Hacker News Reader

Comment by tmtvl | Hacker News Reader

I'm already using CanvasBlocker, Decentraleyes, and the NoScript Security Suite; but getting more protections will be nice. Even if it may take a while for them to land in Waterfox.

View on HN

You are actually easier to track using these addons.

By installing Canvasblocker, Decentraleyes and NoScript you are providing more entropy to trackers and thus making it easier to track you. Imagine how many people worldwide block specifically Canvas, have weird looking network requests to certain js libs and have JS disabled for some (/all) scripts combined with your general setup (window size, font size, and many other factors that do not even require JS).

The Tor project explicitly suggests to not install an adblocker for example because of this.

Without an ad blocker and JavaScript blocker the average website would be 100GB in size and take several years to load. If I really cared about tracking protection I would just not use the regular internet and stick to Gemini. CanvasBlocker is just because the Tor browser itself has one implemented (source: <https://2019.www.torproject.org/projects/torbrowser/design/#...>) so I figured I might as well.

There has to be a happy middle between "no protection" and "complete uniqueness"

The web without ad blocking is revolting. Browsers building in these features makes them more popular.

Aside: Fuck the Washington Post. They have a line in their privacy policy that acknowledges the existence of "Do Not Track" flags in browsers. Their acknowledgement: since there is no industry standard for responding to it, they ignore it.

wow lmao

> Do Not Track. Some web browsers may transmit a “do-not-track” signal. Because there currently is no industry standard concerning how to treat such signals, the Services currently do not take action in response to do not track signals. We respond to legally recognized browser-based opt out signals such as the Global Privacy Control signal for California residents.

https://www.washingtonpost.com/privacy-policy/

Read: we ignore it because it's not legally enforced

The actual industry standard for Do Not Track is to ignore it. It is deprecated. The browser we are talking about in this post, Firefox, removed support for Do Not Track in February of this year.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...

To my credit, WaPo should have said that instead of saying there isn't a standard. The standard is gone.

I was a bit glib with my answer, but I don’t think what they said is wrong. Just because something is a written standard doesn’t mean it is an observed standard. WaPo was clearly referring to the lack of an observed standard. I don’t think they were denying the existence of API specifications, nor do I think that’s a reasonable interpretation. They’re saying that nobody treated it the same way, which is true, and it’s also the reason why it was deprecated in the first place.

I more or less use those addons (uMatrix instead of NoScript) plus uBlock Origin. uMatrix doesn't load a large number of JS files. An example from an ecommerce site I'm browsing right now: the site is functional (at least in browsing mode) without the scripts from

    bigcommerce.com
    classyschema.org
    doofinder.com
    elfsightcdn.com
    google.com
    grit.software
    gstatic.com
    hexgator.com
    klarna.com
    skeepers.io
    criteo.com
    googletagmanager.com

It needs only the JS from the first party domain. So they can track me from there but all the other guys don't know about me, unless they buy data from the first party. At least they have to do more work.

I also don't get advertising in any form, maybe because I don't have ecommerce apps on my phone and I block a lot of things with Blockada, but that's another story.

I don’t really mind first party telemetry. I’m already interacting with the sites, so they can build a nice profile if they want too. But my pet peeves are loads of non functional JS and not having an html render for web content for a non app website.

> (window size, font size, and many other factors that do not even require JS

Yeah, they require CSS, which you can also block using noscript and other tools, if you want.

Also, while you might be more "trackable" to those who fingerprint, if you are blocking those cross origin or same origin scripts from loading you are already stopping some of that. You can even blacklist some known hosts completely in your browser's policy settings and prevent those requests from ever reaching their destination.

How is your browsing experience with that stuff? I used to go nuts with anti-tracking measures, but enough of my browsing experience kept breaking that it just didn't feel worth it.

I use LibreWolf at work, and I exempt most internal sites from aggressive anti-tracking stuff, but otherwise it works fine.

It's fine. Sometimes I get annoyed by websites which require JavaScript to show static text (apparently HTML is too difficult?) or which block me with a 'please unblock challenges.cloudflare.com to proceed' (that second one seriously pisses me off when I see it on, for example, the website of the Belgian railways), but by and large I'm fine with just saying 'if it breaks I don't need it'. But I handle my e-mail with isync, mu, and mu4e; and as far as I understand e-mail tends to be a sticking point for those who care for their digital rights. I also don't have Xitter or Facebook or any of that nonsense.

If there's one thing I don't like its the fact that NoScript doesn't integrate with Multi-Account Containers. It would be neat if instead of having to temporarily allow GitHub JavaScript and re-disable it when I'm done; I could just allow GH JS in a GitHub or Microsoft container and it only being enabled in that container.

Libraries documentation that requires javascript to load is the lowest of the bunch in my opinion.

My experience with uMatrix: most sites work right away. Others require fiddling with the matrix of media, script, xhr, frames and the third parties serving them. After a while it's easy to remember which ones must be temporary enabled and which ones don't. Sites with videos are a little more difficult. Sites with payments require care. I whitelist the minimum set of scripts that make the sites I use often work. There are usually many scripts that can be left out. If everything fails and it's a one shot site, I start Chrome.

Reply on news.ycombinator.com