5 ms·
RFC2109, from 1997, had this: 8.3 Unexpected Cookie Sharing A user agent should make every attempt to prevent the sharing of session information between host
by tyingq 4y ago
RFC2109, from 1997, had this:
8.3 Unexpected Cookie Sharing
A user agent should make every attempt to prevent the sharing of session information between hosts that are in different domains. Embedded or inlined objects may cause particularly severe privacy problems if they can be used to share cookies between disparate hosts. For example, a malicious server could embed cookie information for host a.com in a URI for a CGI on host b.com. User agent implementors are strongly encouraged to prevent this sort of exchange whenever possible.
- hedora 4y agoIt's really weird that they claim there privacy work started in 2015. Netscape Navigator add cross site cookie blocking at some point, and firefox has always (?) had it. The innovation here seems to be that they further partition by the URL in the address bar. It's frustrating that browsers have been fighting and losing this war for 25 years. (Presumably they still don't block browser fingerprinting, so sites will just move to that instead...)
- staticassertion 4y agoIt's not possible to block browser fingerprinting since it's a range of techniques and heuristics based on numerous features. There's no "turn off fingerprinting" button you can just press.
- sillysaurusx 4y agoWhonix says hello. https://www.whonix.org/ https://www.whonix.org/ I was planning to use it exclusively when I was working on a system to fight cartels, so I got pretty deep into these kinds of questions. Whonix has its own problems but it's the best solution available. The communities are interesting too. One fellow was trying to download map data, which confused me initially. Why was he so fixated on maps? It's because if you're in the middle of a warzone, there's obviously no cell service, and it might be a few weeks before you reach an area with wifi. Remarkably prescient given that this was 2013 or so. But you're right in general that there's no way to do it that isn't a pain in the ass for most people. "I can't resize my browser window? Really?"
- staticassertion 4y agoI'm sure that the techniques used in Whonix can reduce the number of valuable features used in fingerprinting but you can't "solve" fingerprinting without every single user switching over to something like this.
- mdp2021 4y agoIt is possible to enable obstacles to fingerprinting. In Firefox, it is configuration entry privacy.resistFingerprinting Some details (the list is not exhaustive): > * Your timezone is reported to be UTC; * Not all fonts installed on your computer are available to webpages; * The browser window prefers to be set to a specific size; * Your browser reports a specific, common version number and operating system; * Your keyboard layout and language is disguised; * Your webcam and microphone capabilities are disguised; * The Media Statistics Web API reports misleading information; * Any Site-Specific Zoom settings are not applied; * The WebSpeech, Gamepad, Sensors, and Performance Web APIs are disabled, etc.
- roughly 4y agoI’ve got this enabled - the only one that’s been more than a mild pain in the ass is the UTC timezone change. Always takes a minute to remember why a site is telling me my appointment is at 2:30 in the morning.
- jszymborski 4y agoIs there a way to reset the timezone but have all the other protections? Timezone provides pretty low information relative to the pain it causes me when I show up to my meeting 5 hours later.
- m463 4y agoI have tried and tried to override this on a site-by-site basis I tried setting: privacy.resistFingerprinting.exemptedDomains to the domain privacy.resistFingerprinting.testGranularityMask -> 4 I still get utc in slack
- 35mm 4y agoJust move to London
- __tmk__ 4y agoUK has daylight savings time. Better move to Iceland instead. They're always on UTC.
- na85 4y agoIt's certainly possible to curtail fingerprinting. Why is my browser reporting my resolution to the server? Why can't you just serve me HTML and let me render it how I damn well please?
- staticassertion 4y agoSounds like a really unique, fingerprintable way to browse.
- fiddlerwoaroof 4y ago> Why is my browser reporting my resolution to the server The browser doesn’t need to report anything by default. You can get a reasonable estimate with CSS + JavaScript (e.g. using media queries to modify some observable properties on the basis of the screen width and then report what those properties are via a call to fetch)
- wraptile 4y agoIt's not binary but it's unfair to say "it can't be done" it absolute can be made significantly better. The strongest fingerprinting techniques use a lot of computing (e.g. font, canvas analysis) so they are expensive to use - no one wants to slow down their visitors by several seconds. The weaker fingerprint techniques can be easily patched and mocked it's just that it's a constant effort to keep up with them. All it would take is 1 major browser to enable it by default to distrubt whole fingerprinting ecosystem to the point where it would be too expensive to effectively fingerprint people.
- CodesInChaos 4y agoInternet explorer used to ask the user before saving cookies. And the server had to declare what cookies would be used for in machine readable form (P3P) which the browser used to decide if it want to allow the cookie (google blatantly lied) And more recently DNT. A graveyard of failed attempts at improving privacy
- nieve 4y agoFIrefox used to ask, then it would ask if you set the right preference, and then it stopped asking entirely. I was very disappointed in them.