8 ms·

This is quite unfortunate news but not surprising. This effectively turns Privacy Badger for the majority of users into another block list. Fingerprinting vs a

by qqii 6y ago

This is quite unfortunate news but not surprising. This effectively turns Privacy Badger for the majority of users into another block list. Fingerprinting vs ad tracking protection has been an ongoing war. The natural escalation to tracking protection is to fingerprint even harder. I'd expect most power users who like to configure their extensions and blocking lists to be suprised how much information thst provides to differentiate them. Even without that browsers by default share a lot of information with every website (https://panopticlick.eff.org/ https://panopticlick.eff.org/). I don't see a good ending to this war. Solutions like Firefox containers requires you to be extremely thoughtful in your site usage and don't protect from more advanced fingerprinting techniques (that for example cloudflare employs). The web is fundimentally a little broken here.

heresie-dabord 6y ago
Given the pervasive commercial surveillance system, a user needs to have several protective layers just to browse the WWW: a browser with security extensions (although a good browser should be built with security as a design principle, not as an "add-on") ESNI and DoH (even though Cloudflare can see the aggregate) DNS caching and blocking in the subnet iptables/nftables blocking of undesirable IP address ranges by the router edit: It's safer to leave the dysfunctional WWW alone and use only RSS.
- Pet_Ant 6y ago
  > It's safer to leave the dysfunctional WWW alone and use only RSS. Is their any evidence that Google killed Google Reader because it interfered with their Ad/user-tracking metrics business?
- tremon 6y ago
  Disagree on DoH though, because it defeats DNS caching and blocking in the subnet. Plus, many people trust their own provider more than yet another US corporation.
  - tptacek 6y ago
    It defeats DNS caching and blocking in the "subnet" because for most US users the DNS provider is an adversary, and trusting it would be a mistake.
    - sildur 6y ago
      But there is an entire world outside the US. I trust my local ISP way more than a US corporation.
      - tptacek 6y ago
        That's fascinating, but now you know why people in the US are quick to embrace DoH in its default configurations. And, of course, nothing ties DoH to major US corporations. You can DoH to a NUC in your cousin's bedroom closet.
        SAI_Peregrinus 6y ago
        I run DoH on a raspberry Pi with piHole. And then DoH from it to Quad9's servers. DNS blocking, with DoH.
        tptacek 6y ago
        You can also just run Pi-Hole directly on something like Fly.io, and DoH to it from your local machine. :P
        musicale 6y ago
        Interesting - I assume their free tier is enough to run this. However, local caching on the Pi might yield faster lookup time.
  - judge2020 6y ago
    They're all only useful in certain circumstances.
jamesgeck0 6y ago
The "community learning" feature they mention investigating at the bottom of the article sounds like the best of both worlds: automatic learning without fingerprinting and a pre-trained block list.
- dpkonofa 6y ago
  This would even be effective, in my opinion, if they just merged your fingerprint with other, random users.
Tarq0n 6y ago
Is this fingerprinting javascript-based, and therefore can be circumvented by whitelisting scripts, or are there server-side methods as well?
- totalZero 6y ago
  I'm not a security expert so I may be wrong (if so, someone please educate me). My impression is that if you own several websites and trackers, you can identify users by the specific combination of blocked and non-blocked trackers, plus data about their machine/OS, ISP, screen resolution, and browser languages, as well as checking to see if browser permissions are turned on for notifications, location, and the like. I'm not sure you can prevent that with a javascript-based approach alone.
Animats 6y ago
This is quite unfortunate news but not surprising. This effectively turns Privacy Badger for the majority of users into another block list. Yes. Privacy Badger was not just an anti-tracker. It's also something of an ad blocker. Since ad sites tend to track, it learns to block them. Checking "cnn.com" right now, Privacy Badger is blocking 36 sites. These include "static.ads-twitter.com", "c.amazon-adsystem.com", "www.googletagmanager.com", "ad.doubleclick.net", and "amplify.outbrain.com". Blocking those knocks out most of the ads from the big players. Two of those are Google's, and they probably don't like being blocked by a large number of users. Taking that away to prevent a theoretical approach to tracking seems like a sell-out by EFF.
crossroadsguy 6y ago
Firefox Containers ought to just let do such things: 1. Open every new website (the one which doesn't have a saved container for it) in a new random/untagged container - destroy that container and data/everything when I close the last tab of that site 2. Unless I tag/name that container for that website and then persist it the way you do - and give me one click operation to tag name and (maybe select an icon/colour for that container) 3. What about giving website favicon as an option to the container icon 4. Get rid of those "Oh you are opening this website B (container_B) from a website A (container_A) - do you want us to open it in container_B instead"? "Always"? Yes! Yes! Make it default or give me an easy options to make it default damn it - give me an option the first time where I can mark "always do this"! 5. Do we really need special container for Firefox and then for the rest? Why not ship with a default already set container in the Multi Container add-on that's Fb container? There's an option "Select a container for each new tab" but it's not very helpful as it lets you just choose either one among all the existing containers, or "No container" and that is blocking pop-up.
totalZero 6y ago
Why is this unfortunate? It's a change to a default setting. You can still turn it back on, I think. Ideally you're using a multi-layered approach, meaning that much of the ugly stuff should be filtered out upstream of your browser extensions anyway.

