5 ms·

A bit tinfoil hat, but could it be an attempt to head off Firefox Containers which would be a threat to Google Cookie collection? That's certainly my main use c

by mkj 6y ago

A bit tinfoil hat, but could it be an attempt to head off Firefox Containers which would be a threat to Google Cookie collection? That's certainly my main use case for containers, using Google Music without telling the rest of the web about my Google account.

metroholografix 6y ago
https://github.com/atomontage/chrome-private https://github.com/atomontage/chrome-private
- floatingatoll 6y ago
  This looks very useful, but it combines valuable profile management work with disabling various web features per the author's opinions. Sadly, disabling those features by default makes it significantly easier to fingerprint users using this script (which is precisely the opposite of its intentions). So I forked it and set those features to be disable-if-requested rather than disable-by-default, so that people who just want to manage separate profiles have an option that doesn't make them easier to fingerprint: https://github.com/floatingatoll/chrome-private/ https://github.com/floatingatoll/chrome-private/
  - metroholografix 6y ago
    Forking to switch a bunch of command line arguments around seems excessive to me. You can simply write a wrapper script that passes the arguments in the way you want them to be passed. Enabling those options does nothing to improve fingerprinting resistance, it's a completely bogus argument. Disabling them however, in combination with the recommended extensions that are in the README plus custom user agent handling, does bring tangible benefits. Finally, fingerprinting resistance isn't mentioned once in the README. It's simply too hard a problem for me to claim that this simple script intends to solve it. You can however use the script as a foundation that you can build custom strategies on top of. More than adequate for that purpose.
    - floatingatoll 6y ago
      Forking permits me to efficiently git rebase against upstream when there are changes, using rerere to remember easy conflict resolutions. A wrapper would not work as two of the options cannot be removed from the command line (and the author refused a PR that would have permitted such a wrapper).
      - metroholografix 6y ago
        I am the author. Flash support in Chrome is going away soon (but even if it didn't) I am not going to be publishing any code with support for that crap baked in. However, it is understandable if you disagree. Re: referrer option, as I explained, it's a nop. So no point in having extra code for that there either (I really should remove it).
        floatingatoll 6y ago
        I had to use Flash two weeks ago to get a food handler’s permit online due to pandemic and terrible horrible choice from a list of 20 options, so I am unusually positioned to disagree from personal basis. I do agree that it should die and I can’t wait for it to do so either!
dmortin 6y ago
There is also browser fingerprinting, so they may still know it's you even if you are in a private tab.
- WorldMaker 6y ago
  And IP (range) fingerprinting. But the point is don't have to give the easy stuff like cookies away for free to mice like Google. They are still going to beg for milk either way, because they are greedy, but you don't have to be hospitable and keep feeding them cookies. (I mean the number of dumb ReCaptcha's I've had to do has gone way up since sequestering Google apps to their own container. Gross.)

by mkj 6y ago

metroholografix 6y ago

https://github.com/atomontage/chrome-private https://github.com/atomontage/chrome-private

floatingatoll 6y ago
This looks very useful, but it combines valuable profile management work with disabling various web features per the author's opinions. Sadly, disabling those features by default makes it significantly easier to fingerprint users using this script (which is precisely the opposite of its intentions). So I forked it and set those features to be disable-if-requested rather than disable-by-default, so that people who just want to manage separate profiles have an option that doesn't make them easier to fingerprint: https://github.com/floatingatoll/chrome-private/ https://github.com/floatingatoll/chrome-private/
- metroholografix 6y ago
  Forking to switch a bunch of command line arguments around seems excessive to me. You can simply write a wrapper script that passes the arguments in the way you want them to be passed. Enabling those options does nothing to improve fingerprinting resistance, it's a completely bogus argument. Disabling them however, in combination with the recommended extensions that are in the README plus custom user agent handling, does bring tangible benefits. Finally, fingerprinting resistance isn't mentioned once in the README. It's simply too hard a problem for me to claim that this simple script intends to solve it. You can however use the script as a foundation that you can build custom strategies on top of. More than adequate for that purpose.
  - floatingatoll 6y ago
    Forking permits me to efficiently git rebase against upstream when there are changes, using rerere to remember easy conflict resolutions. A wrapper would not work as two of the options cannot be removed from the command line (and the author refused a PR that would have permitted such a wrapper).
    - metroholografix 6y ago
      I am the author. Flash support in Chrome is going away soon (but even if it didn't) I am not going to be publishing any code with support for that crap baked in. However, it is understandable if you disagree. Re: referrer option, as I explained, it's a nop. So no point in having extra code for that there either (I really should remove it).
      - floatingatoll 6y ago
        I had to use Flash two weeks ago to get a food handler’s permit online due to pandemic and terrible horrible choice from a list of 20 options, so I am unusually positioned to disagree from personal basis. I do agree that it should die and I can’t wait for it to do so either!

dmortin 6y ago

There is also browser fingerprinting, so they may still know it's you even if you are in a private tab.

WorldMaker 6y ago
And IP (range) fingerprinting. But the point is don't have to give the easy stuff like cookies away for free to mice like Google. They are still going to beg for milk either way, because they are greedy, but you don't have to be hospitable and keep feeding them cookies. (I mean the number of dumb ReCaptcha's I've had to do has gone way up since sequestering Google apps to their own container. Gross.)