5 ms·
I’m no Google fanboy but I wasn’t satisfied with this: > Chrome will happily collect as much private information about me and my browsing history and share the
by afavour 3y ago
I’m no Google fanboy but I wasn’t satisfied with this:
> Chrome will happily collect as much private information about me and my browsing history and share them with select parties, as needed
What information does Chrome provide in this scenario that Firefox doesn’t? It feels like backward logic: it worked in Chrome therefore it must be because Chrome gave extra info. In reality it could be a whole bunch of things, something as mundane as Firefox being a rarer user agent so subject to more filtering.
It strikes me that all of this is an inexact science. I've run into rate limit messages with sites before now that go away when I switch browsers, no matter what the browser is. I assume it's because, with the limited information given, the DDOS protection software assumes that same IP + different UA = different computer.
I have no clue but I wasn’t persuaded that this specific scenario works with Chrome because it was giving away more information. At a bare minimum at least try a third browser!
- deadbunny 3y agoYou're conflating a downside of using Chrome and the reason they think Cloudflare blocked them.
- afavour 3y ago> So I naturally tried to access the same page in Google Chrome to see if I’d still be blocked. Thankfully, I wasn’t. > But of course I wasn’t because Chrome doesn’t have the same privacy- and security-enhancing designs Maybe I’m missing something but it seems the conflation was by the article author, not me?
- tmpX7dMeXU 3y agoNo. And there’s still the central issue of the author really hand-waving the specifics of their accusations about Chrome. It really seems to come down to “Google bad”. To be clear, I don’t even use Chrome, in part because “Google bad”. This just isn’t intellectually honest.
- factormeta 3y agoseems like the author mentioned that in FireFox disabling "privacy.resistFingerprinting" worked. So looks like Chrome by default is allowing the server to collect Fingerprinting. If cloud flare is using that, then it is a big red flag.
- waithuh 3y agoOf course they are. Thats the whole point of the 'Integrity Check'. Besides, almost every website you visit collects your fingerprint nowadays.
- semiquaver 3y agoThe opposite. enabling the flag fixed the issue although it broke other sites. > Eventually, I found some suggestions that if you’re using Firefox you can disable the privacy.resistFingerprinting option in the about:config page. But that was already listed as false for me when I got stuck, so I switched the value to true just to see if that would do anything. > And that worked!
- jbdigriz990 3y agoWhen I started having this problem logging into a certain credit card co.'s website beginning with about Firefox 105.0.2 on Fedora 38, I was told by their apparently outsourced customer service that I had to use Chrome, which I don't have installed there and couldn't try. Yeah, they wanted me to use LogMeIn so they could fix the problem, too. Right. Firefox on Android was still working, though, loathe as I am to put passwords of any significance on my phone. Doesn't directly address your question, which I'd like to know the answer to as well.
- tmpX7dMeXU 3y ago[flagged]
- edmundsauto 3y agoWhy would they load balance based on user agent? I can’t think of a scenario where that was a reasonable solution.
- waithuh 3y agoMaybe back when standarts where on shaky ground and different versions of the same content was made? I too cant see the performance advantage of it. Deprioritizing less mainstream browsers to mess with the nerds?
- edmundsauto 3y agoAhhh yes I remember those days... if you wanted to use advanced IE-only features, send to one codebase, if you wanted broader compatability, send to another. Similar to how mobile websites used to work. Thanks for the ideas! Any other hypotheses?
- danShumway 3y ago> Completely reasonable and expected response from customer support Absolutely not, it is not reasonable or expected that a credit card company launch a website that doesn't work with Firefox. > Back in the day, my university would load balance based on the browser being used. What on earth?
- brandon 3y agoI don't mean to support or refuse the author's main points or analysis, but you might like to know that the Chrome team is currently working towards shipping the Topics API. I have strong opinions about it but I will try not to editorialize. My high-level understanding is that they're going to run an ML model over your browsing history (locally on your device) to build a list of "topics" that you care about. Sites you browse can use the Topics API to pull a set of these interests from the browser to show you "relevant" ads. Mozilla has taken a negative position against this standard. https://privacysandbox.com/proposals/topics/ https://privacysandbox.com/proposals/topics/ https://github.com/mozilla/standards-positions/issues/622 https://github.com/mozilla/standards-positions/issues/622
- afavour 3y agoHow is that relevant to the topic?