by qqii 6y ago

heresie-dabord 6y ago

Given the pervasive commercial surveillance system, a user needs to have several protective layers just to browse the WWW: a browser with security extensions (although a good browser should be built with security as a design principle, not as an "add-on") ESNI and DoH (even though Cloudflare can see the aggregate) DNS caching and blocking in the subnet iptables/nftables blocking of undesirable IP address ranges by the router edit: It's safer to leave the dysfunctional WWW alone and use only RSS.

Pet_Ant 6y ago
> It's safer to leave the dysfunctional WWW alone and use only RSS. Is their any evidence that Google killed Google Reader because it interfered with their Ad/user-tracking metrics business?
tremon 6y ago
Disagree on DoH though, because it defeats DNS caching and blocking in the subnet. Plus, many people trust their own provider more than yet another US corporation.
- tptacek 6y ago
  It defeats DNS caching and blocking in the "subnet" because for most US users the DNS provider is an adversary, and trusting it would be a mistake.
  - sildur 6y ago
    But there is an entire world outside the US. I trust my local ISP way more than a US corporation.
    - tptacek 6y ago
      That's fascinating, but now you know why people in the US are quick to embrace DoH in its default configurations. And, of course, nothing ties DoH to major US corporations. You can DoH to a NUC in your cousin's bedroom closet.
      - SAI_Peregrinus 6y ago
        I run DoH on a raspberry Pi with piHole. And then DoH from it to Quad9's servers. DNS blocking, with DoH.
        tptacek 6y ago
        You can also just run Pi-Hole directly on something like Fly.io, and DoH to it from your local machine. :P
        musicale 6y ago
        Interesting - I assume their free tier is enough to run this. However, local caching on the Pi might yield faster lookup time.
- judge2020 6y ago
  They're all only useful in certain circumstances.

jamesgeck0 6y ago

The "community learning" feature they mention investigating at the bottom of the article sounds like the best of both worlds: automatic learning without fingerprinting and a pre-trained block list.

dpkonofa 6y ago
This would even be effective, in my opinion, if they just merged your fingerprint with other, random users.

Tarq0n 6y ago

Is this fingerprinting javascript-based, and therefore can be circumvented by whitelisting scripts, or are there server-side methods as well?

totalZero 6y ago
I'm not a security expert so I may be wrong (if so, someone please educate me). My impression is that if you own several websites and trackers, you can identify users by the specific combination of blocked and non-blocked trackers, plus data about their machine/OS, ISP, screen resolution, and browser languages, as well as checking to see if browser permissions are turned on for notifications, location, and the like. I'm not sure you can prevent that with a javascript-based approach alone.

Animats 6y ago

This is quite unfortunate news but not surprising. This effectively turns Privacy Badger for the majority of users into another block list. Yes. Privacy Badger was not just an anti-tracker. It's also something of an ad blocker. Since ad sites tend to track, it learns to block them. Checking "cnn.com" right now, Privacy Badger is blocking 36 sites. These include "static.ads-twitter.com", "c.amazon-adsystem.com", "www.googletagmanager.com", "ad.doubleclick.net", and "amplify.outbrain.com". Blocking those knocks out most of the ads from the big players. Two of those are Google's, and they probably don't like being blocked by a large number of users. Taking that away to prevent a theoretical approach to tracking seems like a sell-out by EFF.

crossroadsguy 6y ago

Firefox Containers ought to just let do such things: 1. Open every new website (the one which doesn't have a saved container for it) in a new random/untagged container - destroy that container and data/everything when I close the last tab of that site 2. Unless I tag/name that container for that website and then persist it the way you do - and give me one click operation to tag name and (maybe select an icon/colour for that container) 3. What about giving website favicon as an option to the container icon 4. Get rid of those "Oh you are opening this website B (container_B) from a website A (container_A) - do you want us to open it in container_B instead"? "Always"? Yes! Yes! Make it default or give me an easy options to make it default damn it - give me an option the first time where I can mark "always do this"! 5. Do we really need special container for Firefox and then for the rest? Why not ship with a default already set container in the Multi Container add-on that's Fb container? There's an option "Select a container for each new tab" but it's not very helpful as it lets you just choose either one among all the existing containers, or "No container" and that is blocking pop-up.

totalZero 6y ago

Why is this unfortunate? It's a change to a default setting. You can still turn it back on, I think. Ideally you're using a multi-layered approach, meaning that much of the ugly stuff should be filtered out upstream of your browser extensions anyway.