8 ms·

I did mention that "complete" privacy is rather costly, but I think it's silly to Ignore low cost countermeasures that have a high impact. Hell you can even def

I did mention that "complete" privacy is rather costly, but I think it's silly to Ignore low cost countermeasures that have a high impact. Hell you can even defend against fingerprinting, which is basically a medium cost very high impact fix. https://panopticlick.eff.org/self-defense.php https://panopticlick.eff.org/self-defense.php I also disagree that the stated countermeasures don't have much of an impact. The universe of entities that get any sort of picture of your behavior narrows VERY sharply, and the remaining holdouts (the govt, those who control the pipes) quite obviously require policy solutions

dredmorbius 11y ago
Agreement and disagreement. Yes, countermeasures can be taken. I apply a number of defenses myself: ⚫ Multiple browser plugins: adblock, noscript/scriptsafe, ghostery, privacy badger, uMatrix. They work, variously, but also make browsing more of a pain. Applying these to, e.g., my parents' systems leads to inevitable (and difficult to diagnose remotely) issues. The median state of technical user competence is very low. ⚫ Privoxy. Though not on my primary browsing sessions as it's routed through... ⚫ Tor. If you want to destroy your browsing experience, route all traffic through Tor. Some sites flat out fail to function (e.g., Craigslist), generally because they block all traffic from proxies. Others repeatedly throw up captchas, including several (Cloudflare comes to mind) who rely on JS entirely, and cannot be bypassed for non-JS browsers. Also: pretty much all commandline tools (curl, wget, youtube-dl) are difficult or impossible over Tor, and you'll have to disable proxy for them. In other cases, Tor is seen as "suspicous activity" and triggers account protection, a/k/a self-triggered denial of service: https://www.reddit.com/r/dredmorbius/comments/2w618r/how_to_kill_your_google_account_access_it_via_tor/ https://www.reddit.com/r/dredmorbius/comments/2w618r/how_to_... (also discussed on HN). (Some way to be able to toggle multiple (or no) Privoxy modes easily would be useful.) ⚫ An extensive set of /etc/hosts blocks. Drawn from uMatrix's blocklists, plus additions of my own. It's a total of 62,290 entries, including most common (and many uncommon) tracking and advertising sites. Plus other practices in real-world tradecraft. It's still 1) tedious and 2) only modestly effective. Email, mobile comms use, and messaging generally remain far less protected than I'd prefer.

dredmorbius 11y ago

Agreement and disagreement. Yes, countermeasures can be taken. I apply a number of defenses myself: ⚫ Multiple browser plugins: adblock, noscript/scriptsafe, ghostery, privacy badger, uMatrix. They work, variously, but also make browsing more of a pain. Applying these to, e.g., my parents' systems leads to inevitable (and difficult to diagnose remotely) issues. The median state of technical user competence is very low. ⚫ Privoxy. Though not on my primary browsing sessions as it's routed through... ⚫ Tor. If you want to destroy your browsing experience, route all traffic through Tor. Some sites flat out fail to function (e.g., Craigslist), generally because they block all traffic from proxies. Others repeatedly throw up captchas, including several (Cloudflare comes to mind) who rely on JS entirely, and cannot be bypassed for non-JS browsers. Also: pretty much all commandline tools (curl, wget, youtube-dl) are difficult or impossible over Tor, and you'll have to disable proxy for them. In other cases, Tor is seen as "suspicous activity" and triggers account protection, a/k/a self-triggered denial of service: https://www.reddit.com/r/dredmorbius/comments/2w618r/how_to_kill_your_google_account_access_it_via_tor/ https://www.reddit.com/r/dredmorbius/comments/2w618r/how_to_... (also discussed on HN). (Some way to be able to toggle multiple (or no) Privoxy modes easily would be useful.) ⚫ An extensive set of /etc/hosts blocks. Drawn from uMatrix's blocklists, plus additions of my own. It's a total of 62,290 entries, including most common (and many uncommon) tracking and advertising sites. Plus other practices in real-world tradecraft. It's still 1) tedious and 2) only modestly effective. Email, mobile comms use, and messaging generally remain far less protected than I'd prefer.