5 ms·

You make yourself non-unique by looking like others. In that sense your privacy is limited by the precautions that others take. Turning off javascript is a ver

by n0nc3 6y ago

You make yourself non-unique by looking like others. In that sense your privacy is limited by the precautions that others take. Turning off javascript is a very good thing to do. The more people that do it, the stronger a protection it will be.

alquemist 6y ago
What I want for Christmas is javascript disabled by default, plus one-click ability to enable for specific sites. Random browsing => no javascript. Play a browser game => javascript. I have this today with Flash, would be nice to have it for all client-side code execution.
- stickfigure 6y ago
  I use a Chrome extension called "Quick Javascript Switcher". If you click the icon in the bar, it switches JS off/on for the domain - using Chrome's built-in allow/block list for JS. I honestly could not live without it. At this point I have pretty much every news and recipe site on the internet blocked. Visiting a new site, as soon as I hear my fan spinning up I reach for the "no-JS" button and the page suddenly becomes responsive again. I'm not quite to the "no JS as default" level but I'm close.
  - Rivosa 6y ago
    Genuine question: Why use Chrome? Google themselves admited they are an ad company rather than a search engine company. Why use a browser by a company where their main revenues are ads.
    - stickfigure 6y ago
      I don't care? Of all the evils in the world, I just don't think advertising warrants much concern. I am tempted to use Firefox more to avoid browser monoculture. But Chrome pretty much just works.
- n0nc3 6y ago
  https://en.wikipedia.org/wiki/NoScript https://en.wikipedia.org/wiki/NoScript
  - alquemist 6y ago
    Christmas came early this year :) Thanks!
    - eindiran 6y ago
      For anyone considering taking the dive: NoScript takes a bit of time to get used to, but stick with it. You'll build up some things you are happy to whitelist, plus always have the backup option of disabling temporarily within a tab. In a week or two, your new workflow will feel completely natural.
      - rakoo 6y ago
        Another user here, and things weren't so smooth. Everytime you reach a new website you'll need to change rules and reload it. It's ok if you're always going to the same sites, but if you always discover new places (and I believe HN participates in that) it's a constant weight to lift. Always useful, but still not natural IME.
        dylan604 6y ago
        It gets a lot easier if you only allow self-hosted JS. Block any JS loaded from a domain other than the one you are actually visiting. If the site I am visiting cannot function properly from self-hosted JS, then I move right along. It has to be a webiste I'm really interested in for me to even consider allowing 3rd party JS.
        smittywerben 6y ago
        I've been whitelisting JavaScript since No-Script was new. I've used uMatrix recently but with it's end-of-development[0] I am considering switching back. I grew tired of having some shitty virus dropped to %appdata% for the N-th time loading a web page, exempli gratia [1] It's gotten a lot more annoying the last several years with 5mb webpages. Backing up the whitelist saves a lot of time. For perspective, I use 4 separate profiles (--user-data-dir) listed in descending order of how annoying they are for me to use. 1). School browser: Chrome + uBlock origin 2). Shopping/low security (when the payment processor is an iFrame and I don't