7 ms·

A possible solution would be anonymize the browser fingerprint, at least in private mode, ie lie about the details of the system. Google, Mozilla, Opera, can y

by 001sky 14y ago

A possible solution would be anonymize the browser fingerprint, at least in private mode, ie lie about the details of the system. Google, Mozilla, Opera, can you hear me? == This. The system needs to be fixed. Need to know (only) vs nice to know info exch, etc.

deleted 14y ago
[deleted]
guessWhy 14y ago
Yes, but it takes more than removing most of the identifying information. First, the precise browser version and OS can probably always be identified by checking for supported features, bugs etc. even if the extreme measure would be taken to remove the user agent string. Add the screen resolution, IP, timing and request patterns (+) and we are all screwed. (+) e.g. rule out users that are using other sites at the same time. Note that it would be possible to determine if a page is in the currently focused and visible browser tab and forward that information to the tracker.
- sounds 14y ago
  But why make it easier for the site to track you? Force them to do detailed packet timing and their costs will go up, and it will become less economical for black hats to play around with your personal data. I don't know if nuking the user agent string is a horrible idea, but it's less of a problem today than it was 5 years ago: today, a website can assume all browsers conform pretty closely to a standard. Only really advanced features require user agent sniffing (arguably, if you're sniffing the UA you're doing it wrong). I think we should make that kind of fingerprinting opt-in, not opt-out.
  - guessWhy 14y ago
    I think changing the user agent to only report the major version would already go a long way.
- jamesbritt 14y ago
  Yes, but it takes more than removing most of the identifying information. The trick is not to remove information, but to poison it. For example, Panopticlick sees that I have dozens of "system fonts", enough to stand out. I want my browser to lie about the fonts I have, based on settings I choose. There are many details about my browser and system that are irrelevant to what most sites need to do so lying about them should not interfere with viewing a site.
  - mrgreenfur 14y ago
    This is a great point. I totally agree, if you adjust simple things on each visit, then you can use their extra bits of identification against them, in a very obscure way, without limiting the actual checks of functionality that the sites use.
  - luchs 14y ago
    These system fonts are detected through Flash/Java. Disabling these will fix this.
    - jamesbritt 14y ago
      I don't want to provide less, but still accurate, data, I want to introduce suspect data. The end result should be that anyone collecting data on me without my consent should have no idea which of it are accurate such that all of it becomes useless.
jval 14y ago
> The system needs to be fixed. This is another problem with having an advertising company (Google) supply a browser that is very popular (Chrome). In fact, Safari and IE are also run by companies with large presences in the online ad market. I doubt Google in particular will risk antitrust suits by blocking these kinds of very, very unsettling but unfortunately legal trackers, which in part are not so technologically different to GA but combine a few more bits of tech which makes them awfully invasive. We might be able to hack technological solutions together here but this stuff rarely makes it out into people's mainstream browsers. The most important way of securing people's data over the next 10 years is going to be by way of the browser and the mobile OS, but the thing that is most easily achievable is to have a solid browser that people can trust on to implement privacy-preserving technologies. The only browser I can realistically see doing that is Firefox.
- 18pfsmt 14y ago
  I see both your points (browser vendors and extension distribution issues), and I think Mozilla has shown great respect for their users. However, Mozilla's primary revenue source is Google. Maybe taking a page out of the enterprise play book and using a proxy, like Squid, would make sense. From reading the Squid manual, it seems like it could play a role as it is quite extensible and sophisticated. Making it easy to setup and customize would be pretty difficult from what I can tell, unfortunately.

by 001sky 14y ago

deleted 14y ago

[deleted]

guessWhy 14y ago

Yes, but it takes more than removing most of the identifying information. First, the precise browser version and OS can probably always be identified by checking for supported features, bugs etc. even if the extreme measure would be taken to remove the user agent string. Add the screen resolution, IP, timing and request patterns (+) and we are all screwed. (+) e.g. rule out users that are using other sites at the same time. Note that it would be possible to determine if a page is in the currently focused and visible browser tab and forward that information to the tracker.

sounds 14y ago
But why make it easier for the site to track you? Force them to do detailed packet timing and their costs will go up, and it will become less economical for black hats to play around with your personal data. I don't know if nuking the user agent string is a horrible idea, but it's less of a problem today than it was 5 years ago: today, a website can assume all browsers conform pretty closely to a standard. Only really advanced features require user agent sniffing (arguably, if you're sniffing the UA you're doing it wrong). I think we should make that kind of fingerprinting opt-in, not opt-out.
- guessWhy 14y ago
  I think changing the user agent to only report the major version would already go a long way.
jamesbritt 14y ago
Yes, but it takes more than removing most of the identifying information. The trick is not to remove information, but to poison it. For example, Panopticlick sees that I have dozens of "system fonts", enough to stand out. I want my browser to lie about the fonts I have, based on settings I choose. There are many details about my browser and system that are irrelevant to what most sites need to do so lying about them should not interfere with viewing a site.
- mrgreenfur 14y ago
  This is a great point. I totally agree, if you adjust simple things on each visit, then you can use their extra bits of identification against them, in a very obscure way, without limiting the actual checks of functionality that the sites use.
- luchs 14y ago
  These system fonts are detected through Flash/Java. Disabling these will fix this.
  - jamesbritt 14y ago
    I don't want to provide less, but still accurate, data, I want to introduce suspect data. The end result should be that anyone collecting data on me without my consent should have no idea which of it are accurate such that all of it becomes useless.

jval 14y ago

> The system needs to be fixed. This is another problem with having an advertising company (Google) supply a browser that is very popular (Chrome). In fact, Safari and IE are also run by companies with large presences in the online ad market. I doubt Google in particular will risk antitrust suits by blocking these kinds of very, very unsettling but unfortunately legal trackers, which in part are not so technologically different to GA but combine a few more bits of tech which makes them awfully invasive. We might be able to hack technological solutions together here but this stuff rarely makes it out into people's mainstream browsers. The most important way of securing people's data over the next 10 years is going to be by way of the browser and the mobile OS, but the thing that is most easily achievable is to have a solid browser that people can trust on to implement privacy-preserving technologies. The only browser I can realistically see doing that is Firefox.

18pfsmt 14y ago
I see both your points (browser vendors and extension distribution issues), and I think Mozilla has shown great respect for their users. However, Mozilla's primary revenue source is Google. Maybe taking a page out of the enterprise play book and using a proxy, like Squid, would make sense. From reading the Squid manual, it seems like it could play a role as it is quite extensible and sophisticated. Making it easy to setup and customize would be pretty difficult from what I can tell, unfortunately.