7 ms·

Privacy-Respecting Software

162 points by cuu508 5y ago

shafyy 5y ago
Looks great. I can see that my small privay-friendly product analytics tool Fugu (https://github.com/shafy/fugu https://github.com/shafy/fugu) is missing, I will make a PR =P
forgotmypw17 5y ago
And in general software which respects user consent
- nonrandomstring 5y ago
  Good point, worth elaborating on. That's one of the reasons I started using the word 'dignity' in place of saying 'privacy' without thinking more. In particular I've found the phrase "digital dignity" stands in more comfortably in some conversations with people who are jaded and cynical about privacy [1]. Privacy does not always equate to security nor mean that the user isn't abused in other ways (indeed many abusers leverage privacy or shame as a way to hide their abuse) [1] https://digitalvegan.net https://digitalvegan.net
kekebo 5y ago
There's mention of the possibility to self host 1password sync, but I can only find a current survey by agilebits to determine if they should implement it. Anyone know if this is already possible or can provide more info on the status?
nonrandomstring 5y ago
Nice up-to-date collection. I'm tired of finding old lists like this but filled with legacy, unmaintained programs. > "Be careful when installing unfamiliar browser add-ons, since some can compromise your security and privacy." I like these little interjections to explain things for beginners. In this case though, I wonder what code auditing/verification is in place to support such a statement: > "At the time of writing, the above list were all open source, verified and 'safe'"
- Ocha 5y ago
  Is there similar list for development tools and services? (e.g. IDEs, cloud services, SaaS Software, datacenters, etc.)
- freddyym 5y ago
  > Nice up-to-date collection. I'm tired of finding old lists like this but filled with legacy, unmaintained programs. It doesn't seem very up-to-date even if the last update was only three hours ago. It still describes Element as 'Matrix + Riot client' even though this changed in 2020. [0] > I like these little interjections to explain things for beginners. These are nice, however a proper criteria would be even nicer. Currently it is just a list of vaguely private and open source software. 0 - https://element.io/blog/the-world-is-changing/ https://element.io/blog/the-world-is-changing/
- feanaro 5y ago
  It has me doubting its accuracy when it calls Element "Riot". I'm also not quite clear why it splits up encrypted vs P2P messaging when encryption and decentralization are two separate concepts.
bscphil 5y ago
One thing a little weird about this list is that it has "privacy-respecting" software mixed in with privacy tools. DuckDuckGo doesn't track you individually, or at least, they don't filter-bubble and advertise to you individually, but they do collect data on what users click on. Privacy-respecting? I think that's debatable. The 1.1.1.1 app is a privacy tool insofar as it allows you to hide DNS requests from anyone in the middle of your connections, but it also means sending your DNS requests (or everything, if you use the VPN) to Cloudflare. According to exodus it contains 2 tracking scripts. Is the end result "privacy-respecting"? Might depend on your opinion of Cloudflare and/or your use case. Should I Remove it [dot] com? Has some information about potentially unwanted programs, but it's also just some proprietary source of information and contains Google Ads and tracking scripts on its pages. And so on and so forth.
- ricardo81 5y ago
  The ones listed are also meta search engines built off non-privacy respecting search engines. Would have been nice if they listed independent ones.
- dngray 5y ago
  Another section I noticed there that is horribly wrong: > Without using a secure, privacy-centric DNS all your web requests can be seen in the clear. You should configure your DNS queries to be managed by a service that respects privacy and supports DNS-over-TLS, DNS-over-HTTPS or DNSCrypt. These things do very little for privacy as we painstakingly write about in this article https://www.privacyguides.org/technology/dns/ https://www.privacyguides.org/technology/dns/
deleted 5y ago
[deleted]
nitinagg 5y ago
Wondering if folks would be interested in a framework to run/deploy the self hosted items here easily on the public clouds..
dngray 5y ago
