Private Browsing 2.0

https://webkit.org/blog/15697/private-browsing-2-0/

by frizlab • 2 years ago

190 102 2 years ago

webkit.org

ranger_danger• 2 years ago

Safari also brings a version of Web AdAttributionKit to Private Browsing

This is like a bad dream.

doublerabbit• 2 years ago

And this is like an executives wet dream.

12_throw_away• 2 years ago

Yeah that part stuck out to me too. Sigh. What if my browser just did nothing at all to help advertisers, because it's my browser running on my hardware? Even if it is totally privacy-preserving and completely transparent, why would my browser spend my processor cycles, network bandwidth, and electricity for the benefit of someone else's for-profit business?

Really, just ... what if the software on my computer tried its best to do exactly what I asked it to do, and was not concerned with anyone else's problems?

Anyway, here are the AdAtributionKit docs:

- Technical / API: https://developer.apple.com/documentation/adattributionkit

- High-level: https://developer.apple.com/app-store/ad-attribution/

dash22• 2 years ago

why would my browser spend my processor cycles, network bandwidth, and electricity for the benefit of someone else's for-profit business?

I think a reasonable answer is that you are using their website for your own purposes; that running a website has costs; and that many businesses choose to fund those costs by advertising. If you don't want to be advertised to, I would suggest paying a fee to use ad-free services.

klauserc• 2 years ago

They present this like a smart solution for some sort of fundamental problem. It's really not a fundamental problem. Advertisement has worked and still works perfectly fine without attribution in TV, in magazines, on billboards.

Adtech gaslights everyone into accepting that just because it is technically possible to perfectly track and personalize ads in digital media, that they have some sort of moral right to do it.

nashashmi• 2 years ago

Block known trackers

Is this a cat and mouse game?

Fingerprinting

Does this prevent Google's cookieless tracking technology?

sumtechguy2• 2 years ago

Is this a cat and mouse game?

In many ways it is. When I first started blocking using pac files. It was painfully obvious that samesite advertising is the harder thing to block. Luckily for the blockers most companies have been lazy about adverts and put them in known locations. Which works just as well for whole site blocking (known trackers). However, once the adverts are blended into the real data it becomes much harder. Such as what youtube is experimenting with (putting adverts right in the same data stream remuxed). As long as the adverts follow known patterns blocking works fairly easily. The next 'arms' race will be AI detection and block. It will only be a matter of time until someone comes up with a plugin that does exactly that.

Does this prevent Google's cookieless tracking technology?

To a point. But you do not need much data to fingerprint. Think it is something like 12-13 bits plus your IP even with a VPN.

timeon• 2 years ago

Think it is something like 12-13 bits plus your IP even with a VPN.

Is that legal under GDPR?

ezfe• 2 years ago

Google's cookie less tracking stuff is mostly in Chrome

yupyupyups9• 2 years ago

Proxying unencrypted HTTP. Any unencrypted HTTP resources loaded in Private Browsing will use the same multi-hop proxy network used to hide IP addresses from trackers. This ensures that attackers in the local network cannot see or modify the content of Private Browsing traffic.

No thanks, Apple!

I trust my ISP more than you. Multi-hop wont matter if all nodes are managed by you.

piperswe• 2 years ago

iCloud Private Relay uses one hop through Apple infrastructure, and one hop through third-party infrastructure. So, one node is managed by Apple and the other is managed by Cloudflare/Akamai/Fastly. The Apple node knows where the request comes from but not the contents, while the CF/Akamai/Fastly node knows the contents but not the source.

yupyupyups9• 2 years ago

This works as long as there is no one combining the information together, like Apple together with Cloudflare, or the US government. This is a concern, since both are under the same jurestiction and are bussiness partners.

Contrast this model with Tor where you have 3 hops that are selected in such a way that there is a lower probability that logs from the node operators will be combined. If two nodes, let's say node 1 and 3 are coorporating, then the best that they can do is a correlation attack or other probabalistic methods.

