Block Fingerprinting with Firefox

https://blog.mozilla.org/firefox/how-to-block-fingerprinting-with-firefox/

by rendall • 7 years ago

1292 392 7 years ago

blog.mozilla.org

OJFord• 7 years ago

You probably wouldn’t appreciate someone tracking your moves in real life. There’s no reason to accept it online.

Great to read something like this on mozilla.org.

tacosx• 7 years ago

The revolt against surveillance capitalism seems to just be starting in earnest. I think a lot of smart people are finally realizing they have wasted their considerable talents on advertising tech while pretending it was something else and are now very angry.

TaylorAlexander• 7 years ago

I’d like to believe this, but I think it will take more time.

ngokevin4• 7 years ago

Kind of funny though, the vast majority of Mozilla's money comes from the ads and tracking industry, just one step removed.

Drdrdrq2• 7 years ago

Yes, but that is just because they represent a risk for Google. Their incentives are quite different than Google's, and that is what matters.

ChrisSD4• 7 years ago

The irony is they tried diversifying their income. But people don't want their browser to ask for donations (that's nagging). They don't want their new tab page pre-populated with websites on a new install (even if their browsing overwrites them). They don't want "fun" additions to advertise TV shows (even if they're opt-in).

But they're happy to pay via google's search and tracking. Mozilla doesn't have a lot of options open to them.

TheRealPomax3• 7 years ago

And? I used to work for a defense contractor, using the military complex money to instead pay for civil projects that actually benefit normal people. You can take money that comes from "I don't like this thing", and then spend it on "this benefits everyone".

derefr2• 7 years ago

What’s wrong with using the resources of evil (freely given, oddly enough) to destroy evil?

If someone you hate offers you a billion dollars, you should take it—because in doing so you’ve made someone you hate a billion dollars poorer! It’s like stealing the money from them, with less work!

Imagine, analogously: a lottery whose proceeds go to a charity supporting statistics education.

BlueTemplar• 7 years ago

Well, we could change that. I've subscribed for a monthly donation to Mozilla after learning about that.

I've also been giving through Flattr as an alternative to ads for micro-funding on the Web - anyone knows why their plugin/extension/addon isn't listed on addons.mozilla.org anymore ? (You can still install it from their official website.) Might it be due to a conflict of interest between Google and Eyeo ?

ngold• 7 years ago

“A lot of the scripts that are run to enable tracking delay webpage load times while all these tracking scripts fire and run in the background,” said Peter Dolanjski, Firefox Product Lead.

Over at Google they are trying to sell fingerprinting as a feature.

skybrian5• 7 years ago

What do you mean? Link?

msla3• 7 years ago

Ironic, though, given their stance on opt-out-only telemetry.

dralley• 7 years ago

99% of what telemetry tracks has nothing to do with user actions. It's mostly stuff like this:

https://metrics.mozilla.com/webrender/dashboard_nvidia.html

Despegar4• 7 years ago

As always when it comes to Firefox and privacy, the question is why isn't it on by default?

stuff4ben• 7 years ago

Because it may cause some websites to break and they're aiming to provide a good user-experience for the majority of the population. If they turn this on by default without users knowing the risks of sites not working correctly, they'll unfairly blame Firefox, bad mouth it, and switch to Chrome/Edge/Safari/etc.

Despegar4• 7 years ago

That's the stated reason but it's pretty weak to me. Safari hasn't had to make similar compromises.

emptyparadise2• 7 years ago

Because they're all but funded by Google.

nicklaf• 7 years ago

Possibly to avoid the kind of cat-and-mouse dynamics that played out when MS enabled Do Not Track by default in IE10: https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer...

tty2300• 7 years ago

Because it causes every website to non stop nag you with captchas and half of websites to change time zones to something not useful for you.

a_imho3• 7 years ago

We can only wonder.

Individuals’ security and privacy on the Internet are fundamental and must not be treated as optional.[1]

[1]https://www.mozilla.org/en-US/about/manifesto/details/

emptyparadise2• 7 years ago

Google Recaptcha becomes absolutely unbearable once you use this and also block Google cookies on non-Google sites.

Given all that, features like this will not make their way to Chrome.

lcao• 7 years ago

Yes, the same browser that sent the raw browsing history of a portion of users to a third party. Talk about tracking!

Users who receive a version of Firefox with Cliqz will have their browsing activity sent to Cliqz servers, including the URLs of pages they visit.

https://blog.mozilla.org/press-uk/2017/10/06/testing-cliqz-i...

jszymborski• 7 years ago

Damned if you disclose your responsible stewardship of user data, damned if you don't.

Less than one percent of users in Germany installing Firefox from our main download page will receive a version of Firefox with Cliqz recommendations enabled out of the box.
Cliqz does not build browsing profiles for individual users and discards the user’s IP address once the data is collected.
One of Mozilla’s core privacy principles is No Surprises: we will use and share data in ways that are transparent and benefit our users. That is why we are telling you about this today. We
We hope that users will appreciate the improved experience, but if users want to turn it off, they can always disable data collection or remove the Cliqz add-on entirely.

jimmaswell• 7 years ago

It was done to less than 1% of users so it's okay? Obviously Chrome is worse but this still sounds bad to me.

sdoering5• 7 years ago

Sorry. If I want my data somewhere else I can stay with Chrome.

I switched years ago because of performance reasons. Whenever I tried to switch back I felt stabbed in the back shortly thereafter by Mozilla.

jodrellblank• 7 years ago

https://www.reddit.com/r/firefox/comments/74vt08/psa_huber_b...

"PSA: Huber Burda Media, the majority owner of Cliqz, which owns many media and digital brands, owns the computer magazine "Chip", its online platform offers "secure installers" which are used to distribute malware (adware)."

and

"One interesting thing I've found on the Cliqz about page, is that they call themselves a "small startup". This is a lie since they're a sub division of Burda Media which is one of the biggest media companies in Europe. How can you trust a company if they even lie on their about page?"

and the Booking.com snippet https://www.reddit.com/r/firefox/comments/abfdym/mozilla_on_...

"I skimmed the source code of the Cliqz extension back during the scandal and as far as I could tell it sent back enough information for it to be possible to identify and create profiles for quite many of the users. Now it is perfectly possible that Cliqz were honest and handled the sensitive data carefully (e.g. by throwing away IPs), but we have no way of knowing that."

Remember 2006 when AOL search data was deliberately anonymized and made public, and then de-anonymized? https://en.wikipedia.org/wiki/AOL_search_data_leak

Even if Cliqz do "throw away IPs" that's not enough for it to no longer be personally identifying. It says nothing about Cliqz throwing away the data. How long before Cliqz realizes they're sitting on a trove of "valuable" data and changes their policy so they do retrospectively build profiles of users, or sell out to Facebook?

That's not responsible stewardship of data, and disclosing it on a blog page nobody read, just saying "it might happen to you, quietly and opt-out" is not responsible disclosure.

jammygit• 7 years ago

Cliqz has an interesting privacy stance, and a decent privacy policy. I don’t know if they are trustworthy or not, but I think the bad press against them has been unfair.