The problem with lists like this is they really are just a "here's 100 open source products", without any criteria or individual evaluation. It is often just parrots repeating what other parrots say. Something which is clearly alpha-state isn't usable to regular users shouldn't have a "recommendation". Then you get sub optimal recommendations, listing some projects which are unmaintained etc. With the cleanup at https://privacyguides.org https://privacyguides.org, (since we split from PTIO) we've removed a lot of things, and gone down the part of actually providing guidance rather than "use this software to make you magically more private". I think it's important to think privately, modify behavior rather than rely on technology to do it all for you. Looking at this particular list there are some bad choices: - LessPass: We explicitly removed deterministic password managers https://github.com/privacyguides/privacyguides.org/pull/323 https://github.com/privacyguides/privacyguides.org/pull/323, https://tonyarcieri.com/4-fatal-flaws-in-deterministic-password-managers https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw... - AndOTP: Uses PBKDF2 and a heap of rounds that is unbelievably slow when you have a number of OTPs. Aegis uses Argon, which doesn't have this problem, and we think it's code is developed by someone who is security conscientious. - Qwant: https://github.com/privacyguides/privacyguides.org/pull/342#issue-1057922379 https://github.com/privacyguides/privacyguides.org/pull/342#..., we removed due to "due to bad privacy policies data is collected and shared with third parties" - Silence: Unmaintained, uses SS7 network, should never be recommended. - Off-The-Record: Doesn't cover group chats or other side channels, such as status updates, VOIP. In general XMPP isn't particularly "privacy friendly" https://web.archive.org/web/20211215132539/https://infosec-handbook.eu/articles/xmpp-aitm/ https://web.archive.org/web/20211215132539/https://infosec-h... - PGP: NO. It has no forward secrecy, it's a terrible way to encrypt real time communication. - Matrix + Riot client: Seriously, it's been "Element" for ages now, makes me think the author really isn't up to date with current events. - Ricochet: Unmaintained, (2016) domain dead, Only supported .onion HSv2 - Tox + qTox: Developed wrong. They developed the software then decided to write the spec afterwards. There's also https://github.com/TokTok/c-toxcore/issues/426 https://github.com/TokTok/c-toxcore/issues/426 - Mailfence: Last email I sent to them they don't use any kind of disk encryption - CriptText, these things really don't help, they are walled, in that everyone has to be on a centralized service to get the benefit. E2EE that comes with web-apps can often be dangerous as it can change, have vulnerabilities introduced after an audit etc. - TorBirdy: Unmaintained - Mumble: Not really private - Linphone: Not really private - Rocket Chat: Experimental E2EE - Browser Extensions: NO JUST NO. https://blog.privacyguides.org/2021/12/01/firefox-privacy-2021-update/ https://blog.privacyguides.org/2021/12/01/firefox-privacy-20... https://github.com/arkenfox/user.js/wiki/4.1-Extensions https://github.com/arkenfox/user.js/wiki/4.1-Extensions - Video Platforms: These are not private - RSS Clients: There are better options - Mobile Operating Systems: Options without Verified Boot. NO. https://source.android.com/security/verifiedboot https://source.android.com/security/verifiedboot - Linux recommendations: Those are also awful and don't have any threat model in mind. I'm going to stop now, it's basically every bad thing that was ever on PTIO, that we removed. Basically there are terrible recommendations with a few good ones sprinkled in. This list is *not* maintained!
bodge5000 5y ago
Whats the current consensus on Brave? Last time I tried it, it seemed to be an alright alternative to Chrome, but remember it wasn't entirely well liked on HN for whatever reason.
- fsflover 5y ago
  It supports Google monopoly on the web by following standards decided by Google.
- dngray 5y ago
  > Whats the current consensus on Brave? If you want to use Chromium based browsers it's probably the only browser that is: - Cares about security, (not doing stupid shit like disabling CRLSets), they are proxied by Brave. See https://qua3k.github.io/ungoogled/ https://qua3k.github.io/ungoogled/ - Does try to do some anti-fingerprinting, while its not a strong as Firefox+Arkenfox, it's at least a step in the direction as opposed to other browsers which don't even attempt to do anything about it - Its a resourced fork with timely security updates, don't use small browsers which lag behind. - Their shields thing aren't bad, they have a script blocker (a bit like noscript) too you can enable, that isn't an addon.
  - h4waii 5y ago
    By these measures of security, anti-fingerprinting, and privacy, both Bromite and Vanadium are far superior to Brave. Bromite is available on F-Droid, and unfortunately Vanadium is only available on GrapheneOS unless you build it yourself.
    - dngray 5y ago
      Vanadium and Brave are only available on Android. Vanadium doesn't really have any privacy features that people normally think of (anti-fp, adblocking etc), it's a series of security related patches https://github.com/GrapheneOS/Vanadium/tree/12.1/patches https://github.com/GrapheneOS/Vanadium/tree/12.1/patches Bromite does have some features like this https://github.com/bromite/bromite https://github.com/bromite/bromite, but we've found in experience the adblocker, is not as comprehensive as uBO, particularly in harder blocking modes https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium-mode https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium... That said for Android Firefox doesn't have the same process isolation like we see from chromium browsers. I still wouldn't bother with Brave on mobile when you've got Bromite though.