If two nodes (all of them) in WebKit are adverserial, then the content is linked back to your IP address with 100% probability.

avianlyric5• 2 years ago

Apple only control half the nodes, the other half is controlled by cloudflare.

Every request goes via an Apple node first, then is sent to a 3rd party node for final routing. That way neither Apple nor the 3rd party have a complete picture of where a request came from, or where it went.

Not entirely sure why you would trust a random ISP, and everyone else involved in routing that connection, more than Apple. Last I checked most ISP don’t have the tightest privacy policies, or even the best data handling practices. Apple stands to loose millions if they slip up on their privacy promises. Most ISP wouldn’t even bother telling you if they accidentally misplaced your personal details.

https://blog.cloudflare.com/icloud-private-relay/

afavour2• 2 years ago

Congratulations on trusting your ISP, you are in the minority.

yupyupyups9• 2 years ago

I wouldn't say that I trust my ISP. I'm saying that to me, they are more trustworthy than Apple.

Aachen7• 2 years ago

s/the minority/a different country/

See also Mozilla turning on routing DNS traffic to Cloudflare by default because that's the level of trust this American organisation has in their ISPs, but after concerns raised in other countries they decided to turn it off by default at least where I'm from in western Europe (not sure about the rest of the world)

kylehotchkiss• 2 years ago

This is one of iCloud's best features. I'm almost always protected by something like a VPN but that Cloudflare has been programmed to trust so I don't see recaptchas all day. AT&T just helpfully leaked their call records database which serves as a data point against trusting ISP more than Apple & Cloudflare. If anything, I want Private Relay running for every application on my phone

lapcat6• 2 years ago

Has anyone actually seen this feature in action? Looking at packet traces, I can't seem to get it to work. I'm still seeing DNS queries and HTTP in the clear.

(I don't use iCloud Private Relay.)

lapcat6• 2 years ago

Advanced tracking and fingerprinting protection breaks Safari extensions: https://lapcatsoftware.com/articles/2024/6/5.html

eproxus• 2 years ago

It's very odd that Safari treats extension scripts as third-party, especially when they have been given permission to access all websites and data (sound like a bug almost?).

I use and love StopTheMadness Pro. Do you know if it breaks the whole extension or only some parts of it? If so, which ones? (I don't use the copy URL shortcut for example).

lapcat6• 2 years ago

sound like a bug almost?

Yes, I assume it's a bug.

I use and love StopTheMadness Pro.

Thanks!

Do you know if it breaks the whole extension or only some parts of it? If so, which ones?

Not the whole extension, no, only the parts that depend specifically on the URL query.

Vinnl4• 2 years ago

Pretty off-topic, but:

When we invented Private Browsing back in 2005, our aim was to provide users with an easy way to keep their browsing private from anyone who shared the same device.

I wonder if anyone actually involved 19 years ago was also involved in writing this piece, or if it just sounded reasonable to whoever drafted it up.

nequo2• 2 years ago

I gather this sentence sounds unreasonable to you. Why? Were they not the first to ship private browsing mode?

Vinnl4• 2 years ago

Oh no, I didn't mean at all to say it was unreasonable. I meant that the paragraph claims to know what the aim was when introducing the feature, so I wondered if they actually knew that, or just guessed that that was the aim (because it sounds reasonable that it was).

callalex• 2 years ago

Apple has a corporate writing/speech style guide that they adhere to religiously. Anything done by anyone in the company present or past is always “we”. Notice how all their keynotes and product press releases almost always include the sentence “we think you’re gonna love it”?

Vinnl4• 2 years ago

Sorry, I was mostly referring to the fact that they claim to know what the aim was when introducing the feature, even though they might not have been there. Pure curiosity.

