Hacker News Reader

Comment by hku333 | Hacker News Reader

You are actually easier to track using these addons.

By installing Canvasblocker, Decentraleyes and NoScript you are providing more entropy to trackers and thus making it easier to track you. Imagine how many people worldwide block specifically Canvas, have weird looking network requests to certain js libs and have JS disabled for some (/all) scripts combined with your general setup (window size, font size, and many other factors that do not even require JS).

The Tor project explicitly suggests to not install an adblocker for example because of this.

View on HN

I more or less use those addons (uMatrix instead of NoScript) plus uBlock Origin. uMatrix doesn't load a large number of JS files. An example from an ecommerce site I'm browsing right now: the site is functional (at least in browsing mode) without the scripts from

    bigcommerce.com
    classyschema.org
    doofinder.com
    elfsightcdn.com
    google.com
    grit.software
    gstatic.com
    hexgator.com
    klarna.com
    skeepers.io
    criteo.com
    googletagmanager.com

It needs only the JS from the first party domain. So they can track me from there but all the other guys don't know about me, unless they buy data from the first party. At least they have to do more work.

I also don't get advertising in any form, maybe because I don't have ecommerce apps on my phone and I block a lot of things with Blockada, but that's another story.

I don’t really mind first party telemetry. I’m already interacting with the sites, so they can build a nice profile if they want too. But my pet peeves are loads of non functional JS and not having an html render for web content for a non app website.

> (window size, font size, and many other factors that do not even require JS

Yeah, they require CSS, which you can also block using noscript and other tools, if you want.

Also, while you might be more "trackable" to those who fingerprint, if you are blocking those cross origin or same origin scripts from loading you are already stopping some of that. You can even blacklist some known hosts completely in your browser's policy settings and prevent those requests from ever reaching their destination.

Without an ad blocker and JavaScript blocker the average website would be 100GB in size and take several years to load. If I really cared about tracking protection I would just not use the regular internet and stick to Gemini. CanvasBlocker is just because the Tor browser itself has one implemented (source: <https://2019.www.torproject.org/projects/torbrowser/design/#...>) so I figured I might as well.

There has to be a happy middle between "no protection" and "complete uniqueness"

The web without ad blocking is revolting. Browsers building in these features makes them more popular.

Aside: Fuck the Washington Post. They have a line in their privacy policy that acknowledges the existence of "Do Not Track" flags in browsers. Their acknowledgement: since there is no industry standard for responding to it, they ignore it.

wow lmao

> Do Not Track. Some web browsers may transmit a “do-not-track” signal. Because there currently is no industry standard concerning how to treat such signals, the Services currently do not take action in response to do not track signals. We respond to legally recognized browser-based opt out signals such as the Global Privacy Control signal for California residents.

https://www.washingtonpost.com/privacy-policy/

Read: we ignore it because it's not legally enforced

The actual industry standard for Do Not Track is to ignore it. It is deprecated. The browser we are talking about in this post, Firefox, removed support for Do Not Track in February of this year.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...

To my credit, WaPo should have said that instead of saying there isn't a standard. The standard is gone.

I was a bit glib with my answer, but I don’t think what they said is wrong. Just because something is a written standard doesn’t mean it is an observed standard. WaPo was clearly referring to the lack of an observed standard. I don’t think they were denying the existence of API specifications, nor do I think that’s a reasonable interpretation. They’re saying that nobody treated it the same way, which is true, and it’s also the reason why it was deprecated in the first place.

Reply on news.ycombinator.com