Hacker News Reader

Comment by kodablah | Hacker News Reader

I think I have a better solution. How about keeping HTML/JS and lose the bidirectional protocols used to track you.

As a side project I am starting to work on a non-HTTP browser (and non-websocket, non-webrtc, etc). The first "protocol" will be IPFS. Download all of the HTML/JS/images and store all the cookies/localStorage you want, you can't send the information back to any server. Heck, you can't even know you have a page view. Now to make it more powerful, I will offer a JS API to pages that let's them use the mutation features of IPFS, but it is strictly opt-in and the permissions are very narrow and clear to the user (think specific oauth scopes).

View on HN

> I think I have a better solution. How about keeping HTML/JS and lose the bidirectional protocols used to track you.

Is it that common for trackers to have Websocket/WebRTC as a requirement? Pretty much any trackers I see in the wild is using regular Ajax calls. And if you're a tracking service, it's not exactly hard to fallback to Ajax if Websockets aren't available...

EDIT: My mistake, I misread the first mention of HTTP as HTML.

I also consider HTTP a bidirectional protocol used to track you.

You can be tracked without bidirectional calls, without JS, even without images or cookies. See the Panopticlick.

> You can be tracked without bidirectional calls

No, you can be fingerprinted and what not, but being tracked requires you send the data somewhere.

You can be tracked from page to page using your fingerprint, optionally with server-side checking of referrers and URL parameters.

> You can be tracked from page to page using your fingerprint

That's not really tracking per se any more than any local stateful data is.

> optionally with server-side checking of referrers and URL parameters

Again, no, this requires sending data to the server (in the URL or as HTTP headers in this case) which is exactly what I am saying would NOT happen in my project.

Saying that fingerprinting is not tracking "per se" is like saying that a series of pictures taken at evenly spaced sub-second intervals is not a movie "per se".

How do you request data from a server without making any contact with the server? The initial page request is sending data to the server. That is unavoidable.

A web browser sends (or doesn't send) lots of HTTP headers all the time. The particular headers sent (User-Agent, Referer[sic], Accept, etc.) or not sent are additional data that can be used to fingerprint, and thus track you (not to mention your request IP address).

> How do you request data from a server without making any contact with the server?

I specifically mentioned IPFS

> The initial page request is sending data to the server. That is unavoidable.

Wrong. I specifically mentioned IPFS and would introduce storj, sia, maidsafe, etc as deemed worthy.

> A web browser sends (or doesn't send) lots of HTTP headers all the time.

Not the one I'm talking about. HTTP isn't even in the picture. Please please read my post that mentions non-HTTP.

I was thinking, IPFS + Gopher or a Gopher-like system. But lose the damn JS, use Lua or something if so desired, and lose the JS web compatibility requirement. Allow public key encryption and signing on a per-document basis.

got a mailing list or something we can subscribe to in order to stay updated on your project? it's extremely important.

I did some early work[0] but the project hasn't started in earnest (a big issue w/ electron and web views in separate partitions was just fixed). I made a POC for maidsafe also [1]

0 - https://github.com/cretz/shrewd 1 - https://github.com/cretz/safe-poc-browser

Reply on news.ycombinator.com