Excerpt: To gain your trust we have open-sourced all of our front-end code (and hence everything that sends something from your computer). We know very few people will ever look into the code, but: you or everyone else could every time check that we’re honest. And hence we cannot hide anything.

Excerpt: History and bookmarks are always processed only locally and never sent to us

Excerpt No IP addresses collected

https://cliqz.com/en/privacy-browser

gowld• 7 years ago

Cliqz is an opt in feature for users who want it

sdoering5• 7 years ago

Or Pocket. Or hyperlink auditing. Or this f... up with certificates lately.

I could go on.

My problem is that every time I wanted to return to ff, Mozilla f...ed Up again.

I feel like I am between a rock and a hard place with ff and Chrome.

zwkrt• 7 years ago

The choice is so easy. Mozilla's main problem is manufactured outrage over some risky/mediocre product management, some bugs (never shipped a bug before?). Google's main problem is trying to remake the entire internet in their image, end-to-end, from optic nerve to server silicon. I'll choose the lesser of two evils, please.

c0nducktr• 7 years ago

Who gives a shit about Pocket? Fucking hell it;s just a bookmarking program. Don't like it? You don't have to use it! It doesn't do anything at all unless you use it.

xvector3• 7 years ago

Can someone paste their results (or at least bits of fingerprinting entropy) from https://panopticlick.eff.org with the latest Firefox?

With the fancy new anti-fingerprinting Safari on macOS Mojave I get just over 14.5 bits of entropy with the most entropic source being my canvas fingerprint (1 in 600).

With Safari on iOS I get 11.71 bits of entropy, with the most entropic value being my screen size and color depth.

numakerg• 7 years ago

Panopticlick says I have "strong protection against Web tracking" but amiunique.org says I'm unique. Though amiunique also claims my TOR is fingerprint is one of six.

godelski7• 7 years ago

I get very different results from each. Some don't quite make sense to me. For example, amiunique says Timezone 3.37%. Panopticlick says 1 in 16, so half as bad. But how the hell is that timezone so identifying? I live on the west coast, how is that timezone so identifying?

gruez• 7 years ago

With the fancy new anti-fingerprinting Safari on macOS Mojave I get just over 14.5 bits of entropy with the most entropic source being my canvas fingerprint (1 in 600).

That's actually pretty good, considering tor browser (which has resistfingerprinting enabled) with default window size (1000x1000) has 14.82 bits of entropy.

mlok• 7 years ago

I have 3 more bits of identifying information than you. (block fingerprinting enabled)

Twirrim• 7 years ago

Interestingly enough, uBlock Origin actually stops that site from working, seems to break the fingerprinting step. If i disable uBlock, I get 16.63 bits of identifying information. Likewise the canvas fingerprint is the biggest, in my case 1 in 101154.

Wowfunhappy4• 7 years ago

Can anyone explain why canvas fingerprinting is so difficult to eradicate without breaking canvas?

abdullahkhalids5• 7 years ago

I have ublock origin. The website works fine. I have all the default filters on.

vbezhenar3• 7 years ago

This website works even with uBlock Origin with disabled JavaScript option. 9,81 bits for me.

user178432• 7 years ago

Firefox Fingerprinting protection has nothing to do with real fingerprinting protection, and does not afffect panopticlick results in any way.

It just bloocks a couple of known scripts based on the disconnect list.

Of course they don't tell us in their marketing posts.

danShumway3• 7 years ago

Firefox deploys two different forms of fingerprint protection:

1) blocking known fingerprinting scripts.

2) blocking underlying techniques.

The second is the one people here are talking about, and it can be enabled by going to your settings and turning on resistFingerprinting. Keep in mind it will do things like normalize your time zone and decrease timer precision.

hulahoof• 7 years ago

Resist fingerprinting will also stop sensor data (e.g. accelerometer) from being exposed on mobile, which can be used to identify[1].

You can verify if it's exposed on this site[2].

[1] https://www.zdnet.com/article/android-and-ios-devices-impact... [2] http://www.albertosarullo.com/demos/accelerometer/

abdullahkhalids5• 7 years ago

17.62 bits on firefox, 11.0 on Tor, 17.63 on chrome.

On firefox, the big contributors are HTTP headers (my native language is announced), hash of WebGl fingerprint and time zone.

On Tor big contributors are hash of webGL fingerprint, screen size.

On chrome, they are system fonts, hash of canvas fingerprint, user agent, and time zone.

I am not too concerned about the fingerprinting in firefox since I have strict blocking on, ublock origin, and separate containers for facebook and google. Based on the small amount of data facebook has on me, all the blocking is working pretty well.

herrvogel-• 7 years ago

Based on the small amount of data facebook has on me ...

How did you get all data, that facebook has on you?

Perceptes• 7 years ago

Similar results for me. Does anyone know if it's possible to turn off WebGL, and if so, how? AFAIK I never use it for anything and I'd rather have increased anonymity. (Assuming disabling it prevents it from being used for fingerprinting.)

Edit: Answering my own question. In `about:config`, change the `webgl.disabled` preference from `false` to `true`. This reduced the "bits of identifying information" from WebGL from 11.26 to 2.56.

Edit 2: Apparently the CanvasBlocker add-on is a better solution as it randomizes the data used for fingerprinting on each read, and works for several exploitable APIs, not just WebGL. https://addons.mozilla.org/en-US/firefox/addon/canvasblocker...

kevin_thibedeau4• 7 years ago

The numbers don't make much sense to me. On FF I get 14.05 with NoScript active. Curiously the headers increase from 1.68 bits to 3.47 when NoScript is running.

remus• 7 years ago

On Tor big contributors are hash of webGL fingerprint, screen size.

Doesn't tor randomise the window size on startup? Though I guess it chooses some sensible size for your screen which is then leaking info about your screen size (in a pretty indirect way).

robolange2• 7 years ago

Panopticlick's numbers are extremely confusing and borderline useless.

On my initial run, I got an overall entropy of 17.63. My two biggest identifiers were screen resolution (1000x595x24 which was approx 1/22000 browsers) and webgl hash (approx 1/3800 browsers). I fixed screen resolution to 1000x600x24 (approx 1/85 browsers) and disabled webgl hashing (approx 1/6 browsers) and the overall entropy did not change one iota, despite also closing browser, flushing cache and cookies, etc. I gave it another run with a deliberately weird resolution (1420x701 which was something like 1/105000 browsers) and once again, the overall entropy was exactly 17.63. So based on my experiment, it seems that screen resolution and webgl hash have no effect whatsoever on [Panopticlick's] overall entropy score.

clairity2• 7 years ago

mine is ~17. language, platform, screen size, time zone, user agent, and plugin info are the most identifying.

anyone know of a list of the most used values for these so we could lower our uniqueness by setting our browser values to them?

incompatible• 7 years ago

Likewise. It makes no difference whether I enable or disable the Fingerprinters checkbox.

