Hacker News Reader

Comment by Macha | Hacker News Reader

If Mozilla's browser supports a way for advertisers to track me, be it for attribution, fraud prevention, targeting or any other person, then what is the point in using it over ungoogled-chromium? Mozilla's reputation in my view has sure taken a beating these last few years, and without the details of the proposal (thanks to their own fuckup), it's hard not to assume the worst.

View on HN

If there is no way to disable this 'feature', I will stop using Firefox entirely.

And, as with DNT, by disabling it you'll just add another feature for identifying you.

1 bit seems pretty preferable to something which people will pretty quickly find a way to turn into a user ID

Maybe - it depends on how much that bit is weighted.

I thought it was the other way around. As it was generally disabled by default, enabling it gave another data point for fingerprinting. But maybe I don't recall correctly.

Either way it works. It's just a feature. What the big issue was was that some browsers would enable it by default and some wouldn't, and then you'd have differences across versions, etc. So it became a more powerful feature.

There was a discussion in PATCG Wednesday about precisely this topic.

Briefly, it should be possible to "disable" this feature by instead encrypting a random match key, which would look the same as having it enabled but merely not be useful for measurement. Obviously, one would need to work through the details of how to make this work in a complete protocol, so this is a little handwavy, but it's definitely a consideration.

That's good to hear - that was such a silly flaw in DNT, along with the entire concept being idiotic.

I don't see any other way to do DNT without creating an extra facet of identifying information. It's entire point is to convey that information. Contrast with say "allow notifications" which lots of privacy advice says to leave to "ask" otherwise you needlessly add an identifying facet. That preference should be invisible to the sandboxed program, with unwanted notifications just going to /dev/null.

Also DNT is not useless modulo new human rights legislation like the GDPR. I would hope that data protection regulators settle on seeing DNT as an explicit sign of non-consent, and punish websites who try to fraudulently obtain consent with annoying popups etc.

What does ungoogled-chrome do to prevent advertiser tracking? I think you’re confusing the unbundling of Google services with general tracking on the web, which this proposal aims to replace.

Unless using an ad blocker your browser is not doing anything to actively prevent it, and there is no meaningful difference between chrome / Firefox / edge there.

The security (specifically sandboxing) hardening of ungoogled-chromium is also substantially beyond firefox's.

Ungoogled Chromium is my daily driver.

Have you found a replacement for profile-sync, assuming you ever found such a thing useful? It's what keeps me on google-chrome vs chromium atm.

I don't sync anything browser related between my devices, sadly. This isn't as much of an issue with the current travel landscape, but I've a new m1max and the last omicron wave seems to be starting to recede globally, so I'm going to have to find a solution.

I might just manually copy the profile directory to my laptop when I leave, and copy the newer one back to my desktop when I get home. Mutex! TBH I can really only be using one browser at a given time so "sync" seems like overkill as long as I've only two hands and two eyeballs.

As a Firefox user, under what circumstances would that make a difference though? How often do Firefox users get exploited by malware or whatever that Chrome users would be protected from due to improved security? Can you give an example? Genuine questions.

It's changing rapidly. Until recently, Firefox did have a sandbox, but lots of different origins lived together in the same sandbox. Which made it much less useful for many types of attacks. Since Fission (shipping now-ish?), each origin lives in its own sandboxed process—same as Chrome—so on the surface there's no longer any difference.

That said, sandboxes aren't all or nothing, and my impression is that the chromium sandbox is still tighter than Firefox's. (I work for Mozilla, but not on sandboxing, and I'm not in touch with the current state.) That is improving over time, and Firefox already has some types of sandboxing that are ahead of Chrome's.

The main threat model here is malware, probably malware being served to you through an ad network. Run an ad blocker.

Personally, I defend the principle of an ad-funded Web. But not the current practice. As long as ads are in practice an exploit vector, screw 'em.

Reply on news.ycombinator.com