- Santosh83 3y agoYou asked: >> Chrome will happily collect as much private information about me and my browsing history and share them with select parties, as needed > What information does Chrome provide in this scenario that Firefox doesn’t?
- afavour 3y agoKey words: "in this scenario" Is Cloudflare using an as yet unshipped API as part of DDOS protection?
- smolder 3y agoNo, the idea is they're abusing existing APIs for fingerprinting purposes that Firefox privacy settings disallow --canvas font rendering difference detection, detecting your GPU model, and things of that nature. But this new API demonstrates that Google is not on the consumers side when it comes to limiting tracking/data gathering ability, as the new API is explicitly for fingerprinting.
- LoganDark 3y agoA third browser... like what? Chrome and Firefox are all that exist now, unless you have access to a Mac with Safari.
- waithuh 3y agoits time to pull out lynx again.
- mdwalters 3y agoMy "third" browser is GNOME Web, however, I uninstalled it thanks to performance issues. I installed Chrome from Flathub, but with limited permissions, which I only use for cross-browser testing. My main browser is Firefox.
- quaddo 3y agoCheck out Vivaldi...?
- LoganDark 3y agoYou mean "Chromium with extra steps"? I know it's a fork, but the actual engine is still mostly Chromium.
- silisili 3y agoThere are a handful of Webkit based browsers out there, though none that popular except for Safari. But yes, 3 is all we're left with outside of a few bespoke projects...
- LoganDark 3y agoHonestly the SerenityOS browser (+ its Linux port, Ladybird) is probably the funniest. I wonder if that passes CloudFlare...
- nextaccountic 3y agoServo seems to be more viable than Ladybird
- ayewo 3y agoChrome will indeed divulge more information than other browsers but only on the condition that you have opted-in for such collection. “The Chrome User Experience Report (CrUX) provides user experience metrics for how real-world Chrome users experience popular destinations on the web. This data is automatically collected by Chrome from users who have opted in, . . .” Taken from https://web.dev/crux-and-rum-differences/ https://web.dev/crux-and-rum-differences/
- afavour 3y agoIt's not a real time API, though. It's an aggregated dataset available via BigQuery. I don't think Cloudflare could use it as part of DDOS protection except in very vague ways.
- quest88 3y agoWhy would chrome give that information away? That's Google's most valuable resource.
- bayindirh 3y agoMaybe they're directly delivering your information for a price. From you to them, directly, via Chrome.
- morjom 3y agohttps://privacytests.org/ https://privacytests.org/ shows some good data what each browser lets through/exposes for websites.
- Fnoord 3y agoCaveat: (default settings) I harden my Firefox installations, and therefore this website comparison isn't useful.
- morjom 3y agoIt does have Librewolf and Mullvad listed, which are hardened Firefox forks. But its still not your exact scenario, my bad :)
- arendtio 3y ago@afavour: The topic isn't as simple as having a HTTP header with a unique identifier. Browser Fingerprinting is a complex process, that uses unintentional implementation details, like how things are rendered with different graphics drivers or details you can get from APIs that are intended for other purposes (like WebRTC). The site that morjom posted gives you a simple overview and Firefox is known for the privacy preserving features it comes with. However, you are right, that it is an inexact science as long as we don't know the logic of the Cloudflare implementation.
- BizarroLand 3y agoI've had sporadic issues with Firefox not working on work-related sites one day when the previous day it worked just fine. I have ublock, privacy badger, decentraleyes, canvas blocker, facebook disconnect, and duckduckgo privacy essentials installed. I would go through and disable each extension in order to see if it was the cause of the issue, and so far, every single time it has been duckduckgo privacy essentials that is breaking websites for me. I think I should remove it at this point, but who knows? Maybe it's protecting me from something that I don't see.
- rocho 3y agoWith Firefox you can toggle some settings that will make much harder to generate useful fingerprints. That's already a massive privacy difference.