phan 5y ago
Pretty useless and subjectively biased list.
philjohn 5y ago
For 2FA leaving out Yubico Authenticator seems strange? The TOTP seeds live on the Yubikey itself, and the app only communicates via NFC (or USB) with it - no phoning home.
- dngray 5y ago
  Yeah, it is. A lot of these lists focus on the fallacy that all open source software == secure, and anything that is not open is instantly bad. We list the Yubikey, as it is at the moment it's one of the better MFA products out there. https://www.privacyguides.org/security/multi-factor-authentication/ https://www.privacyguides.org/security/multi-factor-authenti... https://www.privacyguides.org/multi-factor-authentication/ https://www.privacyguides.org/multi-factor-authentication/
  - philjohn 5y ago
    That's a great resource, thanks for putting it together! The thing I've found great about Yubikeys is how easy it has been to onboard non-technical family members to using them.
jerry1979 5y ago
I notice gocryptfs is missing from the encryption section. Is there something wrong with that software?
vmoore 5y ago
> https://github.com/Lissy93/personal-security-checklist/blob/master/5_Privacy_Respecting_Software.md#browser-extensions https://github.com/Lissy93/personal-security-checklist/blob/... I went through a mad phase where I had loads of extensions installed in my main browser. Then all these stories came out about addon authors getting contacted by shady actors who wanted to buy the addon so they could add malicious code that siphons off personal data. Now I just have uBlock Origin and that's it! I trust it NOT to be taken over by bad actors. Addons also have exploitable bugs in them, and also having multiple 'privacy addons' can mean some overlap in functionality where the tracking protection is redundant since it's covered by another addon. Like who really needs Privacy Badger, DuckDuckGo privacy essentials, and then uBlock running all together? And with browsers shipping with fingerprinting mitigation, and having the option to surf strictly HTTPS sites, some addons are becoming redundant, like HTTPS Everywhere & 'useragent spoofing' addons which can actually make you stand out (privacy.resistFingerprinting:true in Firefox FTW). The trick is to blend in with a useragent, not stand out.
- dngray 5y ago
  Would upvote parent more than once if I could. > I went through a mad phase where I had loads of extensions installed in my main browser. Then all these stories came out about addon authors getting contacted by shady actors who wanted to buy the addon so they could add malicious code that siphons off personal data. Now I just have uBlock Origin and that's it! I trust it NOT to be taken over by bad actors. Addons increase the number of parties you trust and also can make your browser more vulnerable. As we say in our openening paragraph https://www.privacyguides.org/browsers/ https://www.privacyguides.org/browsers/ These are our current web browser recommendations and settings. We recommend keeping extensions to a minimum: they have privileged access within your browser, require you to trust the developer, can make you stand out, and weaken site isolation. - https://en.wikipedia.org/wiki/Device_fingerprint#Browser_fingerprint https://en.wikipedia.org/wiki/Device_fingerprint#Browser_fin... - https://groups.google.com/a/chromium.org/g/chromium-extensions/c/0ei-UCHNm34/m/lDaXwQhzBAAJ https://groups.google.com/a/chromium.org/g/chromium-extensio... > Addons also have exploitable bugs in them, and also having multiple 'privacy addons' can mean some overlap in functionality where the tracking protection is redundant since it's covered by another addon. Like who really needs Privacy Badger, DuckDuckGo privacy essentials, and then uBlock running all together? Which is why common methodology now is very conservative. If you look at the research Arkenfox has done https://github.com/arkenfox/user.js/wiki/4.1-Extensions https://github.com/arkenfox/user.js/wiki/4.1-Extensions they recommend very few extensions. > And with browsers shipping with fingerprinting mitigation, and having the option to surf strictly HTTPS sites, some addons are becoming redundant, like HTTPS Everywhere & 'useragent spoofing' addons which can actually make you stand out (privacy.resistFingerprinting:true in Firefox FTW). The trick is to blend in with a useragent, not stand out. RFP does more than just adjust the user agent. User agent spoofing does *not* work. As soon as you allow javascript there are dozens of metrics that can be used to profile you and to determine exactly what browser you have.