Maybe due to the "uBlock Origin stops it from working" mentioned elsewhere, or some other glitch. Disabling uBlock Origin on panopticlick.eff.org didn't make a difference.

samirm4• 7 years ago

9.93 bits of identifying information.

with this new setting turned on + uBlock Origin + NoScript

messe• 7 years ago

If you haven't already, change your user agent to get it down further.

vasili111• 7 years ago

You can disable JS with uBlock Origin. No need for NoScript.

wybiral2• 7 years ago

I wonder if these fingerprint checks look for the more stealthy and sinister approaches, like localhost port scanning [1] and specific CSS selector behavior...?

[1] https://twitter.com/davywtf/status/1132026581038190592

qiqitori2• 7 years ago

There's so much fingerprinting that can't really be disabled. Think about it:

Performance

- Single-threaded CPU performance

- Multi-threaded CPU performance

- WebGL performance

- Video performance

- Network performance (how long does it take to transfer data to various locations, what's the lag, is the lag consistent, etc.)

- (Maybe) Time it takes to execute certain JavaScript functions

User behavior

- How does the user use their mouse when navigating web pages?

- Not at all?

- Jerky movements?

- Smooth movements?

- If the user uses the keyboard, do they appear to be advanced keyboard users, do they have an IME, etc.

- Does the user press X buttons on tiny annoying popups that wouldn't interfere with the page's browsing experience?

- Does the user appear to block access to certain resources? (ad blocker)

- Does the user's workplace/country/etc. appear to block anything?

ouid• 7 years ago

I think it's funny that panopticlick gives me a little red X for not allowing trackers from companies that have "promised" not to track me. I have no incentive to do so, as I do not get any sort of compensation if they are found to be in violation of those terms.

rjf724• 7 years ago

Just sticking this comment here since I think most people would like to see how the site works. People are interpreting the numbers incorrectly, as I also did at first even though it says at the top exactly how they're measuring these numbers.

Your entropy is determined exclusively based upon the people that have used the site in the past 45 days. For now that number is about 204k. So for instance if you see something has an etropy of 9.08 (as my user agent does) you'd also see that it says 1 in 542.15 browsers have this value. 2^9.08 ~= 542.15. The ~ there only because the thousandths and onward digits are not showing. My exact entropy would be about 9.08254825596. All that means is that of the ~204k people that have used the site in the past 45 days, 377 had the same user agent.

The problem with this is that the people using this site are going to be a heavily biased sample. And so by tuning to reduce your entropy, you are not actually reducing your trackability but instead making yourself look more like the subset of people that are actively using this site. And this becomes an even bigger problem since I do imagine this site is actively shared on more technically orientated sites, such as this one. But the settings of technically orientated users are often going to vary somewhat significantly from the settings of the other 99% of users.

The point of this is that by working to reduce your entropy on this site you may, ironically, end up making yourself more trackable. So the numbers should be taken not as a measurement of trackability, but rather as an interesting insight of your browser/setting differences/similarities of other users with the site.

---

Also, 100% agreed on the silliness of them marking you down for not allowing cookies marked Do Not Track friendly. Until such things are enforced, in code and ubiquitously, they're meaningless unenforceable promises that rely on tracking and advertising corporations never lying.

groovecoder• 7 years ago

Please note: the fingerprinting protection in this blog post is different from the resistFingerprinting about:config pref which would affect your entropy bits on panopticlick.

everdrive• 7 years ago

"Currently, we estimate that your browser has a fingerprint that conveys at least 17.66 bits of identifying information."

However, some of the information sent by my (stock browser) is clearly false:

User Agent: Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0

Platform: Linux x86_64

I didn't mess with my user agent, so I assume this is related "resistfingerprinting" in about:config.

vbezhenar3• 7 years ago

Firefox with uBlock Origin and JavaScript disabled: 9.81 bits, one in 900.21 browsers. Google Chrome with uBlock Origin: at least 17.68 bits, unique among the 209,744. iPhone 8, Safari, some adblocker: the same (unique). Probably I should update OS, I'm using pretty old version.

Causality14• 7 years ago

AdNauseam is an extension that clicks ads at random in the background, thus polluting your user data. It was useful enough to get banned from the Chrome web store.

floatingatoll4• 7 years ago

It’s probably wise not to encourage interstate advertising fraud that the FBI might decide to investigate and arrest you for knowingly participating in.

https://www.fastcompany.com/90273549/fbi-and-google-take-dow...

Causality14• 7 years ago

They arrested people for making money by generating fake clicks on their own site. AdNauseam isn't ad fraud any more than running a web crawler bot is ad fraud.

darkpuma• 7 years ago

Pathetic FUD.

amanzi• 7 years ago

I use the Strict blocking setting and have no need for a separate adblocker.

cypherpunks01• 7 years ago

Does this just turn on the privacy.resistFingerprinting flag? I liked that flag but it set all sites to UTC time which caused me random issues..

cpeterso• 7 years ago

No, this is different. This feature is a block list of known fingerprinting and cryptomining scripts. The privacy.resistFingerprinting flag changes Firefox settings that scripts use to fingerprint users, such as User-Agent string, window dimensions, and time zone (as you mentioned). The flag is enabled in Tor but not Firefox because the setting changes can break some websites or hurt performance.

ziddoap5• 7 years ago

I find it really interesting that when a company is making moves in a direction that benefits privacy of consumers, everyone takes the opportunity to shit on them for past mistakes or how it isn't good enough or why isn't it on by default or any other thing they can find to shit on.

Yes, every single company has made mistakes. FireFox is no exception. Some of them were pretty egregious. Mistakes are - hopefully - an opportunity to learn and adjust, move forward, and continue progress towards something we all want: privacy.

We should absolutely call out companies when they make mistakes or ill-advised choices. I'm not saying we shouldn't. However, we should also _applaud_ efforts that are in-line with bringing privacy to consumers. Not just spend all of our time looking for something negative to be outraged at.

This always-negative/outrage attitude just erodes any sort of meaningful discussion.

roca4• 7 years ago

It also reduces incentives to actually make moves that benefit privacy. Because if the people who say they care about privacy aren't going to support you, why bother?

scarejunba• 7 years ago

Nah, the people who care are happy. The problem is the guys who like to talk. It's the same with security. There's like an army of people who've learned about it from internet commentary exclusively and they bluster a lot as a substitute for competence.

zobzu2• 7 years ago

On point

Kiro• 7 years ago

Pretty sure you would never say the same thing about Google.

ziddoap5• 7 years ago

What are you basing this assumption on?

The funny thing is, no matter how I reply to your comment I lose by default. If I say I have - you say I'm lying. If I say I haven't, your point is proven. What option do I have?

Perhaps you'd like to chime in on the discussion at hand rather than speculating on my personal life.

blub• 7 years ago

So far Google have only made moves in a direction that damages privacy, so everyone would be too stunned to say anything in your hypothetical case.

eitland2• 7 years ago

I defended them for years.

They made me look dumb.

I learned my lesson.

zwaps5• 7 years ago

Never?

You may not remember this, but Google used to be cool. "Don't be evil", and all that. There was a lot of hope - when Microsoft was still the bad guys. Working at Google was the dream - they made movies about that.

