• ngwoo@lemmy.world
      link
      fedilink
      English
      arrow-up
      139
      arrow-down
      4
      ·
      3 months ago

      Advertisers track you with device fingerprinting and behaviour profiling now. Firefox doesn’t do much to obscure the more advanced methods of tracking.

        • hoot@lemmy.ca
          link
          fedilink
          English
          arrow-up
          61
          ·
          3 months ago

          Lots do. But do you know anyone that turns JS off anymore? Platforms don’t care if they miss the odd user for this - because almost no one will be missed.

          • pixelscript@lemm.ee
            link
            fedilink
            English
            arrow-up
            30
            ·
            3 months ago

            “Anymore”? I’ve never met a single soul who knows this is even possible. I myself don’t even know how to do it if I wanted to.

            I do use NoScript, which does this on a site-by-site basis, but even that is considered extremely niche. I’ve never met another NoScripter in the wild.

            • BalooWasWahoo@links.hackliberty.org
              link
              fedilink
              English
              arrow-up
              2
              arrow-down
              1
              ·
              3 months ago

              The people who I’ve tried to get on NoScript seem to have the brain capacity of goldfish. If the site doesn’t instantly work, it’s as if the sky has fallen and there is no way to convince them to pay attention to which scripts are actually needed.

              It’s a rare breed that is willing to put up with toggling different scripts on and off. I’ll also acknowledge that too many people (including me) are in a giant rush. For work-type stuff, I have the laptop without noscript, because sometimes I do need something to work absolutely right now.

              • papabobolious@feddit.nu
                link
                fedilink
                English
                arrow-up
                6
                ·
                3 months ago

                You don’t think you are being a tad judgemental?

                People whose lives revolve around fashion probably think you dress like shit.

                People who love food probably think you eat like shit.

                People who love cars probably think you are a shit driver.

                You probably love computers and care about privacy, and you are shitting on regular users(assumption, admittedly) for not being invested.

                They had something that was working, you present noscript, thing no longer works. If you are not invested, how are you going to see the appeal of extra work?

              • pixelscript@lemm.ee
                link
                fedilink
                English
                arrow-up
                3
                ·
                3 months ago

                Well, you know what they say. You can lead a horse to water, but you can’t make it interested in learning about the water cycle to have a deeper understanding of why the river flows in the first place.

            • Buddahriffic@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              ·
              3 months ago

              I like the grid add-on for Firefox. It disables 3rd party pretty much anything by default. And you can control cookies separately from everything else, and I can’t remember any time I’ve needed to enable those cookies to get a site working properly (whereas sometimes you need to enable scripting, media, or iframe for cdn or something).

          • Prison Mike@links.hackliberty.org
            link
            fedilink
            English
            arrow-up
            10
            ·
            edit-2
            3 months ago

            I go hard with DNS-based ad blocking and I’m constantly confirming it works by checking the network tab in developer tools. I’m basically only seeing first party scripts and CDN assets — 99% of websites load all the tracking garbage from third-party domains that can be easily blocked.

          • MigratingtoLemmy@lemmy.world
            link
            fedilink
            English
            arrow-up
            4
            ·
            3 months ago

            uBlock origin + NoScript for me. I deal with the bigger umbrella of scripts with uBlock and then fine tune permissions to the ones that uBlock allowed with NoScript.

            They might be fingerprinting me using these two extensions though.

          • pmc@lemmy.blahaj.zone
            link
            fedilink
            English
            arrow-up
            2
            ·
            3 months ago

            I use LibreJS with few exceptions. If I need to use a site that requires non-free JavaScript, I’ll use a private browsing window or (preferably) Tor Browser.

        • Septimaeus@infosec.pub
          link
          fedilink
          English
          arrow-up
          9
          ·
          3 months ago

          Not all but most, yes. But TBF, sites that still function with JS disabled tend to have the least intrusive telemetry, and might pre-date big data altogether.

          Regardless, unless the extent of a page’s analytics is a “you are the #th visitor” counter, all countermeasures must remain active.