162 points by cuu508 5y ago

Looks great. I can see that my small privay-friendly product analytics tool Fugu (https://github.com/shafy/fugu https://github.com/shafy/fugu) is missing, I will make a PR =P

forgotmypw17 5y ago

And in general software which respects user consent

nonrandomstring 5y ago
Good point, worth elaborating on. That's one of the reasons I started using the word 'dignity' in place of saying 'privacy' without thinking more. In particular I've found the phrase "digital dignity" stands in more comfortably in some conversations with people who are jaded and cynical about privacy [1]. Privacy does not always equate to security nor mean that the user isn't abused in other ways (indeed many abusers leverage privacy or shame as a way to hide their abuse) [1] https://digitalvegan.net https://digitalvegan.net

kekebo 5y ago

There's mention of the possibility to self host 1password sync, but I can only find a current survey by agilebits to determine if they should implement it. Anyone know if this is already possible or can provide more info on the status?

nonrandomstring 5y ago

Nice up-to-date collection. I'm tired of finding old lists like this but filled with legacy, unmaintained programs. > "Be careful when installing unfamiliar browser add-ons, since some can compromise your security and privacy." I like these little interjections to explain things for beginners. In this case though, I wonder what code auditing/verification is in place to support such a statement: > "At the time of writing, the above list were all open source, verified and 'safe'"

Ocha 5y ago
Is there similar list for development tools and services? (e.g. IDEs, cloud services, SaaS Software, datacenters, etc.)
freddyym 5y ago
> Nice up-to-date collection. I'm tired of finding old lists like this but filled with legacy, unmaintained programs. It doesn't seem very up-to-date even if the last update was only three hours ago. It still describes Element as 'Matrix + Riot client' even though this changed in 2020. [0] > I like these little interjections to explain things for beginners. These are nice, however a proper criteria would be even nicer. Currently it is just a list of vaguely private and open source software. 0 - https://element.io/blog/the-world-is-changing/ https://element.io/blog/the-world-is-changing/
feanaro 5y ago
It has me doubting its accuracy when it calls Element "Riot". I'm also not quite clear why it splits up encrypted vs P2P messaging when encryption and decentralization are two separate concepts.

bscphil 5y ago

One thing a little weird about this list is that it has "privacy-respecting" software mixed in with privacy tools. DuckDuckGo doesn't track you individually, or at least, they don't filter-bubble and advertise to you individually, but they do collect data on what users click on. Privacy-respecting? I think that's debatable. The 1.1.1.1 app is a privacy tool insofar as it allows you to hide DNS requests from anyone in the middle of your connections, but it also means sending your DNS requests (or everything, if you use the VPN) to Cloudflare. According to exodus it contains 2 tracking scripts. Is the end result "privacy-respecting"? Might depend on your opinion of Cloudflare and/or your use case. Should I Remove it [dot] com? Has some information about potentially unwanted programs, but it's also just some proprietary source of information and contains Google Ads and tracking scripts on its pages. And so on and so forth.

ricardo81 5y ago
The ones listed are also meta search engines built off non-privacy respecting search engines. Would have been nice if they listed independent ones.
dngray 5y ago
Another section I noticed there that is horribly wrong: > Without using a secure, privacy-centric DNS all your web requests can be seen in the clear. You should configure your DNS queries to be managed by a service that respects privacy and supports DNS-over-TLS, DNS-over-HTTPS or DNSCrypt. These things do very little for privacy as we painstakingly write about in this article https://www.privacyguides.org/technology/dns/ https://www.privacyguides.org/technology/dns/

deleted 5y ago

[deleted]

nitinagg 5y ago

Wondering if folks would be interested in a framework to run/deploy the self hosted items here easily on the public clouds..