Nowadays we all feel stupid, obviously. Right up to deleting "Don't be evil". Literally taking it out. The nerve.

dmos623• 7 years ago

always-negative/outrage attitude

That's a meaningful insight. I think Web is in a place now where anyone with technical insight is frustrated. Yes, frustration is the right word. And confused. And it's this mix of confusion and frustration that has people going around bad mouthing all browsers, or at least I think so. Mozilla Firefox is the only significant browser that has the economic incentives to take care of privacy (there's no debate about that right? well there could be Safari, but it's closed source). I'm pretty close to chanting "the end is nigh". If you compare the resources available to the privacy-invading businesses, and the privacy-preserving businesses, how does it look? Or maybe regulative action will be taken? 100x more restrictive and better thought through than GDPR should be enough. Somehow I don't see that happening. Someone with a lighter outlook, chime in.

core-questions• 7 years ago

Vote with your dollars and your eyeballs, and retreat from the parts of the Web that are abusing you and everyone else. You lived fine before Facebook and Instagram, you can live fine without them now.

Despegar4• 7 years ago

there's no debate about that right?

Sure there is. Mozilla depends heavily on revenue from Google whereas Apple doesn't. For Mozilla it's life or death and for Apple it's not (to be the default search engine).

There isn't a single tech company where the business incentives are more aligned with privacy than Apple.

GrinningFool• 7 years ago

    If you compare the resources available to the 
    privacy-invading businesses, and the
    privacy-preserving businesses, how does it look?

I think this highlights an underlying problem: invading privacy has proven to be extremely profitable, which gives the companies that do it disproportionate resources when it comes to controlling the privacy discussion.

    Someone with a lighter outlook, chime in.

Oops, nope that's not me...

hartator• 7 years ago

The thing is there is disparity between the value they promote - privacy - and Mozilla actions.

If privacy first was truly the Mozilla mission, we won't have Google Analytics on extension internal pages, the Mr Robot Ad, the Yahoo ad deal, and the ability to inject code remotely in your browser. Privacy seems to be a Mozilla concern but it's not a primary one.

silversconfused• 7 years ago

Mozilla will gladly protect you from other entities, but they are not user freedom respecting enough to realize that they should also not require you to submit yourself to them. My argument is that allowing users to "opt out" from tracking is insufficient, and I will argue against it whenever possible.. You should be asked and informed before ANY DATA IS SENT to them, not just informed that it is already happening and then asked if you want to keep it on.

Arg.

roca4• 7 years ago

Without the Yahoo ad deal, or "the ability to inject code remotely in your browser" i.e. automatic updates, or reliable telemetry from the majority of Firefox users, it would have been impossible to build a good browser.

jake_the_third2• 7 years ago

I'd be glad to forget Mozilla's past if they'd show that they have learned from them. The problem is that they haven't. In some cases, they've doubled down on them.

I say this as someone who uses firefox on every device he can.

Nicksil• 7 years ago

The problem is that they haven't.

How so?

In some cases, they've doubled down on them.

Which cases?

msla3• 7 years ago

This always-negative/outrage attitude just erodes any sort of meaningful discussion.

They destroyed some of my bookmarks when they dropped RSS support. That isn't privacy-eroding, it's data destruction, and they didn't even let me opt out.

I know they probably had a lot of conversation about it, but when the conversation ends with "And then we destroy the data of random people without letting them say no", you need to back up a few steps and look closely at what went wrong in your process.

ziddoap5• 7 years ago

This is what I mean by an attitude that doesn't contribute anything to the discussion at hand. They announced this change in October, and implemented it in December.[1] I don't understand why you were unable to make alternate arrangements in that time. It feels like you're going out of your way to find something to be angry about.

In addition:

Firefox will tell you when support for Live Bookmarks has ended and will do the following:
Automatically export all existing Live Bookmarks to an OPML file on your desktop named Firefox feeds backup.opml which you can import into another feed reader.
Live Bookmarks will be turned into regular static bookmarks if Firefox can identify the URL. If the URL doesn't exist, the original Live Bookmark is removed.
ESR version 60 will support the built-in feed reader and live bookmarks features. Support for these features will be removed in October 2019, when ESR 60 is no longer supported.[2]

So, what would suggest instead of (or in addition to) providing months of warning, automatic export, and extended support that will continue for another 4-5 months?

[1]https://www.gijsk.com/blog/2018/10/firefox-removes-core-prod... [2]https://support.mozilla.org/en-US/kb/feed-reader-replacement...

3xblah2• 7 years ago

Mozilla has a conflict of interest. It pays its developers indirectly from internet ad revenue through deals with companies that sell ads. More importantly it seeks to compete with a browser controlled by ad sales company.

Giving the users commenting negatively the privacy they want would mean that Firefox would not implement the "features" that its developers believe are necessary for a "good browser".1

What "good browser" really means to these developers is a browser that does what the "competing" browser does first and foremost, not the ideal browser some vocal group of ad-loathing, privacy-conscious users want. That is how Mozilla defines "good". "Good" to them means "competitive". To the users who comment on Firefox flaws, "good" means something else. It does not necessarily mean one that "competes" with Chrome.

The honest response from Mozilla to negative comments would be to acknowledge they do not exist primarily for all users. They exist primarily for the developers who work there, as part of a project to be "competitive" with commercially-driven browsers.

Cutting ties to the revenue stream of internet advertising and the browsers that it finances is not an option for Mozilla. It is not volunteer-driven like many open source projects. It has to pay developers a competitive salary.

The idea of "something we all want: privacy" is at odds with developers who are being paid to support the internet ad business. The pervasive advertising found on the internet would not be possible without the cooperation of browser authors.

1 "Without the Yahoo ad deal, or "the ability to inject code remotely in your browser" i.e. automatic updates, or reliable telemetry from the majority of Firefox users, it would have been impossible to build a good browser." - Mozilla employee

sequoia• 7 years ago

The honest response from Mozilla to negative comments would be to acknowledge they do not exist primarily for all users. They exist primarily for the developers who work there, as part of a project to be "competitive" with commercially-driven browsers.

I don’t understand- how is trying to offer a competitive, viable product not “for all users”? Are you suggesting that if they focus on a non-competitive product that’s better for “all users”?

ziddoap5• 7 years ago

I think you fundamentally misunderstand my message.

The point I was trying to get across is this:

Companies do bad things, sometimes intentionally, sometimes by accident, and sometimes because they were misguided. Companies also do good things, sometimes intentionally, sometimes by accident. How are we, as users, able to communicate our thoughts with the company in question in these cases?

One method is by calling out the negatives and applying pressure so that, hopefully, the company feels some obligation to act or risk user exodus. This is an example of what you are doing - and it is a valid way of communicating displeasure with a company when they have made a decision the users don't agree with. Negative reinforcement absolutely has its place.

However, an often forgotten method of communication is positive reinforcement. This is how we can tell a company "Hey, good job on this specific thing. It's in a direction we would like to see you keep moving in.". This signals to the company that they are on the right track and, hopefully, encourages them to continue developing that way.

In the specific context of Mozilla, this means that I try to encourage them when they do positive things (blocking fingerprinting) while still expressing my displeasure over the certificate fiasco and other issues.

