3 ms·

I fantasize having a browser that I can use only for viewing content. No applications. No mail. No need for cookies. I can use a "regular" browser for more en

by BeetleB 6mo ago

I fantasize having a browser that I can use only for viewing content. No applications. No mail. No need for cookies. I can use a "regular" browser for more enhanced stuff. But for simple content consumption, we can just have a "dumb" browser that can't do much. > A user agent that says the browser's version? Reasonable enough. No user agent. I'm guessing it will need it for JavaScript or HTML features, and dynamically update if using an old browser, but let's just not supply a user agent and let it be the reader's burden to have a reasonably decent browser. > Being able to ask for fonts, if the system has them? Difficult to have font support without that. What's the fallback if the system doesn't have them? > Getting the user's timezone, language and keyboard layout? Reasonable. Keyboard layout is irrelevant for viewing content. For timezone and language: Yeah, I can see the use cases, but these are in a small minority. Let there be a popup when requested, and the user can specify the timezone/language as requested. > The size of the screen, and the size of the browser window? Difficult to lay things out without that. Let's let this new browser return only from a (small) discrete set of sizes. It will pick the size closest to the actual browser window size and send that. > Of course a video or audio player needs to know which video formats your browser supports - how else to provide the right video? Same answer as user agent. Either let the user pick from a selection of video formats, or just hard code a reasonable one and put the onus on the user to have a browser that supports it. > Obviously javascript can get the time, and it's trivial to figure out the system's clock error by comparing that to the time on a server. This hypothetical browser could just not send the time :-) For 99% of content consumption, this function is not needed. What I'm describing should be part of "Private mode". Or browsers should have an "Ultra-private" mode that is the above. If it's too complex/risky maintaining it all in one codebase ... fine. Just have a separate browser. Right now, if I built such a browser, I'm sure a lot of sites meant for content would break. But in my fantasy world, using "Ultra-private" would be the default, and people who make sites will target them first. I think much of the complexity in making a web browser is all the "other" stuff. Being able to run apps, cookie/privacy management, etc.

0x62 6mo ago
Unfortunately you've now made an incredibly niche browser, and the lack of those metrics is a good fingerprint by itself. How browsers render SVGs can be used for fingerprinting (even the underlying OS affects this, and I assume you'll want to see those), combine with ISP from IP address, and unless theres hundreds users in every city you're now pretty easily trackable.
- BeetleB 6mo ago
  > Unfortunately you've now made an incredibly niche browser, and the lack of those metrics is a good fingerprint by itself. If 100 people are using that browser, how will they know which one is me? > How browsers render SVGs can be used for fingerprinting (even the underlying OS affects this, and I assume you'll want to see those) Can you provide details on this? And how will they know which OS I'm using (through SVG rendering...)? The UserAgent definitely should not send the OS. > combine with ISP from IP address That's already provided whether I use Private mode or not, correct? I can always use a VPN.
  - pbhjpbhj 6mo ago
    You're the only one out of 100 that visits HN, or who's use matches a particular timezone, or who has the use pattern that [anti-]correlates with your work pattern, or ...
    - BeetleB 6mo ago
      My brain is a bit slow today: > You're the only one out of 100 that visits HN So the HN operator sees someone using this browser, with this timezone. Then I go to some other site. Let's pretend that site's operator and HN's are identical. How will they know that I'm the same guy who went to HN? How does he know there aren't two people who use the browser in the same timezone (and the other one doesn't go to HN)?
      - Atreiden 6mo ago
        I think the point is that it takes very few data points to effectively deanonymize someone. And the less common a data point is, the greater the information gain. "User is male" eliminates ~half of users. "User actively reads HackerNews" eliminates >99%. "User uses this niche browser that only 1000 people have ever been seen using" eliminates 99.999%. This is how surveillance operates at scale. You don't need a stable identifier linking a specific person's identity, you just need a few data points to narrow it down to even a few thousand people. Then you apply more focus on those people, gathering data points that eliminate people until you're left with your target. And thanks to decades of global iteration on surveillance infrastructure, and AI to glue data sets together, it's all automated.
93po 6mo ago
i've had the same thought for 20 years and unfortunately it's less likely than ever to happen now, given how many sites require javascript and have cloudflare pages before even loading a site (I get several a day). thankfully i think traditional web surfing is probably going to die out in the next 10 years, and progressively decline a lot much sooner than that as people start to interact with AI rather than browsers (or any software for that matter). my feed of hackernews is going to be my AI agent giving it to me in plain text very soon, and soon after that i will probably never visit the internet again because it will be impossible to know what's real and fake as a millennial it will be interesting to experience the full cycle of being born when nothing was online, to everything being online, to then again being entirely offline by the time i'm older
- fc417fc802 6mo ago
  > my feed of hackernews is going to be my AI agent giving it to me in plain text very soon Wait for the advent of local agents running on local models (for privacy) followed by techniques to fingerprint agents, followed by techniques to infer query parameters based on agent behavior. I wish I was joking but it seems all too plausible.
bryan_w 6mo ago
Just use Tor browser? You can turn the tor part off if you need the speed. What you want exists, have at it
- BeetleB 6mo ago
  As the submission shows, Tor browser isn't enough. My hypothetical browser would never have an IndexedDB API. Why should it? "Web applications use it for offline support, caching, session state, and other local storage needs" This use case is completely orthogonal to what my browser is meant to do. My browser would not have a concept of local storage. The premise of starting with a modern browser and stripping away features to get privacy is flawed - it's always vulnerable to these types of things. I'm going the opposite route: Only add features if they cannot be exploited for monitoring.
BeetleB 6mo ago
I can't edit, but I forgot to add: No support for forms. The browser is meant for content consumption. Not for interaction/creation. One could argue that any JS capabilities to do network requests (including dynamically rendering content) would be disallowed. Yes, I know, this is going pre-Web 2.0. Yes, of course, most current sites won't work in that model. But I'll also say: Most current content sites don't need these capabilities. They have them because they know the browser supports them. Again - a fantasy. I know only a few people will use it. I know that won't be enough to change web behavior. It would be nice, though, if sites carried a badge to indicate they conform to all of the above.

