5 ms·

> Plus privacy.resistfingerprinting isn't enabled even when selecting "Strict" "Enhanced Privacy Protection" in the settings, great job there Mozilla. For good

> Plus privacy.resistfingerprinting isn't enabled even when selecting "Strict" "Enhanced Privacy Protection" in the settings, great job there Mozilla. For good reason. I've run that setting for ages but I kept having to disable it and add workarounds because websites would break in weird ways. Timezones in scheduling websites being messed up nearly made me miss a couple of appointments. There's no way to tell the user Firefox isn't broken without displaying a permanent banner like "if websites are broken in any way or you see weird glitches or your computer's time is wrong or fonts look weird or videos don't always work right, click here to disable fingerprinting protection". Interestingly, Turnstile breaks with resistfingerprinting but works with fingerprintingProtection, I guess the latter takes this crap into account.

croes 5mo ago
Maybe a good reason for not enabling it by default but a bad reason to not enabling it for strict settings. I somewhat expect breaking sites with strict settings, I don’t expect an still wide open tracking path. That’s deceiving.
- jeroenhd 5mo ago
  Even with resistFingerprinting, websites will be able to fingerprint you. There is no full immunity against fingerprinting. Websites already break often with the strictest protections enabled, adding a "super duper strict protections" mode will just lead to bug reports. Even more-than-bare-basic tracking prevention has HN threads full of comments like "doesn't work on <Firefox fork>" because they don't see the connection between fingerprinting protection, WebRTC/WebGL/WebGPU, and websites not working. People who are willing to take that bet can enable it in about:config.
  - croes 5mo ago
    > Websites already break often with the strictest protections enabled, adding a "super duper strict protections" mode will just lead to bug reports. That’s what I‘m saying. They already break because of other effects of the strict settings, so what is the benefit of leaving resistFingerprinting turn off? > There is no full immunity against fingerprinting. There is 0 immunity if you don’t even try. Strict means, do what you can, not do somethings strict other not so strict and others ignore completely. Don’t call it strict if it isn’t strict
    - jeroenhd 5mo ago
      The description in Firefox state: > Stronger protections that block more trackers, but may cause some sites to break. That seems very reasonable to me. Anyone who wants more than that can turn on resistFingerprinting and live with the consequences.
      - croes 5mo ago
        > Stronger protections that block more trackers, but may cause some sites to break. People already expect sites to break, so why holding back?
        tomrittervg 5mo ago
        (n.b. I own these features in Firefox) There are three levels of protection: - ETP Standard (see [0] for the latest improvements we rolled out) - ETP Strict (we're working on things in Bugs 2036879 specifically this issue, 2037260, and more generally 2036786) - Resist Fingerprinting (RFP) These levels are something akin to "Wash your hands after using the subway", "Wear a mask on the subway", and "Wear a level B hazmat suit on the subway". "people already expect sites to break, so why holding back?" - because the breakage is so severe, and people _don't_ associate that breakage with the setting they made. There are bug reports all over the internet proving it, here are some examples [01-4]. The protections we deploy in ETP Standard and Strict are calibrated to provide as much protections as possible while keeping the internet usable, and we're working fulltime on improving them. [0] https://www.firefox.com/en-US/firefox/151.0/releasenotes/#note-791716 https://www.firefox.com/en-US/firefox/151.0/releasenotes/#no... [1] https://old.reddit.com/r/firefox/comments/fy6l1z/youtube_borked_with_new_firefox/ https://old.reddit.com/r/firefox/comments/fy6l1z/youtube_bor... [2] https://necromuralist.github.io/posts/mozilla-madness-resist-fingerprinting/ https://necromuralist.github.io/posts/mozilla-madness-resist... [3] https://support.mozilla.org/en-US/questions/1212634 https://support.mozilla.org/en-US/questions/1212634 [4] https://support.mozilla.org/en-US/questions/1322787 https://support.mozilla.org/en-US/questions/1322787
        sterlind 5mo ago
drnick1 5mo ago
> Timezones in scheduling websites being messed up nearly made me miss a couple of appointments. The reason for spoofing the time zone (to UTC) is that it is one of the many things used to fingerprint users. There is an unintended side effect however: a mismatch with the IP geolocation could out you as a VPN user even if no VPN is actually used.
- jeroenhd 5mo ago
  Of course, but the impact on many web stuff was one of the reasons I didn't turn the option on as part of my standard Firefox setup anymore.
- miki123211 5mo ago
  It's quite incredible how much you can learn about a person just by knowing their user agent, country of origin and list of preferred languages. When Youtube still supported trends, visiting the trends page from Poland with Safari set to English gave you really interesting results. Mostly intellectually-stimulating content from channels like Veritasium, with a smattering of reviews, trailers, music and focus soundtracks thrown in. Meanwhile, visiting that same page on (Windows) Chrome set to Polish gave you the typical "you won't believe what this man just did!!!" crap.