However, my original post was not meant to be read only in the context of Mozilla, nor was it meant to be read in a way that makes you think that you cannot also raise your concerns. There is a time and place for both positive reinforcement and negative reinforcement. It just seems like people forget about the positive one.

roca4• 7 years ago

FORMER Mozilla employee, FWIW.

Mozilla doesn't exist for its developers. Most of its developers could make a lot more money working elsewhere.

The reality is that if Firefox isn't competitive in performance, security, and Web compatibility, very few people will use it, in which case why even bother?

There's more at stake here than just privacy, too. An open platform that isn't controlled by a single vendor, that doesn't have gatekeepers, that has lots of content AND lots of clients is really important. The standards-based Web is the only candidate at this point. Mozilla cares a lot about that, and they need a competitive browser with significant marketshare or they have no leverage.

sjwright• 7 years ago

Mozilla has a conflict of interest.

Irrelevant. Conflicts of interest aren't a problem in and of themselves. Most people and companies have conflicts of interest all over the place—if you're prepared to look hard enough. It could be as simple as the conflict between retaining good employees and turning a profit. Conflicts are everywhere.

The question is whether the conflict is causing the company to make decisions which you think are bad—and whether you can convince others to agree with you that they're bad.

The remainder of your post is an equivocation fallacy between the ability to deeply track individual people and the ability to run advertisements at all. You don't need deep tracking in order for advertising to work well. (...unless perhaps you're relying on a fully automated algorithm to do all the work...)

flukus2• 7 years ago

Good reputations are hard to gain and easily lost, we shouldn't forget how we got to the sorry current state of the web and Mozillas mistakes are a large part of how that happened. Had mozilla not pissed away market share while they rewrote things in rust, broke extensions, built a horrible UI, etc, then they would have had enough weight to do things look push back against DRM.

Obviously having a spyware company like google control the web is a bad thing, but that doesn't make mozilla good, they've been poor stewards for a long time and we should be looking toward others, the pale moon fork to name one example.

tyingq• 7 years ago

It doesn't help when companies use privacy as a fake veil for what they are actually doing. Google's "manifest V3" changes are a recent example.

This change from Firefox does seem well intentioned.

neilv• 7 years ago

I applaud this move by Mozilla towards privacy and security, and I have hope that they'll be increasing their focus on this.

The criticisms like "why isn't this the default", "why didn't you do this when you had patches years ago", "why did you play along with standardization of these mechanisms in the first place", and "what about all these other things you're doing" might reflect a knowledge of technology and history. And frustration, since, now, with Firefox's diminished market share, and having already given up privacy&security ground, Mozilla probably has to tiptoe.

A possible alternative to tiptoeing... With Google handing Mozilla a huge freebie right now, with the anti-adblocking move, there might be a new opening for Mozilla to "go rogue", from the perspective of many dotcom abusers, reclaim some lost ground, and start actually making the abusers angry. For that to work, Mozilla needs users who, when an abusing site says "Firefox broke this; switch to Chrome", will yell at the abusing site, and leave the site. They'll also need to live up to the expectations of those dedicated users, not do data-grabbing/leaking dotcom behavior themselves, which will require some internal rethinking. If they piss off some funding sources, they'll need to find some minimal level of funding, to pay for the jobs that simply can't be done by volunteers, and for expenses for things actually essential to the core mission. (And to get all their hardware&connectivity infrastructure donated by companies that would like the goodwill, and who will sign legal commitments to not use incidental data, with severe penalty clauses.)

ycombonator• 7 years ago

Is there a test to check whether a site is fingerprinting ?

kube-system• 7 years ago

There are likely some blacklists for known fingerprinting libraries. But, there's nothing that can tell you for sure, because it is also possible to fingerprint entirely server-side using the information your browser voluntarily transmits or contextual information about your connection.

banachtarski4• 7 years ago

Serious question. Suppose we have this. I suppose my expectation is that instead of seeing the same ad over and over again, now I'm seeing effectively a random one.

Why is this necessarily better? I guess personally, I've always thought that regulating the content of the ads, rather than the usage of sufficiently anonymized data for ad targeting.

jeena• 7 years ago

Ads that are not targeted don't have such huge impact on you as the targeted ones and therefor they don't trick you to buy something you don't need as easily which is good for you and the environment.

treve• 7 years ago

Getting a targeted advertising that is likely relevant to you is probably one of the few positives of tracking.

The issue people have with tracking is not 'what ad am I getting on a given website'. To get a targeted ad they need to maintain a database of privacy infringing information. 3rd parties having this data, and what they might do it with it (or who they might lose the data to) is what many people have an issue with.

Being served a targetted ad is just a strong signal that someone out there has this private data on you.

For example, chances are that google has a pretty rich database of your location history. If not you specifically, they do for most people. You can probably imagine a few different scenarios where someone else obtaining that data could be bad for someone. You're trusting google with it, but is that trust warranted?

chrisshroba• 7 years ago

Serious follow-up: I've always been fairly apathetic towards companies tracking me because I don't see too many plausible situations that would end up truly affecting me negatively. Do you have any examples (preferably that have happened in the past, but hypothetical are okay too) of what can go wrong if the tracking information falls in the wrong hands? Sure, street addresses, SSN's, credit card numbers would be bad, but why should I care if someone finds out that I'm a male aged 24 interested in backpacking, Apple products, and programming?

banachtarski4• 7 years ago

I would like to see legislation that prevents storing data in a way that identifying information could be derived from a legitimate hacker. I think this is far more practical than a blanket hammer banning all forms of tracking, as we're stuck with advertising for better or worse. Might as well actually make things saner.

zwaps5• 7 years ago

You go to hotel.com and you don't get a good offer because they know exactly how much you are willing and able to pay.

Sounds good?

now do this for every other thing you buy online.

Good enough?

banachtarski4• 7 years ago

I would classify that as "not sufficiently anonymized." I'm asking a serious question and don't really subscribe to dogma as being particularly convincing.

Thanks for the facetious argument and hand-waving though.

ttiurani• 7 years ago

In addition to the many privacy problems, advertising is rarely about passing timely information on things you need. Ads are mostly used to fabricate desires for things you don't need. While being good at critical media literacy helps, none of us are immune to this kind of manipulation and even less so when the ads are carefully targeted.

the_gipsy• 7 years ago

One case is targetting very precisely at people that could sway their vote.

wybiral2• 7 years ago

I've been really impressed with Firefox Quantum for the steps they've taken towards privacy and transparency.

This definitely seems like the edge that Mozilla will have when trying to stand out against Chromium-based browsers going forward (especially now that everyone else seems to base their browser off of Chromium).

ojosilva• 7 years ago

I'm a big user of Firefox since I switched from Chrome 1 year ago for these reasons, but I wonder why don't they base their underlying engine on Chromium then build all their safety, privacy and other niceness on top of that?

I know Mozilla has been working hard on the engine (rewrite with Rust?) and new versions like Firefox Focus on mobile is blazing fast, but keeping a separate renderer (and developer tools!), with its own issues and discrepancies, seems like a lot of sweat and pain when the Chromium project seems decently sound OSS. I know being able to put in practice your own interpretation of standards is a great exercise in freedom and web diversity, which seems to reinforce their mission, but still... the end result is probably millions in economic impact worldwide to keep website codebases aligned with browser standards, even if the differences are apparently minimal and 99% of the time it just works.

