8 ms·

Getting some semblance of control over my browsing habits and enabling the implementation of multiple-proxy-based browsing strategies is one reason why I wrote

Getting some semblance of control over my browsing habits and enabling the implementation of multiple-proxy-based browsing strategies is one reason why I wrote chrome-private.sh [1]. I go through hundreds of disposable browsing profiles every day. [1] https://github.com/atomontage/chrome-private https://github.com/atomontage/chrome-private

chubot 6y ago
That's pretty cool ... I'm left wondering what a visualization of the state accumulated by visiting different websites would look like, e.g. google, twitter, nytimes, etc.
tantalor 6y ago
So you're the one messing up my sessions analysis :p
thinkloop 6y ago
Interesting. Why disable gpu? > Disables 3D APIs / WebGL, GPU acceleration by default while allowing them to be re-enabled through command-line switches.
- StrangeDoctor 6y ago
  Not OP, WebGL is a fast path to direct hardware execution and kernel space execution. It’s difficult to patch when things go wrong often requiring driver or kernel coordination. There might be issues with cross site memory leaking, but I’ve only seen white papers on how this might be an issue.
  - nitrogen 6y ago
    It's also used for fingerprinting, because there are a lot of different GPU configurations with slightly different reported features and slightly different e.g. rounding, dithering, antialiasing, and other rendering behaviors.
- rasz 6y ago
  WebGL: getParameter: enum 0x9246 - fingerprinting 3d hardware. Personally I run a shim that rotates a list of most popular gpus.
- metroholografix 6y ago
  Mostly for security, rather than fingerprinting, concerns. Fingerprinting avoidance is a complex issue and it's reached the point where you can't simply disable JavaScript / WebGL and assume you're ok. One needs to run additional extensions to project a browser-view that blends in. You can use chrome-private.sh as a base layer you can build on to get there, but you are not going to get it by default (which is why I'm not making any anti-fingerprinting claims in the README).
thinkloop 6y ago
I'm doing something similar but less ephemeral. I have many web profiles, but they are dedicated, for example I have a Google profile where I open Gmail, drive, photos, etc. I have an FB one, a reddit one, an HN one, etc. About 15. Then Firefox for my regular browsing.
jedberg 6y ago
Firefox containers does the same thing with a lot less work. If you get the multi-account-containers extension and the temporary containers extension, you won't have to log back into everything all the time but will still get isolation. https://addons.mozilla.org/en-US/firefox/addon/temporary-containers/ https://addons.mozilla.org/en-US/firefox/addon/temporary-con... https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/ https://addons.mozilla.org/en-US/firefox/addon/multi-account... Edit: See below with a warning about using this with profile sync.
- metroholografix 6y ago
  Well, there are definite benefits to being in full control of profile segmentation. You have no idea what the extension is doing unless you audit it. And even then, there are second-order effects that could surprise you [1]. Plus, the extension writer has to maximally cover the set of possibilities where a site can store/retrieve data. These are a lot of unknowns you're trusting and assumptions you're making. It's far simpler to treat the profile directory as contaminated waste and nuke it at will. The only assumption you're making is that the browser implements a profile in a given directory properly. [1] https://github.com/stoically/temporary-containers/wiki/Isolation-Notes#navigating-in-tabs-isolation-exceptions https://github.com/stoically/temporary-containers/wiki/Isola...
  - jedberg 6y ago
    Of course, all security is a trade off between convenience and privacy. But the hassle of a new profile all the time seems like a lot of extra inconvenience for little extra privacy. So far in practice I've never seen the isolation fail. The combination of the two plugins seems to counteract each one's failures. And Mozilla makes the multi-account-container plugin. I trust them a lot more than I trust Google to make Chrome not leak information across profiles.
    - metroholografix 6y ago
      I can say that I would prefer to use Firefox instead of Chrome, except that Firefox has no OSA scripting endpoints on macOS (a real shame) and I've written a lot of code that depends on Chrome APIs over the years. Even if I did move to Firefox however, I would still implement a directory-based profile segmentation strategy.
jason0597 6y ago
Why not use ungoogled-chromium? https://github.com/Eloston/ungoogled-chromium https://github.com/Eloston/ungoogled-chromium
- kodablah 6y ago
  Different concerns. Ungoogled Chromium removes Google-specific features from Chrome. That is unrelated to non-Google-specific browsing features such as providing cookies back to hosts on repeat requests in the same profile.
uniqueid 6y ago
There is no hope of privacy on the internet today without some sort of "tumbling" strategy. It is wholely impossible for anyone to prevent all sources of their information from leaking, and once your data from one source is out there, the rest of your precautions are potentially useless. So the only viable strategy is to muddy the waters by creating enough spurious data that an attacker can't know what is real and what is fake.
fouc 6y ago
Unfortunately chrome itself makes far too many calls home.

chubot 6y ago

That's pretty cool ... I'm left wondering what a visualization of the state accumulated by visiting different websites would look like, e.g. google, twitter, nytimes, etc.

tantalor 6y ago

So you're the one messing up my sessions analysis :p

thinkloop 6y ago

Interesting. Why disable gpu? > Disables 3D APIs / WebGL, GPU acceleration by default while allowing them to be re-enabled through command-line switches.