croes 5mo ago

Maybe a good reason for not enabling it by default but a bad reason to not enabling it for strict settings. I somewhat expect breaking sites with strict settings, I don’t expect an still wide open tracking path. That’s deceiving.

jeroenhd 5mo ago
Even with resistFingerprinting, websites will be able to fingerprint you. There is no full immunity against fingerprinting. Websites already break often with the strictest protections enabled, adding a "super duper strict protections" mode will just lead to bug reports. Even more-than-bare-basic tracking prevention has HN threads full of comments like "doesn't work on <Firefox fork>" because they don't see the connection between fingerprinting protection, WebRTC/WebGL/WebGPU, and websites not working. People who are willing to take that bet can enable it in about:config.
- croes 5mo ago
  > Websites already break often with the strictest protections enabled, adding a "super duper strict protections" mode will just lead to bug reports. That’s what I‘m saying. They already break because of other effects of the strict settings, so what is the benefit of leaving resistFingerprinting turn off? > There is no full immunity against fingerprinting. There is 0 immunity if you don’t even try. Strict means, do what you can, not do somethings strict other not so strict and others ignore completely. Don’t call it strict if it isn’t strict
  - jeroenhd 5mo ago
    The description in Firefox state: > Stronger protections that block more trackers, but may cause some sites to break. That seems very reasonable to me. Anyone who wants more than that can turn on resistFingerprinting and live with the consequences.
    - croes 5mo ago
      > Stronger protections that block more trackers, but may cause some sites to break. People already expect sites to break, so why holding back?
      - tomrittervg 5mo ago
        (n.b. I own these features in Firefox) There are three levels of protection: - ETP Standard (see [0] for the latest improvements we rolled out) - ETP Strict (we're working on things in Bugs 2036879 specifically this issue, 2037260, and more generally 2036786) - Resist Fingerprinting (RFP) These levels are something akin to "Wash your hands after using the subway", "Wear a mask on the subway", and "Wear a level B hazmat suit on the subway". "people already expect sites to break, so why holding back?" - because the breakage is so severe, and people _don't_ associate that breakage with the setting they made. There are bug reports all over the internet proving it, here are some examples [01-4]. The protections we deploy in ETP Standard and Strict are calibrated to provide as much protections as possible while keeping the internet usable, and we're working fulltime on improving them. [0] https://www.firefox.com/en-US/firefox/151.0/releasenotes/#note-791716 https://www.firefox.com/en-US/firefox/151.0/releasenotes/#no... [1] https://old.reddit.com/r/firefox/comments/fy6l1z/youtube_borked_with_new_firefox/ https://old.reddit.com/r/firefox/comments/fy6l1z/youtube_bor... [2] https://necromuralist.github.io/posts/mozilla-madness-resist-fingerprinting/ https://necromuralist.github.io/posts/mozilla-madness-resist... [3] https://support.mozilla.org/en-US/questions/1212634 https://support.mozilla.org/en-US/questions/1212634 [4] https://support.mozilla.org/en-US/questions/1322787 https://support.mozilla.org/en-US/questions/1322787
        sterlind 5mo ago

drnick1 5mo ago

> Timezones in scheduling websites being messed up nearly made me miss a couple of appointments. The reason for spoofing the time zone (to UTC) is that it is one of the many things used to fingerprint users. There is an unintended side effect however: a mismatch with the IP geolocation could out you as a VPN user even if no VPN is actually used.

jeroenhd 5mo ago
Of course, but the impact on many web stuff was one of the reasons I didn't turn the option on as part of my standard Firefox setup anymore.
miki123211 5mo ago
It's quite incredible how much you can learn about a person just by knowing their user agent, country of origin and list of preferred languages. When Youtube still supported trends, visiting the trends page from Poland with Safari set to English gave you really interesting results. Mostly intellectually-stimulating content from channels like Veritasium, with a smattering of reviews, trailers, music and focus soundtracks thrown in. Meanwhile, visiting that same page on (Windows) Chrome set to Polish gave you the typical "you won't believe what this man just did!!!" crap.