dngray 5y ago

The problem with lists like this is they really are just a "here's 100 open source products", without any criteria or individual evaluation. It is often just parrots repeating what other parrots say. Something which is clearly alpha-state isn't usable to regular users shouldn't have a "recommendation". Then you get sub optimal recommendations, listing some projects which are unmaintained etc. With the cleanup at https://privacyguides.org https://privacyguides.org, (since we split from PTIO) we've removed a lot of things, and gone down the part of actually providing guidance rather than "use this software to make you magically more private". I think it's important to think privately, modify behavior rather than rely on technology to do it all for you. Looking at this particular list there are some bad choices: - LessPass: We explicitly removed deterministic password managers https://github.com/privacyguides/privacyguides.org/pull/323 https://github.com/privacyguides/privacyguides.org/pull/323, https://tonyarcieri.com/4-fatal-flaws-in-deterministic-password-managers https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw... - AndOTP: Uses PBKDF2 and a heap of rounds that is unbelievably slow when you have a number of OTPs. Aegis uses Argon, which doesn't have this problem, and we think it's code is developed by someone who is security conscientious. - Qwant: https://github.com/privacyguides/privacyguides.org/pull/342#issue-1057922379 https://github.com/privacyguides/privacyguides.org/pull/342#..., we removed due to "due to bad privacy policies data is collected and shared with third parties" - Silence: Unmaintained, uses SS7 network, should never be recommended. - Off-The-Record: Doesn't cover group chats or other side channels, such as status updates, VOIP. In general XMPP isn't particularly "privacy friendly" https://web.archive.org/web/20211215132539/https://infosec-handbook.eu/articles/xmpp-aitm/ https://web.archive.org/web/20211215132539/https://infosec-h... - PGP: NO. It has no forward secrecy, it's a terrible way to encrypt real time communication. - Matrix + Riot client: Seriously, it's been "Element" for ages now, makes me think the author really isn't up to date with current events. - Ricochet: Unmaintained, (2016) domain dead, Only supported .onion HSv2 - Tox + qTox: Developed wrong. They developed the software then decided to write the spec afterwards. There's also https://github.com/TokTok/c-toxcore/issues/426 https://github.com/TokTok/c-toxcore/issues/426 - Mailfence: Last email I sent to them they don't use any kind of disk encryption - CriptText, these things really don't help, they are walled, in that everyone has to be on a centralized service to get the benefit. E2EE that comes with web-apps can often be dangerous as it can change, have vulnerabilities introduced after an audit etc. - TorBirdy: Unmaintained - Mumble: Not really private - Linphone: Not really private - Rocket Chat: Experimental E2EE - Browser Extensions: NO JUST NO. https://blog.privacyguides.org/2021/12/01/firefox-privacy-2021-update/ https://blog.privacyguides.org/2021/12/01/firefox-privacy-20... https://github.com/arkenfox/user.js/wiki/4.1-Extensions https://github.com/arkenfox/user.js/wiki/4.1-Extensions - Video Platforms: These are not private - RSS Clients: There are better options - Mobile Operating Systems: Options without Verified Boot. NO. https://source.android.com/security/verifiedboot https://source.android.com/security/verifiedboot - Linux recommendations: Those are also awful and don't have any threat model in mind. I'm going to stop now, it's basically every bad thing that was ever on PTIO, that we removed. Basically there are terrible recommendations with a few good ones sprinkled in. This list is *not* maintained!

bodge5000 5y ago

Whats the current consensus on Brave? Last time I tried it, it seemed to be an alright alternative to Chrome, but remember it wasn't entirely well liked on HN for whatever reason.

fsflover 5y ago
It supports Google monopoly on the web by following standards decided by Google.
dngray 5y ago
> Whats the current consensus on Brave? If you want to use Chromium based browsers it's probably the only browser that is: - Cares about security, (not doing stupid shit like disabling CRLSets), they are proxied by Brave. See https://qua3k.github.io/ungoogled/ https://qua3k.github.io/ungoogled/ - Does try to do some anti-fingerprinting, while its not a strong as Firefox+Arkenfox, it's at least a step in the direction as opposed to other browsers which don't even attempt to do anything about it - Its a resourced fork with timely security updates, don't use small browsers which lag behind. - Their shields thing aren't bad, they have a script blocker (a bit like noscript) too you can enable, that isn't an addon.
- h4waii 5y ago
  By these measures of security, anti-fingerprinting, and privacy, both Bromite and Vanadium are far superior to Brave. Bromite is available on F-Droid, and unfortunately Vanadium is only available on GrapheneOS unless you build it yourself.
  - dngray 5y ago
    Vanadium and Brave are only available on Android. Vanadium doesn't really have any privacy features that people normally think of (anti-fp, adblocking etc), it's a series of security related patches https://github.com/GrapheneOS/Vanadium/tree/12.1/patches https://github.com/GrapheneOS/Vanadium/tree/12.1/patches Bromite does have some features like this https://github.com/bromite/bromite https://github.com/bromite/bromite, but we've found in experience the adblocker, is not as comprehensive as uBO, particularly in harder blocking modes https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium-mode https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium... That said for Android Firefox doesn't have the same process isolation like we see from chromium browsers. I still wouldn't bother with Brave on mobile when you've got Bromite though.