Aachen7• 2 years ago

I wasn't involved in the internal discussion 19 years ago, but definitely remember the feature being considered to be for the purpose you cited. I also remember telling classmates that you can use it for logging in to two accounts at the same time on the site we were developing to have an easier time demoing it to the teachers, and getting jokes about "gee you're awfully familiar with the private browsing feature", from which I'd say it was (1) news to people that it also worked the other way around (website doesn't recognise you) because it was worth bringing up, and (2) people demonstrated knowing it's for not leaving the browser history full of NSFW content—and buying gifts for your partner or parent, of course

JumpCrisscross2• 2 years ago

My most-wanted feature in Safari (and Orion) is first-party website-data whitelisting. I have a limited number of sites whom I trust to store data. Everyone else should be a tabula rasa each visit.

horeszko2• 2 years ago

I use the Cookie AutoDelete browser extension for this purpose, which besides the name handles more than just cookie data.

https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...

JumpCrisscross2• 2 years ago

Firefox has first-party whitelisting. Block all website data and then whitelist.

rsolva• 2 years ago

If you're willing to switch browsers, Firefox has this option built in. It flushes all cookies on exit, except from domains in the whitelist. Been using it for years!

kccqzy• 2 years ago

Staying with the 2005 definition of private mode as only being ephemeral, such as Chrome’s Incognito Mode, simply doesn’t cut it anymore.

Yes I cannot agree more. Personally this shift in people's expectations of Private Browsing or Incognito Browsing came in a way that felt sudden. The recent lawsuit about Google tracking you in Incognito mode was absolutely dumbfounding to me: of course websites can still track you! If only people still remembered the origins of this feature in 2005 (or 2008 in Chrome's case). But even on HN the opinion was pretty split. It is indeed clear that it is now time to change what private browsing means.

However, I don't think this is going to stay this way for long. The word "private" when it comes to computing has many varied definitions and it all depends on who the information is made private to. In the extreme case, if your threat model is privacy from eavesdroppers on the network or the ISP, then a browser can easily claim any HTTPS connection is private enough; the majority of browsing is already private browsing. If it is privacy from others using the same machine, then this older private browsing already works. But I cannot help but feel that a few years down the road people are going to consciously or subconsciously substitute yet another definition of privacy.

lcnPylGDnU4H9OF• 2 years ago

substitute yet another definition

I'm not entirely surprised they got this "wrong" given that the question was, "What should we call it?" Naming things (correctly, "future-proof"-ly) is hard.

Aachen7• 2 years ago

It's also not as if smart lamps have brains, as if "we use cookies" is about cookies (it's about agreeing to 178 privacy policies using localStorage and canvas fingerprinting unapologetically), as if cloud computing runs in the sky (ironically, in said clouds, you often can't use those services properly), as if a home button have something to do with your house, and so on and so forth. But, surprise: private navigation mode doesn't give you a free VPN or joins you to an onion routing dark web or something! Why would any consumer expects a computer term to be literally what it says, rather than being like the real-world thing they're named after

Naming things may be hard, but in addition, this isn't even a bad name. The popular colloquial name at the time (porn hiding button, or maybe that was only because I was a student when it was introduced) could hardly be seriously used, of course it is called something related to not leaving traces on the computer you're using

wild_pointer• 2 years ago

That's good progress. How do these features compare to Brave, which has Brave Shields and [copy clean link](https://github.com/brave/brave-browser/wiki/Copy-clean-link)?

dash22• 2 years ago

My impression is:

* These guys are truly working very hard at guaranteeing privacy;

* That will probably break some websites (I'm trying out the advanced tracking protection in normal mode, we'll see).

* It will also put them on collision with Google, which is essentially an advertising shop with a free browser frontend.

lern_too_spel5• 2 years ago

From the article:

Alongside the new suite of enhanced privacy protections in Private Browsing, Safari also brings a version of Web AdAttributionKit to Private Browsing.

This is worse for privacy. No other browser does this. No other browser even lets you opt in for this because it's so nonsensical.

nerdjon• 2 years ago

This is worse for privacy.

That seems like an exaggeration? How could another solution possibly be worse for privacy than the open season it was previously...

The worst it could be is the same.

No other browser even lets you opt in for this because it's so nonsensical.

That also does not seem true

Google has their topics API: https://developer.chrome.com/blog/new-in-chrome-115/#topics-...

and according to another poster here, Firefox added something similar.