Is being a fully independent browser Mozilla's main raison d'être?

hinkley• 7 years ago

I'm starting to wonder what would happen if you made a proxy that made your web browsing look like bot traffic.

jamiek88• 7 years ago

Captchas. Lots of captchas.

SmokeGS• 7 years ago

This might make me download Firefox

securityfreak2• 7 years ago

All of this is fantastic. I just hope the day comes, when Google is no longer the default search engine in Firefox. Safari is my default browser, but I use Firefox heavily for “social” media accounts. I love the extensions.

vidyesh• 7 years ago

You can change the default to any other search engine you want. Just a few clicks away.

nsomaru• 7 years ago

In the context, most users do not change the default

securityfreak2• 7 years ago

Yes, that is true. But the hypocrisy is how Firefox criticises Google (either directly or indirectly), but is paid by Google to have them as the default search engine. The emphasis is on the word default, not that you can't change it. The same thing goes for Apple with Safari. They disabled 3rd party cookies and promote privacy, but Google is still the default browser, for which Google pays a very large amount of money each year.

tadzik_• 7 years ago

At the top left of your Firefox browser, you will see an icon that looks like an i inside a circle. Click on it and then click on Content Blocking

...did anyone figure out what the hell that is supposed to be, or look like? Why wouldn't they just put a screenshot.

Apparently they just mean the security settings and selecting Custom in those. Except it's on the right. And it's stripes, not a circle. shrug

detaro• 7 years ago

ⓘ

StavrosK2• 7 years ago

Left of the URL on the URL bar is an information icon. Click that and click "custom" next to Content Blocking, or just go into the options at Security & Privacy.

dessant3• 7 years ago

Google's reCAPTCHA makes it impossible to use large portions of the web once you take reasonable measures to protect your privacy. The challenge will continuously fail, despite you spending time to carefully solve it. This cruel behavior is described in a patent [1] by Kyle Adams of Juniper Networks.

[1] https://patents.google.com/patent/US9407661

StavrosK2• 7 years ago

The audio CAPTCHA always works first try for me. The image CAPTCHA can go eff itself, it would always take me five tries while the images loaded super slowly.

dessant3• 7 years ago

Yes, the audio CAPTCHA is easier to solve, but the audio challenge is blocked [1] if you are not in a good network neighbourhood or they can't collect enough tracking data to classify your visit.

[1] https://github.com/w3c/apa/issues/25

kabacha3• 7 years ago

Google's reCAPTCHA is cancer upon the web. Everyone should enable fingerprint block to shut this invasive and abusive garbage.

If everyone would block it the website owners would have no choice other than to move to a different captcha system.

confounded• 7 years ago

“Hm, works in Chrome. Are you using Chrome?”

smittywerben2• 7 years ago

I'm logged in on a Chrome browser with a residential IP and get a reCAPTCHA 1-3 times a day when programming. It's the kind that I don't need to solve puzzles but still need JS enabled to click the button. So after the first few (SEO optimized) pages I either get fingerprinted or temp banned. Ugh this is getting ridiculous.

DRINK VERIFICATION CAN

rum33• 7 years ago

Cloudflare must be mentioned when talking about recaptcha and cancer. They are the ones locking people out from whole websites and forcing you to fill out these recaptchas. They are also the ones who have almost destroyed browsing the internet using TOR due to these recaptchas.

jeltz• 7 years ago

Do you know of any good alternatives? I would love to get rid off recaptcha but it is a very convenient and quick to set up way to stop most spam bots.

sebazzz• 7 years ago

Remember that reCAPTCHA v1 used to be noble: reading books and converting them to text.

Now you're just training many Google machine learning algorithms by classifying data. In which they get more useful for the consumer, thus more powerful.

visarga• 7 years ago

I hate them as much as you do, but you're wrong. Those storefront and traffic sign captchas are not useful for training ML models. If they were to be useful, they would be much more varied, like the original ones (used for OCR).

bytesandbots• 7 years ago

They are able to verify that the user selection is correct. It is possible only if they already have the right answer. If they already have the right answer, what are they training for.

chmars• 7 years ago

Do you have a suggestion for a good alternative?

I dislike Google reCAPTCHA, however, it brought down contact form and comment spam to almost zero. (With the price of an unknown number of false positives and some frustrated users.)

stefek99• 7 years ago

Wait. Patent? It's just a simple technique, quirk, workaround, something to win the arms race... Just like shadowbanning on Twitter.

stockkid2• 7 years ago

Keep in mind that blocking fingerprinting may cause some sites to break.

This represents the sad state of Internet we are all living through. I have noticed that when I turn on privacy settings on Firefox, some major websites are broken and rendered unusable. It seems that the Internet is rampant with tracking and privacy violation, and we consumers are passively accepting it, by and large.

kgwxd2• 7 years ago

I haven't had an issue, but I avoid "major websites" like the plague, as they are the modern equivalent (though measles is making a comeback). If a site breaks with good privacy settings, it's a decent indicator you're better off not visiting. If a breaking site shows up on my radar too much, I add the domain to an add-on I made to hide links to it on any page. My HN/reddit/search results/etc views usually have a few blank lines, they're links to domains I have determined I never want to visit ever again. My RSS reader gets a variation of the filter, so they don't show up there either. It feels really good to have the power to remove an entire site from my personal internet.

stockkid2• 7 years ago

I add the domain to an add-on I made to hide links to it on any page.

That sounds interesting. Have you published it or made source available? I'd love to try.

rhaksw3• 7 years ago

I have noticed that when I turn on privacy settings on Firefox, some major websites are broken

In some cases it is because Firefox's tracking protection is based off of a curated list of websites [1]. This breaks a site I built called reVddit [2].

In my uneducated opinion, this list is weird. I had some discussion about this with Mozilla devs [3]. In that message chain, devs acknowledged reVddit is not doing anything wrong, rather it is reddit who could infringe users' privacy. Yet it is the non-infringing site that is rendered broken.

Further, the devs' suggestions for remedy are not workable. They propose moving requests to the server so that reVddit.com makes the requests to reddit.com. There are multiple problems with this,

* It would hide more code from users

* Reddit rate-limits requests coming from a single source

* Infrastructure becomes expensive on what is supposed to be a low cost website

My conversation with devs was good but needs more. I don't understand their point and they do not seem to understand mine.

[1] https://github.com/disconnectme/disconnect-tracking-protecti...

[2] https://revddit.com

[3] https://groups.google.com/d/msg/mozilla.dev.privacy/XO84Ezrw...

bitdeep• 7 years ago

Damn... I was using some fingerprint to prevent sensitive accounts to be stolen or misused, now moz guys is taking away my cake.

quickthrower2• 7 years ago

Are they are biting the hand that feeds them? Interesting relationship with Google - they get revenue from them, but are a competitor with conflicting ideals.

