking" option. Imposing laws on the internet contributes to the regionalization of the network: what was once a completely free international network will be divided into many regulated national networks. Not all countries will have these laws so evading sanctions will be as simple as hosting something in a country like Russia.
    - baroffoos 7y ago
      >They'll just say the tracking is part of the business model and therefore needed to provide the service. This is unacceptable under the GDPR. You must allow users to opt out. If this affects your business model than the legal option is to remove the free plan and charge a fee for the service.
  - liability 7y ago
    > What is very simple is just creating a law This must be some new use of the word "simple" I was previously unaware of.

matheusmoreira 7y ago

> Browsers have been trying this for a long time but its not simple. I didn't say it was gonna be easy. I said it was necessary. This is a perpetual arms race. If content blockers can maintain their huge blocklists, browsers should also be able to maintain their own counter-measures to abusive websites. Browser vendors created and standardized the APIs that websites are now exploiting. I expect them to clean it up. > then websites just check how fast the local data store is to check if it is on disk or in memory. Making both calls equally slow should prevent this particular side channel attack.

baroffoos 7y ago
What is very simple is just creating a law stating that you may only use exactly the data needed for the purpose of providing the service and any extra data must be requested from the user with the easy ability to decline. Now rather than years of cat and mouse where advertisers always have the upper hand, the advertisers suffer massive fines for misuse.
- matheusmoreira 7y ago
  They'll just say the tracking is part of the business model and therefore needed to provide the service. The law's purpose is to allow users to negotiate the terms so it is worthless if it doesn't force websites to provide a "give me access to the service without any tracking" option. Imposing laws on the internet contributes to the regionalization of the network: what was once a completely free international network will be divided into many regulated national networks. Not all countries will have these laws so evading sanctions will be as simple as hosting something in a country like Russia.
  - baroffoos 7y ago
    >They'll just say the tracking is part of the business model and therefore needed to provide the service. This is unacceptable under the GDPR. You must allow users to opt out. If this affects your business model than the legal option is to remove the free plan and charge a fee for the service.
- liability 7y ago
  > What is very simple is just creating a law This must be some new use of the word "simple" I was previously unaware of.