phan 5y ago

Pretty useless and subjectively biased list.

philjohn 5y ago

For 2FA leaving out Yubico Authenticator seems strange? The TOTP seeds live on the Yubikey itself, and the app only communicates via NFC (or USB) with it - no phoning home.

dngray 5y ago
Yeah, it is. A lot of these lists focus on the fallacy that all open source software == secure, and anything that is not open is instantly bad. We list the Yubikey, as it is at the moment it's one of the better MFA products out there. https://www.privacyguides.org/security/multi-factor-authentication/ https://www.privacyguides.org/security/multi-factor-authenti... https://www.privacyguides.org/multi-factor-authentication/ https://www.privacyguides.org/multi-factor-authentication/
- philjohn 5y ago
  That's a great resource, thanks for putting it together! The thing I've found great about Yubikeys is how easy it has been to onboard non-technical family members to using them.

jerry1979 5y ago

I notice gocryptfs is missing from the encryption section. Is there something wrong with that software?

vmoore 5y ago

> https://github.com/Lissy93/personal-security-checklist/blob/master/5_Privacy_Respecting_Software.md#browser-extensions https://github.com/Lissy93/personal-security-checklist/blob/... I went through a mad phase where I had loads of extensions installed in my main browser. Then all these stories came out about addon authors getting contacted by shady actors who wanted to buy the addon so they could add malicious code that siphons off personal data. Now I just have uBlock Origin and that's it! I trust it NOT to be taken over by bad actors. Addons also have exploitable bugs in them, and also having multiple 'privacy addons' can mean some overlap in functionality where the tracking protection is redundant since it's covered by another addon. Like who really needs Privacy Badger, DuckDuckGo privacy essentials, and then uBlock running all together? And with browsers shipping with fingerprinting mitigation, and having the option to surf strictly HTTPS sites, some addons are becoming redundant, like HTTPS Everywhere & 'useragent spoofing' addons which can actually make you stand out (privacy.resistFingerprinting:true in Firefox FTW). The trick is to blend in with a useragent, not stand out.

dngray 5y ago
Would upvote parent more than once if I could. > I went through a mad phase where I had loads of extensions installed in my main browser. Then all these stories came out about addon authors getting contacted by shady actors who wanted to buy the addon so they could add malicious code that siphons off personal data. Now I just have uBlock Origin and that's it! I trust it NOT to be taken over by bad actors. Addons increase the number of parties you trust and also can make your browser more vulnerable. As we say in our openening paragraph https://www.privacyguides.org/browsers/ https://www.privacyguides.org/browsers/ These are our current web browser recommendations and settings. We recommend keeping extensions to a minimum: they have privileged access within your browser, require you to trust the developer, can make you stand out, and weaken site isolation. - https://en.wikipedia.org/wiki/Device_fingerprint#Browser_fingerprint https://en.wikipedia.org/wiki/Device_fingerprint#Browser_fin... - https://groups.google.com/a/chromium.org/g/chromium-extensions/c/0ei-UCHNm34/m/lDaXwQhzBAAJ https://groups.google.com/a/chromium.org/g/chromium-extensio... > Addons also have exploitable bugs in them, and also having multiple 'privacy addons' can mean some overlap in functionality where the tracking protection is redundant since it's covered by another addon. Like who really needs Privacy Badger, DuckDuckGo privacy essentials, and then uBlock running all together? Which is why common methodology now is very conservative. If you look at the research Arkenfox has done https://github.com/arkenfox/user.js/wiki/4.1-Extensions https://github.com/arkenfox/user.js/wiki/4.1-Extensions they recommend very few extensions. > And with browsers shipping with fingerprinting mitigation, and having the option to surf strictly HTTPS sites, some addons are becoming redundant, like HTTPS Everywhere & 'useragent spoofing' addons which can actually make you stand out (privacy.resistFingerprinting:true in Firefox FTW). The trick is to blend in with a useragent, not stand out. RFP does more than just adjust the user agent. User agent spoofing does *not* work. As soon as you allow javascript there are dozens of metrics that can be used to profile you and to determine exactly what browser you have.