I'd like to see Firefox premium services (like a dropbox clone etc.) to provide independent revenue, so they can be aggressive for privacy.

thomasfedb• 7 years ago

Recent progress in Firefox contrasts very strongly with Chrome. I know I'm very happy to be a FF user right now.

geekamongus• 7 years ago

It seems that almost weekly, I am reminded why I love Firefox because of some new thing Mozilla is doing. A lot of good decisions have been coming from them lately.

codsane2• 7 years ago

I finally made the switch from Brave today and I'm never going back. Firefox is just as privacy-conscious, supports built-in tracker blocking, fingerprinting, and has full sync that Brave hasn't implemented yet.

rjf724• 7 years ago

Just as privacy conscious is a misleading statement. Choosing to migrate their default search to Google was a money grab by Firefox and that money is, in turn, 100% dependent upon tracking. I think this is why what limited privacy options Firefox does offer are entirely opt-in, and often hidden behind menus that your average user will probably never visit.

By contrast Brave has had things such as blocking of fingerprinting for months (years?), and also natively supports OPT-OUT ad blocking, script blocking, third party cookie blocking (which FireFox does also but once again in a less direct fashion), single click native TOR access + ID swapping anywhere, and more. And I think the biggest difference is that this is all directly exposed to the user. If a user clicks the big iconic Lion icon in the top right they get a popup that shows nothing but:

- [x] Shields Up (adblocking/etc)

- [x] Third party trackers blocked

- [x] Connections forced to HTTPS

- [x] Scripts blocked

- [Third Party/All/None] Cookies blocked

- [Third Party/All/None] Device recognition blocked

So even users that know absolutely nothing and don't bother to navigate through menu options will almost definitely immediately be exposed to all of these privacy options, though again given the opt-out nature of much of it - even if they weren't, it would be less of an issue.

dylan604• 7 years ago

FF is my primary browser, yet people I know that work in security laugh at me as they claim FF is always the first browser to fail in the hacker games. I don't know enough about why, but I'd love for that to not be a thing. Taking into account my threat profile (types of sites I visit, JS blocking, etc), I feel the hacking risk is still a worth while trade off for the lack of tracking.

Fnoord4• 7 years ago

"People I know that work in security" is vague and non descriptive.

To be fair, you did follow it up:

as they claim FF is always the first browser to fail in the hacker games

What are their sources? I also "know such people" and I am unaware of such claims. If one uses Kali Linux, it has Mozilla Firefox as default browser. The same for Debian (on which Kali is based upon).

The thing is, you can harden your browser after installation. The first thing I do with a browser is installing uBlock Origin and uMatrix.

lol768• 7 years ago

I've heard that too.. I know it's been attacked successfully at pwn2own a few times, and in the past the sandbox on e.g. Linux wasn't as restricted.

I think things have improved though.

whatamidoingyo• 7 years ago

There are more vulnerabilities in FF, or so I've heard. But most people I know in security love firefox, especially because of how easy it is to setup with tools like Burp Suite.

terrycody• 7 years ago

Awesome feature, already activated it!

somezero• 7 years ago

Does using "User-Agent switcher" or similar extensions have any effect on this functionality?

rhaksw3• 7 years ago

I've had some issues maintaining reVddit.com while keeping Firefox's tracking protection in mind. I'd love some help if there is anyone who can provide insight.

Basically, you can't load reVddit pages on Firefox because reVddit accesses reddit's API, and reddit is listed on Firefox's list of websites that are considered trackers [1].

In my uneducated opinion, this list is weird. I had some discussion about this with Mozilla devs [2]. In that message chain, devs acknowledged reVddit is not doing anything wrong, rather it is reddit who could infringe users' privacy. Yet it is the non-infringing site that breaks.

Further, the devs' suggestions for remedy are not workable. They propose moving requests to the server so that reVddit.com makes the requests to reddit.com. There are multiple problems with this,

* It would hide more code from users

* Reddit rate-limits requests coming from a single source

* Infrastructure becomes expensive on what is supposed to be a low cost website

My conversation with devs was good but needs more. Is there any solution here, or do we just go our separate ways?

[1] https://github.com/disconnectme/disconnect-tracking-protecti...

[2] https://groups.google.com/d/msg/mozilla.dev.privacy/XO84Ezrw...

Mathnerd314• 7 years ago

There is a similar bug in Bugzilla for redditp.com, open since 2015: https://bugzilla.mozilla.org/show_bug.cgi?id=1235978

My general impression is that tracking protection is low-priority for Mozilla and anyone who actually cares is using uBlock Origin / uMatrix or similar extensions since those use filter lists that are actually updated.

rhaksw3• 7 years ago

My general impression is that tracking protection is low-priority for Mozilla

It is on by default, and as you point out, breaks many innocent sites. People may migrate elsewhere. That should bump up its priority.

Justsignedup• 7 years ago

I've used this feature in the past. There are some weirdneses.

You lose your timezone and ALL dates appear in UTC. This is definitely not desirable.

Fingerprinting cannot be allowed for some sites, and thus things like android messages cannot work because it cannot accurately identify the browser.

Hopefully they'll do something about all this.

kabacha3• 7 years ago

You lose your timezone and ALL dates appear in UTC.

Seems like an easy fix would be to have client based converter, even more simple than what fingerprint blocker does with screen resolution.

ddffre2• 7 years ago

What about them selling their data on the darkweb?

They claimed that there was no breach, but yet all of their database is being sold on the darkweb.

Is it so easy to gather their database and publish it?

eVeechu7• 7 years ago

Who is them? Whose database?

ddffre2• 7 years ago

Truecaller: https://techunalt.com/truecaller-data-sold-on-dark-web/

hwj• 7 years ago

The German version of that article has a casual slang:

Clearly, you don't want to throw your computer out of the window and never use the internet again, just to get rid of ads.

https://blog.mozilla.org/firefox/de/loesche-deinen-digitalen...

anoplus• 7 years ago

I am posting this again, because I still didn't get opinions about it and I think it is important.

How much of Firefox success depends on donations?

I have seen successful crowd-funding projects where the budget is always transparent and communicated to the public. I am certain this motivates the masses to donate.

Wouldn't it be better for Mozilla to make their funding fully transparent to attract the masses?

tngranados• 7 years ago

I'm not sure how transparent they are about their finances, but most of Mozilla funding comes from search engines deals to make them default in certain regions (Yahoo, Google, Yandex and Baidu).

b-3-n• 7 years ago

Firefox is playing its trump, the privacy, very well lately. This is very smart as the competition has no good answer. Equalizing on privacy level would go against their business model so they won't ever do it wholeheartedly.

Trying out Firefox now...

jopsen• 7 years ago

Equalizing on privacy level would go against their business model...

More importantly it would go against the mission statement.

Mozilla isn't around to make money, it's around to make progress toward a mission. (Search revenue helps fund that, but revenue is not the end goal for Mozilla).

_bAp_• 7 years ago

He was talking about the competition, not Mozilla.

bojanvidanovic• 7 years ago

Firefox is really stepping up in the game of online privacy. I switched to Firefox almost 2 years ago and never looked back.

scoutt• 7 years ago

I wonder is there is the possibility (or if someone came across) of saving (and loading) all the data of a fingerprint state, or to be able to craft one, modify it, or share it. That is, all the metadata (cookies, history, etc.) that supposedly identifies a user-type.

