Hacker News Reader

Comment by ______- | Hacker News Reader

> FLoC is premised on a compelling idea: enable ad targeting without exposing users to risk

The second you open your browser you are exposed to risk. Many times I have had to tweak the default settings of my browser to comply with my (non paranoid) requirements. Basic things like putting DuckDuckGo as the default search engine, turning off various JS APIs like HTML5 Canvas, WebGL, using AD-blockers and other addons, tweaking about:config and hardening it, etc

Call me a power user if you want, but all this hardening stuff should ship out-of-the-box.

View on HN

Opinions are my own.

I'm not sure if we're being led to focus on a wrong problem. I hate intrusive Ads as much as everyone else. However, it's not only that "when you open your browser, you are exposed to risk". It's also:

- Every time you use Windows (without turning off all the bad settings)

- Every time you connect to a Cell tower (telcos openly sell your location data)

- Every time you use your credit cards

Now, I'm not saying those are OK, or to justify intrusive Ads. However, I see a magnitude difference in the "violation of my privacy" for the above cases. The media and certain communities keep focusing on Ads tech because it drives clicks. But then we let the Telcos, Insurance, and Credit Card companies establish a creeping normality on our privacy violation.

We don't spend as much effort to stop Telco from directly selling our location data [1], but we have daily threads about companies indirectly use our location data for targeting Ads. Are we having our priority wrong? I couldn't shake the feeling that we're being led by a different narrative. The best situation of course is when we have good privacy laws and practices. However, focusing on the wrong priority like this is how we let other (much more severe) violators (Insurance, Telcos) get away with their creeping normality.

[1] https://www.marketplace.org/2020/02/28/fcc-set-to-fine-big-t...

It doesn't matter anymore. The world is literally covered in tracking technologies from satellites orbiting the earth to radiowaves that are invisible to us but are monitoring our interactions within the world.

By existing in 2021 (whether you use computers/tech or not) you need to accept your data will be collected, analyzed and sold. It will be leaked, combined/processed and abused in many different ways. I would be surprised if there was a single human on earth Facebook did not have a profile on at this point. I'd suspect the NSA can bring up the profiles of all 7 billion humans and recollect their entire lives from the digital/physical breadcrumbs they leave every day.

Now that we can collect so much data, so rapidly (at the speed of light) and can analyze it in real time and store it forever it seems every digital application is focused on obtaining that valuable information and storing it to use in some way (usually, for profit).

Even electric cars require apps and digital connectivity before they can be used/charged.

Data is the new gold.

It's trivially easy to break into my house. No measures exist that I could realistically take to prevent it with 100% certainty. Any measures I stubbornly take anyway, are done out of spite, and to somewhat minimise the risk of my home being chosen over a neighbour's.

In this data collection context, any efforts I take to hide parts of my identity and actions from these privacy rapists, I do out of obstinacy and vicious spite.

Telecoms are heavily regulated, and your link reinforces that: The FCC is able to directly fine telcos from selling our location data. Tech companies generally aren't subject to the same fines as telecoms are for doing... exactly the same things.

And while Verizon, T-Mobile, etc. all have programs that opt-in to data collection and marketing practices, it's often impossible to opt out of tech companies' behaviors. Because telecoms are required to get your opt-in consent to use your data, generally they offer incentives to join rewards programs that have the additional marketing permissions as a requirement.

For example, Verizon Up Rewards requires you enable Verizon Selects, where they can collect information about your web browsing activity and such: https://www.androidauthority.com/verizons-new-rewards-progra... Not something I'd want to participate in, but Verizon is paying it's users for that data in effect, something tech companies never do.

> Opinions are my own.

I find it impressive how well this line still singularly identifies the employer of anyone who uses it. :)

The funny thing is that customizing your browser in this way can be its own kind of fingerprint.

That's the number 1 reason it should be the default.

Not happening. All those anti-tracking measures break websites more often than not.

They break sites that are broken by design. If a site isn't usable with html and css it's the devs fault. They don't get to dictate my browser's capability or assume I don't have special accessibility needs.

"more often than not" is a vast overstatement, it breaks a tiny handful of sites at best.

That is flat wrong in my experience. I browse with javascript and CSS both disabled by default, using uMatrix. Only a minority of sites I browse require me to whitelist JS or CSS; maybe 1-in-10. Most newspapers and blogs do not require JS or CSS.

I note that uMatrix is archived, do you have a plan for when it stops working? (I'm also a user)

I fear I don't. Probably I'll end up using the web in general a lot less.

Yes but disabling JS as a default wipes out whole classes of attacks against your browser.

On top of disabling JS, just a simple AD blocker like uBlock Origin greatly diminishes the amount of profiling. There is no silver bullet however. It depends on your threat model.

If you really don't want to be tracked and profiled, using the Tor Browser Bundle is worthwhile, but even that is problematic since it's heavily surveilled (both at the entry node and exit nodes).

Realistically, can you ship a website where everything happens client side? - reflow, adjusting layout, computing locations/sizes and whatnot. I am not a web person so my thinking may be outdated on this. I'm imagining something like a stand-alone self-contained "docker" type thing.

That's how most websites work. The JavaScript code that runs on the browser then reports back to a server, because it makes money for the people who wrote the app.

Yeah, I meant without the 'reporting back to a server'. Like for e.g., the website sends a 'package' to the browser - The package is built on the fly and contains all the dependencies. The package is then unarchived and files are opened in the browser w/o the server being involved.

That is the standard static html + css + JavaScript without further requests. Aka Web 1.0. (Should you make all in one page with inline images that is)

Then how are the people who wrote the app supposed to make money by selling your personal information to advertisers?

> all this hardening stuff should ship out-of-the-box.

I mean, Brave kinda does that. It’s much more “hardened” by default.

"No, you shouldn't use Brave": https://web.archive.org/web/20210531085250/https://aspenuwu....

Disabling canvas...

Reply on news.ycombinator.com