StrangeDoctor 6y ago
Not OP, WebGL is a fast path to direct hardware execution and kernel space execution. It’s difficult to patch when things go wrong often requiring driver or kernel coordination. There might be issues with cross site memory leaking, but I’ve only seen white papers on how this might be an issue.
- nitrogen 6y ago
  It's also used for fingerprinting, because there are a lot of different GPU configurations with slightly different reported features and slightly different e.g. rounding, dithering, antialiasing, and other rendering behaviors.
rasz 6y ago
WebGL: getParameter: enum 0x9246 - fingerprinting 3d hardware. Personally I run a shim that rotates a list of most popular gpus.
metroholografix 6y ago
Mostly for security, rather than fingerprinting, concerns. Fingerprinting avoidance is a complex issue and it's reached the point where you can't simply disable JavaScript / WebGL and assume you're ok. One needs to run additional extensions to project a browser-view that blends in. You can use chrome-private.sh as a base layer you can build on to get there, but you are not going to get it by default (which is why I'm not making any anti-fingerprinting claims in the README).

thinkloop 6y ago

I'm doing something similar but less ephemeral. I have many web profiles, but they are dedicated, for example I have a Google profile where I open Gmail, drive, photos, etc. I have an FB one, a reddit one, an HN one, etc. About 15. Then Firefox for my regular browsing.

jedberg 6y ago

Firefox containers does the same thing with a lot less work. If you get the multi-account-containers extension and the temporary containers extension, you won't have to log back into everything all the time but will still get isolation. https://addons.mozilla.org/en-US/firefox/addon/temporary-containers/ https://addons.mozilla.org/en-US/firefox/addon/temporary-con... https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/ https://addons.mozilla.org/en-US/firefox/addon/multi-account... Edit: See below with a warning about using this with profile sync.

metroholografix 6y ago
Well, there are definite benefits to being in full control of profile segmentation. You have no idea what the extension is doing unless you audit it. And even then, there are second-order effects that could surprise you [1]. Plus, the extension writer has to maximally cover the set of possibilities where a site can store/retrieve data. These are a lot of unknowns you're trusting and assumptions you're making. It's far simpler to treat the profile directory as contaminated waste and nuke it at will. The only assumption you're making is that the browser implements a profile in a given directory properly. [1] https://github.com/stoically/temporary-containers/wiki/Isolation-Notes#navigating-in-tabs-isolation-exceptions https://github.com/stoically/temporary-containers/wiki/Isola...
- jedberg 6y ago
  Of course, all security is a trade off between convenience and privacy. But the hassle of a new profile all the time seems like a lot of extra inconvenience for little extra privacy. So far in practice I've never seen the isolation fail. The combination of the two plugins seems to counteract each one's failures. And Mozilla makes the multi-account-container plugin. I trust them a lot more than I trust Google to make Chrome not leak information across profiles.
  - metroholografix 6y ago
    I can say that I would prefer to use Firefox instead of Chrome, except that Firefox has no OSA scripting endpoints on macOS (a real shame) and I've written a lot of code that depends on Chrome APIs over the years. Even if I did move to Firefox however, I would still implement a directory-based profile segmentation strategy.

jason0597 6y ago

Why not use ungoogled-chromium? https://github.com/Eloston/ungoogled-chromium https://github.com/Eloston/ungoogled-chromium

kodablah 6y ago
Different concerns. Ungoogled Chromium removes Google-specific features from Chrome. That is unrelated to non-Google-specific browsing features such as providing cookies back to hosts on repeat requests in the same profile.

uniqueid 6y ago

There is no hope of privacy on the internet today without some sort of "tumbling" strategy. It is wholely impossible for anyone to prevent all sources of their information from leaking, and once your data from one source is out there, the rest of your precautions are potentially useless. So the only viable strategy is to muddy the waters by creating enough spurious data that an attacker can't know what is real and what is fake.

fouc 6y ago

Unfortunately chrome itself makes far too many calls home.