It could be interesting to have a drop-down in the browser to select a "who I want to be today" profile and be able to see the world from that perspective.

porky• 7 years ago

At first I read "block Fingering with Firefox"

kakkksaknmdm11• 7 years ago

I worked in the ad industry. Every web-browser including brave, tor,safari is uniquely identifiable even on same hardware.

All the public computer researchers and browser vendors are years behind the techniques to fingerprint devices (probably 5+).

Canvas, WebGl etc are techniques of the past. There are much more advanced ones, than can identify devices with completely uniquely (on both desktop and mobile)

Also we know when users fake their fingerprints, and the algorithm respects the decision even though we know who the user is despite faking with all state of the art methods.

Latest methods dont even use JavaScript. Just CSS is enough to identify every device uniquely but you'd need JS to send the data back.

Every public researcher I've seen are given honeypot techniques that they consider state of the art even thought the industry is way ahead of the researchers.

senorjazz• 7 years ago

If this is the case, then the millions if not billions of adfraud is put through by the ad companies knowingly and defrauding the ad-buyers surely?

kakkksaknmdm11• 7 years ago

Large companies have fixed ad spend budgets. If they dont spend they lose. Doesn't matter if its lost to fraud.

Google, Facebook advertiser have more specific budgets, especially Facebook which has a large number of small advertisers.

Large adnetworks however get large advertisers with advertising budgets in tens of millions on average.

There is a larger pressure on Google and Facebook to be competitive then say smaller ad networks.

Also the techniques that I mention of are not in use in wild after the POC on millions of devices few months ago. They're a backup plan. Also not every adtech company has them. Maybe 2 or 3 at the most are at the cutting edge of tracking.

Google knows this very well. You really think Google couldn't counter fraud? Its a fake and manufactured outrage. No one wants to give away their "secret sauce" just yet.

Also right now many adtech companies are going bankrupt. Many larger one are waiting for smaller ones to be gone after which the landscape changes.

flatb• 7 years ago

Not to be picky, because to be honest I completely believe that what you say is plausible, but that's a lot of outrageous claims with very little in the way of examples or evidence.

kakkksaknmdm11• 7 years ago

This is what we knew of in 2015: https://boingboing.net/2019/05/22/unique-device-fingerprints... you can figure out where the industry is now yourself.

rypskar• 7 years ago

Thank you for this good argument for why we all should block ads. There is no reason for you to stalk users

user32556• 7 years ago

Are you talking about CSS-based fingerprinting?

https://browserleaks.com/css#explanation

kakkksaknmdm11• 7 years ago

No, not this is some amateur work. State of the art techniques css fingerprinting can uniquely identify 1 device from billions.

Also this is nothing but getting dimension of screen and other browser attributes which are useless now. The current state of the art cannot be mitigated unless you put a 95% penalty on performance on the CSS engine AFAIK.

TeMPOraL• 7 years ago

As a service to the public, could you please share the state-of-the-art techniques used currently by the industry?

kakkksaknmdm11• 7 years ago

This was used publicly in around 2016, stopped using around 2017 when research showed even better ways that cannot be spoofed: https://boingboing.net/2019/05/22/unique-device-fingerprints...

Ours was more advanced then this. As far as I've read the paper cited on the source above, they are like 30% of ours tech POC back in 2015.

Laaas• 7 years ago

Can you give any examples for the techniques used?

kakkksaknmdm11• 7 years ago

This is one that we knew of in 2015, and the public researchers just found out in 2019: https://boingboing.net/2019/05/22/unique-device-fingerprints...

Now we're waaay past this easy stuff to fake stuff. This now considered to be basic.

Look into distill networks, but their public product is very far behind what we did. Not sure if they have better tech to be used in future.

emtel• 7 years ago

In order to believe what you're claiming here, we have to believe that

1. There is magic css/js that can not only tell different browsers and devices apart, but can tell two phones from the same manufacturing run with the same software apart.

2. Despite the fact that this magic code would have to run in the client browser where its content, execution, and the data it sends back are all plainly visible to anyone who can hit ctrl-shift-j, no "public researcher or browser vendor" knows anything about it.

3. This technology is not used to combat ad fraud because of some weird conspiracy at Google.

It could be true, I suppose, but I don't see why anyone would believe this based on the evidence so far.

kakkksaknmdm11• 7 years ago

Yes to all. Have a look if you want for a bit of evidence: This was one of the 10's of possible techniques that could identify devices uniquely among billions https://boingboing.net/2019/05/22/unique-device-fingerprints...

However the author of the paper could not get it to work on low end devices, whereas we could. And we discovered this around 2015.

vbezhenar3• 7 years ago

Just today I decided to switch to FF and try noscript experience. Works good enough so far. Funny that crippled experience is even better in some weird ways. I used to scroll reddit forums, now I can read just few first posts and that is good. I used to expand a lot of comments, now I can't expand them, but it saves time. Sure, self-control would be better, but that is good too :) It's good to know that without JavaScript I'll send less data to that anti-human industry.

kakkksaknmdm11• 7 years ago

Wait for the new CSS version over which our team had a watch. Wont require JS after it comes out. ;D

Also we know many exploits to bypass noscript if we wanted to (yes I know there are bounties for this, but we were paid much higher then any public bounty for this stuff)

vxNsr• 7 years ago

As much as I hate more legislation I think the only way to solve this is to make it very onerous to own and compile this data and to level heavy fines (as in criminal charges and/or force the company into bankruptcy via 90% revenue fines) in cases when the database is breached.

Everything else will just turn into an arms race between those who don't wanna be tracked and those who wanna track.

If the US did something like the GDPR but in our constitution I wouldn't be surprised if a cottage industry opened up overnight in secure data-warehousing. I get that it would complicate things for small companies but we brought this on ourselves.

joaobeno• 7 years ago

These companies then lobby the government, asking to be relieved of the fines, because if they go down, so many workers will be out of jobs, and that they will comply (pinky promise), so the fines should be lifted to help these innocent people...

t0astbread• 7 years ago

How does this work? Does it just block domains known to host fingerprinting scripts? If no, how does it hide addons and settings that interfere with the website? And how does it prevent leaking information by itself that can assist fingerprinting?

mod_stretch• 7 years ago

Mozilla has been up to some questionable activity lately as well. They blocked the Dissenter extension.

muxator• 7 years ago

Whatsapp web does not show the authentication QR code if resistFingerprinting is on. This is annoying at minimum.

I would happily use another IM, but the bad thing about network effect is that one would need to convince everyone else to make the switch, too.

In order to take over, freedom-respecting services need to become _better_ than the non free ones not only on a technical level, but on a UX one, too.

roboyoshi• 7 years ago

which is basically impossible of you're a non-profit or donation based insitution versus a multi-billion dollar company. It's why Evernote is still unreplaced and dropbox has the best filesync. Anyy,way.. I've heard good stuff about matrix so will try to setup this over the weekend.

thejohnstone• 7 years ago

You should try Kameleo software manipulate your fingerprint!

Block Fingerprinting with Firefox

Related Stories