by BeetleB 6mo ago

0x62 6mo ago

Unfortunately you've now made an incredibly niche browser, and the lack of those metrics is a good fingerprint by itself. How browsers render SVGs can be used for fingerprinting (even the underlying OS affects this, and I assume you'll want to see those), combine with ISP from IP address, and unless theres hundreds users in every city you're now pretty easily trackable.

BeetleB 6mo ago
> Unfortunately you've now made an incredibly niche browser, and the lack of those metrics is a good fingerprint by itself. If 100 people are using that browser, how will they know which one is me? > How browsers render SVGs can be used for fingerprinting (even the underlying OS affects this, and I assume you'll want to see those) Can you provide details on this? And how will they know which OS I'm using (through SVG rendering...)? The UserAgent definitely should not send the OS. > combine with ISP from IP address That's already provided whether I use Private mode or not, correct? I can always use a VPN.
- pbhjpbhj 6mo ago
  You're the only one out of 100 that visits HN, or who's use matches a particular timezone, or who has the use pattern that [anti-]correlates with your work pattern, or ...
  - BeetleB 6mo ago
    My brain is a bit slow today: > You're the only one out of 100 that visits HN So the HN operator sees someone using this browser, with this timezone. Then I go to some other site. Let's pretend that site's operator and HN's are identical. How will they know that I'm the same guy who went to HN? How does he know there aren't two people who use the browser in the same timezone (and the other one doesn't go to HN)?
    - Atreiden 6mo ago
      I think the point is that it takes very few data points to effectively deanonymize someone. And the less common a data point is, the greater the information gain. "User is male" eliminates ~half of users. "User actively reads HackerNews" eliminates >99%. "User uses this niche browser that only 1000 people have ever been seen using" eliminates 99.999%. This is how surveillance operates at scale. You don't need a stable identifier linking a specific person's identity, you just need a few data points to narrow it down to even a few thousand people. Then you apply more focus on those people, gathering data points that eliminate people until you're left with your target. And thanks to decades of global iteration on surveillance infrastructure, and AI to glue data sets together, it's all automated.

93po 6mo ago

i've had the same thought for 20 years and unfortunately it's less likely than ever to happen now, given how many sites require javascript and have cloudflare pages before even loading a site (I get several a day). thankfully i think traditional web surfing is probably going to die out in the next 10 years, and progressively decline a lot much sooner than that as people start to interact with AI rather than browsers (or any software for that matter). my feed of hackernews is going to be my AI agent giving it to me in plain text very soon, and soon after that i will probably never visit the internet again because it will be impossible to know what's real and fake as a millennial it will be interesting to experience the full cycle of being born when nothing was online, to everything being online, to then again being entirely offline by the time i'm older

fc417fc802 6mo ago
> my feed of hackernews is going to be my AI agent giving it to me in plain text very soon Wait for the advent of local agents running on local models (for privacy) followed by techniques to fingerprint agents, followed by techniques to infer query parameters based on agent behavior. I wish I was joking but it seems all too plausible.

bryan_w 6mo ago

Just use Tor browser? You can turn the tor part off if you need the speed. What you want exists, have at it

BeetleB 6mo ago
As the submission shows, Tor browser isn't enough. My hypothetical browser would never have an IndexedDB API. Why should it? "Web applications use it for offline support, caching, session state, and other local storage needs" This use case is completely orthogonal to what my browser is meant to do. My browser would not have a concept of local storage. The premise of starting with a modern browser and stripping away features to get privacy is flawed - it's always vulnerable to these types of things. I'm going the opposite route: Only add features if they cannot be exploited for monitoring.

BeetleB 6mo ago

I can't edit, but I forgot to add: No support for forms. The browser is meant for content consumption. Not for interaction/creation. One could argue that any JS capabilities to do network requests (including dynamically rendering content) would be disallowed. Yes, I know, this is going pre-Web 2.0. Yes, of course, most current sites won't work in that model. But I'll also say: Most current content sites don't need these capabilities. They have them because they know the browser supports them. Again - a fantasy. I know only a few people will use it. I know that won't be enough to change web behavior. It would be nice, though, if sites carried a badge to indicate they conform to all of the above.