Hacker News Reader

Comment by floatingatoll | Hacker News Reader

Sigh, yet another “privacy” guide that has you enable options like DNT that make you easier to fingerprint.

And it suggests you disable HTML5 EME, which has nothing to do with privacy at all. Whatever your views on DRM, that’s not a privacy concern.

This is yet another “opinionated guide to Firefox” that misleadingly uses privacy to convince people to read it.

Do not harm your friends and family’s experience by making the changes suggested in this guide.

View on HN

>And it suggests you disable HTML5 EME, which has nothing to do with privacy at all.

DRM requires proprietary software, and effective DRM requires obfuscated proprietary software. How do you know it's not harming your privacy, even accidentally?

Because the design of the open-source sandbox does not allow private data to enter it. https://hacks.mozilla.org/2014/05/reconciling-mozillas-missi...

It looks like DNT is turned on automatically if tracking protection is on, so it probably doesn't identify you any more than "a Firefox browser with tracking protection on".

I just tested. With standard settings for "Content Blocking" (under "Privacy and Security") and "Only when Firefox is set to block known trackers" selected, Firefox does not send the DNT header in regular windows. It only sends it in private windows. Therefore if you don't want to stand out, you should not enable DNT.

Indeed. If you don’t want to stand out, you should use the defaults. Anything non-default will stick out as a 1%-or-less marker. Three or more non-default might well uniquely fingerprint you.

By that reasoning, what would be best would be to identify a few items of information exposed that are commonly used for tracking but that have little or no effect on browsing, and randomly alternate them between the default value and 1 or more other (or random) values.

If the data can't be relied on to contain any specific useful information (even whether it's default or not), then it's effectively useless for tracking, and you've not just hidden yourself in the largest category for those bits of tracking data, you've effectively made them entirely useless for tracking you (which is more effective than hiding in the biggest group).

That only works if you're synchronizing those changes with your other identifiers (cookies, local storage, ip, etc.) Otherwise you're going to be "that guy" that constantly changes his values with every page load.

Just based on a random seed set when the browser loads and the domain name being loaded (that is, external resource requests get the values for the sourcing page domain, which is already tracked in browsers for security purposes). You'll get persistent per-domain values per browser run. If they can already track you definitively beyond that (bookie, session, etc), you're not hurting yourself at all by doing it, but it will possibly help with all the other cases.

IIRC you should look into the Tor Browser’s work along these lines. It includes fun things like “provide a default untraceable screen size ignoring your own”, so that web pages render at the wrong resolution for your browser window in exchange for one less effective vector. I don’t know if Firefox has it under a config option or not.

I think you're talking about letterboxing, which Mozilla stole as a good idea from Tor a while back, and is gated behind the "privacy.resistFingerprinting" config option. It was covered here at the time.[1]

1: https://news.ycombinator.com/item?id=19323032

"stole" is an unusual phrasing of "uplifted into Firefox": https://blog.torproject.org/tor-heart-firefox

I figured someone might interpret that the wrong way. In my mind it was sort of a "Imitation is the sincerest form of flattery" mixed with "Good artists copy; great artists steal." I tried to allude to this with the "as a good idea" bit, so maybe it would come across as "that's a good idea, I'm stealing it!"

To summarize and clarify, I applaud their actions wholeheartedly. :)

> it suggests you disable HTML5 EME, which has nothing to do with privacy at all.

Does the DRM really not leak data about the content you're watching to the license server?

That's my thinking as well. I've been to a few non-media sites (eg. aliexpress) that inexplicably ask to play DRM content.

Do you have a URL for a page that exhibits this behavior without obvious reason?

    https://www.aliexpress.com/item/32678087225.html

The server that is streaming you the encrypted data presumably already knows what you are watching.

Reply on news.ycombinator.com