4 ms·

> we’ve been vocal about the need for people to use privacy add-ons with their web browsers This contradicts what I have read on the Tor Project site: "Site-s

by gorhill 11y ago

> we’ve been vocal about the need for people to use privacy add-ons with their web browsers This contradicts what I have read on the Tor Project site: "Site-specific or filter-based addons such as AdBlock Plus, Request Policy, Ghostery, Priv3, and Sharemenot are to be avoided."[1] [1] https://www.torproject.org/projects/torbrowser/design/#philosophy https://www.torproject.org/projects/torbrowser/design/#philo...

striking 11y ago
Because imperfect filtering can sometimes be worse than exposing yourself. Imperfect filtering can sometimes identify its users. That and filters will never be perfect.
pstrateman 11y ago
Filter-based addons leak at a minimum 1 bit of identifying information -- that the addon is installed. With something like RequestPolicy the specific policy in place likely uniquely identifies the user. Maintaining anonymity with a modern web browser is virtually impossible. Maintaining pseudonymity substantially less so, but you're probably identified as "user running tails version x"
- alphapapa 11y ago
  But if you block JavaScript, a site can't detect whether certain third-party elements are loaded. So using RequestPolicy to also block third-party elements would then increase your anonymity, because it would prevent things like web bugs from leaking your browsing patterns outside of the first-party site. Right? Or would CSS tricks allow a first-party site to conditionally load elements and reveal your RequestPolicy policy? Sigh. :(
- MichaelGG 11y ago
  Why/how do browsers allow sites to query the list of installed addons? That seems like it should very much be opt-in behaviour, that an addon would need to explicitly inject functionality to be discovered.
  - noondip 11y ago
    It's not that the list of addons is known, but rather infered from the number and types of blocked elements.

by gorhill 11y ago

striking 11y ago

Because imperfect filtering can sometimes be worse than exposing yourself. Imperfect filtering can sometimes identify its users. That and filters will never be perfect.

pstrateman 11y ago

Filter-based addons leak at a minimum 1 bit of identifying information -- that the addon is installed. With something like RequestPolicy the specific policy in place likely uniquely identifies the user. Maintaining anonymity with a modern web browser is virtually impossible. Maintaining pseudonymity substantially less so, but you're probably identified as "user running tails version x"

alphapapa 11y ago
But if you block JavaScript, a site can't detect whether certain third-party elements are loaded. So using RequestPolicy to also block third-party elements would then increase your anonymity, because it would prevent things like web bugs from leaking your browsing patterns outside of the first-party site. Right? Or would CSS tricks allow a first-party site to conditionally load elements and reveal your RequestPolicy policy? Sigh. :(
MichaelGG 11y ago
Why/how do browsers allow sites to query the list of installed addons? That seems like it should very much be opt-in behaviour, that an addon would need to explicitly inject functionality to be discovered.
- noondip 11y ago
  It's not that the list of addons is known, but rather infered from the number and types of blocked elements.