want to refresh...): Firefox + uBlock origin + CanvasBlocker 3). General browsing like browsing Google or YouTube: Chrome + uBlock Origin + uMatrix 4). VPN browser: Chrome + uBlock origin + uMatrix + CookieAutoDelete + VPN extension I've gone from 2 browsers (Firefox + IE6) to 4 browsers (Firefox, Chrome1, Chrome2, Chrome3). By 2030 I'll be running 16 browsers in a virtual machine on a remote server that I connect to with my browser browser. [0] https://www.ghacks.net/2020/09/20/umatrix-development-has-ended/ https://www.ghacks.net/2020/09/20/umatrix-development-has-en... [1] http://forums.mozillazine.org/viewtopic.php?f=38&t=368230 http://forums.mozillazine.org/viewtopic.php?f=38&t=368230 (2006)
- quesera 6y ago
  > What I want for Christmas is javascript disabled by default, plus one-click ability to enable for specific sites. uBlock Origin solves this in two clicks. WFM.
  - alquemist 6y ago
    It does! I had to manually disable Javascript in UO settings, which solved the problem for me. FWIW, it doesn't solve the problem at scale, per opt-in / opt-out dynamics. It's a feature worth building into the browser, and setting it to disable JS by default. Make site owners ask for permission to use JS, and they better have a good reason.
    - alquemist 6y ago
      And yet, not enough: > Your browser fingerprint appears to be unique among the 2xx,xxx tested in the past 45 days. > Currently, we estimate that your browser has a fingerprint that conveys at least 18.xx bits of identifying information. Biggest offenders: USER AGENT and HTTP_ACCEPT HEADERS. Especially the USER AGENT is crazy, 9 digit browser version to everyone who asks?!
      - eindiran 6y ago
        Use an extension to spoof your user-agent string. Something like this: https://addons.mozilla.org/en-US/firefox/addon/user-agent-string-switcher/ https://addons.mozilla.org/en-US/firefox/addon/user-agent-st...
        alquemist 6y ago
        Thanks. What is the most common user agent out there? Sadly, this is of limited use. Defense against fingerprinting is like herd immunity. If everybody else already has a unique fingerprint, there is not much an individual can do to avoid being uniquely identified as well. At most one can spoof one other unique individual. Plus the EFF recommendation is 'latest Chrome on Windows' which is a moving target. Would be nice if the EFF site in OP would recommend an agent id to spoof to, at least that would help building a small, but non trivial herd of indistinguishable users. And then a popular extension like uBlock Origin would track this agent id and set it by default for all its users. Edit: list of top UAs: https://techblog.willshouse.com/2012/01/03/most-common-user-agents https://techblog.willshouse.com/2012/01/03/most-common-user-...
godelski 6y ago
I don't buy this. A 2017 Macbook Air and Safari should be a pretty common setup, yet I am far from unique (more bits than the FF I'm running).
mpeg 6y ago
Turning off javascript actually makes your browser more unique, in most cases, as it's so rare for people to do.
- lultimouomo 6y ago
  But it blocks a whole lot of other fingerprinting techniques, so I think the net output is decreasing your uniqueness.
iguy 6y ago
> You make yourself non-unique by looking like others. ... limited by the precautions that others take Yes. This is why it would ideally be done by the browser, not by individuals. If Safari reported only its top-level version number (and only exposed the installed-by-default fonts, and so on) then millions of others would suddenly look like me.