Don't get me wrong, I hate that they had to make these concessions, but what was their choice? If they did not give something (while giving users the ability to opt out) we would have seen browsers being blocked (and no way Google was going to not do something given their entire business is ads, so they could just keep saying use Chrome).

akersten2• 2 years ago

We also expanded Web AdAttributionKit (formerly Private Click Measurement) as a replacement for tracking parameters in URL to help developers understand the performance of their marketing campaigns even under Private Browsing.

Without fail, the knee bends. This also just got quietly enabled by default in Firefox 128, go check and turn it off if you are so inclined.

SkyMarshal• 2 years ago

What's the key in Firefox about:config to turn this off?

akersten2• 2 years ago

It's not hidden in about:config thankfully. It's a checkbox in about:preferences labelled "Allow websites to perform privacy-preserving ad measurement"

sexy_seedbox• 2 years ago

    dom.private-attribution.submission.enabled

mappu• 2 years ago

Alternative take on the same news: ""Safari already contains ad tracking technology, and they’re now adding it to Safari’s Private Browsing mode, too"" -

https://www.osnews.com/story/140252/safari-already-contains-...

nwah1• 2 years ago

This is the most important comment and needs more upvotes.

ku1ik• 2 years ago

You know what’s also cool about this announcement? How clean, lightweight and unobtrusive that blog page is.

Aachen7• 2 years ago

TL;DR:

- Blocking requests to known trackers

- Remove utm_ and other such parameters from URLs

- Fingerprinting resistance

- Extension disabling

- Cap third-party cookie lifetimes

- Partitioning for sessionStorage and blob URLs

- Proxying encrypted-to-the-resolver DNS traffic

- Proxying HTTP, but only when it's unencrypted

With a subscription, you also get per-tab sessions and a VPN

---

The fingerprinting resistance is interesting as it claims to remove user behaviour characteristics like typing speed and how you move the cursor. Does it fire keyboard events with randomised delays and adds random offsets to mouse locations or how could this work? Games would be unplayable with mouse offsets and random input lag, but if that's not it, then the website gets the data so this has to be it right? For canvas specifically, they say there'll be small but probably visible artifacts from noise injections. So no web-based photo editing in private navigation? Curious how this'll work out in practice

Also cool is that they offer an open platform (Mastodon) as a place where you can respond to the author!

lapcat6• 2 years ago

- Remove utm_ and other such parameters from URLs

Incorrect. Safari does not remove utm_ parameters. See: https://lapcatsoftware.com/articles/2023/6/2.html

Aachen7• 2 years ago

That article doesn't really say either way? It doesn't mention utm nor give a list of what's removed nor link to such a list (at least not the two links I tried). But if you found the list somewhere I'll take your word for it that utm isn't on there specifically; I should have used more generic phrasing though this did seem like an immediately recognisable "ah, that's what's meant" example

yencabulator• 2 years ago

to implement ad attribution and click measurement in a privacy-preserving way

What an oxymoron.

flumpcakes• 2 years ago

I moved from Android to Apple for only two reasons:

1. They started using USB Type C.

2. They are the only major manufacturer that appears to actually take privacy seriously. Even their AI endeavours look the most privacy focused that exists.

I'm sure I could go buy some no-name brick and flash my own security focused OS and run my own relays and ... I don't want to do that. I want to buy something that everyone else uses and for it to respect me.

So as much hate as Apple gets, they have my trust in good faith, for now.

lern_too_spel5• 2 years ago

Apple is the only major manufacturer that makes phones that can't get their location or install an application without phoning home. The only appearance of privacy is in their marketing. Consider that Google did on-device voice-to-text long before Apple did, that Android lets you use a fully-offline app as your default maps app while iOS does not, and that Android lets you use real Firefox with real uBlock Origin. All out of the box on any Android phone from a reputable vendor. No flashing required.

Apple's deceptive marketing has made me lose all trust in the company. It will take a lot more than USB-C for me to consider Apple for computing devices.

Jiahang• 2 years ago

I using private browsing in iPad all time. It is great to see update !

Private Browsing 2.0

Related Stories