by n0nc3 6y ago

alquemist 6y ago

What I want for Christmas is javascript disabled by default, plus one-click ability to enable for specific sites. Random browsing => no javascript. Play a browser game => javascript. I have this today with Flash, would be nice to have it for all client-side code execution.

stickfigure 6y ago
I use a Chrome extension called "Quick Javascript Switcher". If you click the icon in the bar, it switches JS off/on for the domain - using Chrome's built-in allow/block list for JS. I honestly could not live without it. At this point I have pretty much every news and recipe site on the internet blocked. Visiting a new site, as soon as I hear my fan spinning up I reach for the "no-JS" button and the page suddenly becomes responsive again. I'm not quite to the "no JS as default" level but I'm close.
- Rivosa 6y ago
  Genuine question: Why use Chrome? Google themselves admited they are an ad company rather than a search engine company. Why use a browser by a company where their main revenues are ads.
  - stickfigure 6y ago
    I don't care? Of all the evils in the world, I just don't think advertising warrants much concern. I am tempted to use Firefox more to avoid browser monoculture. But Chrome pretty much just works.
n0nc3 6y ago
https://en.wikipedia.org/wiki/NoScript https://en.wikipedia.org/wiki/NoScript
- alquemist 6y ago
  Christmas came early this year :) Thanks!
  - eindiran 6y ago
    For anyone considering taking the dive: NoScript takes a bit of time to get used to, but stick with it. You'll build up some things you are happy to whitelist, plus always have the backup option of disabling temporarily within a tab. In a week or two, your new workflow will feel completely natural.
    - rakoo 6y ago
      Another user here, and things weren't so smooth. Everytime you reach a new website you'll need to change rules and reload it. It's ok if you're always going to the same sites, but if you always discover new places (and I believe HN participates in that) it's a constant weight to lift. Always useful, but still not natural IME.
      - dylan604 6y ago
        It gets a lot easier if you only allow self-hosted JS. Block any JS loaded from a domain other than the one you are actually visiting. If the site I am visiting cannot function properly from self-hosted JS, then I move right along. It has to be a webiste I'm really interested in for me to even consider allowing 3rd party JS.
      - smittywerben 6y ago
        I've been whitelisting JavaScript since No-Script was new. I've used uMatrix recently but with it's end-of-development[0] I am considering switching back. I grew tired of having some shitty virus dropped to %appdata% for the N-th time loading a web page, exempli gratia [1] It's gotten a lot more annoying the last several years with 5mb webpages. Backing up the whitelist saves a lot of time. For perspective, I use 4 separate profiles (--user-data-dir) listed in descending order of how annoying they are for me to use. 1). School browser: Chrome + uBlock origin 2). Shopping/low security (when the payment processor is an iFrame and I don't want to refresh...): Firefox + uBlock origin + CanvasBlocker 3). General browsing like browsing Google or YouTube: Chrome + uBlock Origin + uMatrix 4). VPN browser: Chrome + uBlock origin + uMatrix + CookieAutoDelete + VPN extension I've gone from 2 browsers (Firefox + IE6) to 4 browsers (Firefox, Chrome1, Chrome2, Chrome3). By 2030 I'll be running 16 browsers in a virtual machine on a remote server that I connect to with my browser browser. [0] https://www.ghacks.net/2020/09/20/umatrix-development-has-ended/ https://www.ghacks.net/2020/09/20/umatrix-development-has-en... [1] http://forums.mozillazine.org/viewtopic.php?f=38&t=368230 http://forums.mozillazine.org/viewtopic.php?f=38&t=368230 (2006)
quesera 6y ago
> What I want for Christmas is javascript disabled by default, plus one-click ability to enable for specific sites. uBlock Origin solves this in two clicks. WFM.
- alquemist 6y ago
  It does! I had to manually disable Javascript in UO settings, which solved the problem for me. FWIW, it doesn't solve the problem at scale, per opt-in / opt-out dynamics. It's a feature worth building into the browser, and setting it to disable JS by default. Make site owners ask for permission to use JS, and they better have a good reason.
  - alquemist 6y ago
    And yet, not enough: > Your browser fingerprint appears to be unique among the 2xx,xxx tested in the past 45 days. > Currently, we estimate that your browser has a fingerprint that conveys at least 18.xx bits of identifying information. Biggest offenders: USER AGENT and HTTP_ACCEPT HEADERS. Especially the USER AGENT is crazy, 9 digit browser version to everyone who asks?!
    - eindiran 6y ago
      Use an extension to spoof your user-agent string. Something like this: https://addons.mozilla.org/en-US/firefox/addon/user-agent-string-switcher/ https://addons.mozilla.org/en-US/firefox/addon/user-agent-st...
      - alquemist 6y ago
        Thanks. What is the most common user agent out there? Sadly, this is of limited use. Defense against fingerprinting is like herd immunity. If everybody else already has a unique fingerprint, there is not much an individual can do to avoid being uniquely identified as well. At most one can spoof one other unique individual. Plus the EFF recommendation is 'latest Chrome on Windows' which is a moving target. Would be nice if the EFF site in OP would recommend an agent id to spoof to, at least that would help building a small, but non trivial herd of indistinguishable users. And then a popular extension like uBlock Origin would track this agent id and set it by default for all its users. Edit: list of top UAs: https://techblog.willshouse.com/2012/01/03/most-common-user-agents https://techblog.willshouse.com/2012/01/03/most-common-user-...

godelski 6y ago

I don't buy this. A 2017 Macbook Air and Safari should be a pretty common setup, yet I am far from unique (more bits than the FF I'm running).

mpeg 6y ago

Turning off javascript actually makes your browser more unique, in most cases, as it's so rare for people to do.

lultimouomo 6y ago
But it blocks a whole lot of other fingerprinting techniques, so I think the net output is decreasing your uniqueness.

iguy 6y ago

> You make yourself non-unique by looking like others. ... limited by the precautions that others take Yes. This is why it would ideally be done by the browser, not by individuals. If Safari reported only its top-level version number (and only exposed the installed-by-default fonts, and so on) then millions of others would suddenly look like me.