        • ngwoo@lemmy.world
          link
          fedilink
          English
          arrow-up
          7
          ·
          3 months ago

          It’s really strange how they specifically mention HTML5 canvas when you can run any fingerprinter test on the internet and see that Firefox does nothing to obfuscate that. You can run a test in Incognito mode, start a new session on a VPN, run another test, and on Firefox your fingerprint will be identical.

          • icydefiance@lemm.ee
            link
            fedilink
            English
            arrow-up
            3
            ·
            edit-2
            3 months ago

            Well yeah, they’re just blocking known fingerprinting services. If you use a tool that they don’t recognize, it’ll still work, but their approach will still block the big companies that can do the most harm with that data.

            The only alternative is probably to disable WebGL entirely, which isn’t a reasonable thing to do by default.

            • Venia Silente@lemm.ee
              link
              fedilink
              English
              arrow-up
              2
              ·
              3 months ago

              WebGL

              I wish Firefox had a per-site or per-domain preference for WebGL (as well as for wasm, etc), the same way we have per-site cookies or notifs preferences. It’d help clear most issues regarding this.

      • KairuByte@lemmy.dbzer0.com
        link
        fedilink
        English
        arrow-up
        8
        arrow-down
        1
        ·
        3 months ago

        Honestly would be hard to do. There a perfectly legitimate and everyday uses for pretty much everything used in fingerprinting. Taking them away or obscuring them in one way or another would break so much.

        • Justin@lemmy.jlh.name
          link
          fedilink
          English
          arrow-up
          15
          ·
          3 months ago

          Librewolf has Resist Fingerprinting which comes pretty far.

          Every Librewolf browser uses the same windows user agent, etc. But there are downsides, like time zones don’t work, and sites don’t use dark mode by default.

          And even then, EFF’s Cover Your Tracks site can still uniquely identify me, mainly through window size. That’s one of the reasons why Tor Browser uses letterboxing to make the window size consistent.

            • Justin@lemmy.jlh.name
              link
              fedilink
              English
              arrow-up
              1
              ·
              edit-2
              3 months ago

              Oh neat! I just tried it, and it seems it’s broken on Gnome when using 125% scaling though :/ Still cool to have the feature!

              I also just figured out how to expose dark mode and my timezone though with RFP, which is useful.

          • mitrosus@discuss.tchncs.de
            link
            fedilink
            English
            arrow-up
            3
            ·
            3 months ago

            I don’t know what letterboxing is. But if window size is used to identify me, can’t it be circumvented simply by using the window in restored size, and not maximised?

            • Venia Silente@lemm.ee
              link
              fedilink
              English
              arrow-up
              4
              ·
              3 months ago

              Your restored window size is even more unique than your maximised window size!

              The correct solution is to just not make the window size available to JS or to remotes at all. There’s no reason to ever need specifics on window size other than CSS media-queries, and those can be done via profiles.

              • mitrosus@discuss.tchncs.de
                link
                fedilink
                English
                arrow-up
                1
                ·
                3 months ago

                But the restored size keeps changing - can’t be profiled, right?

                And how do I not make the size available “to JS or to remote”?

                • Venia Silente@lemm.ee
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  3 months ago

                  Changing the source code of the browser, unfortunately. I don’t know what Tor Browser does or how, but basically you’d have to do about the same as they do.

  • ArchRecord@lemm.ee
    link
    fedilink
    English
    arrow-up
    308
    arrow-down
    1
    ·
    3 months ago

    For those who don’t care to read the full article:

    This basically just confines any cookies generated on a page, to just that page.

    So, instead of a cookie from, say, Facebook, being stored on site A, then requested for tracking purposes on site B, each individual site would be sent its own separate Facebook cookie, that only gets used on that site, preventing it from tracking you anywhere outside of the specific site you got it from in the first place.

    • peopleproblems@lemmy.world
      link
      fedilink
      English
      arrow-up
      207
      arrow-down
      2
      ·
      3 months ago

      Hahahahaha so it doesn’t break anything that still relies on cookies, but neuters the ability to share them.

      That’s awesome

      • ripcord@lemmy.world
        link
        fedilink
        English
        arrow-up
        60
        ·
        edit-2
        3 months ago

        Honestly, I thought that’s how it already worked.

        Edit: I think what I’m remembering is that you can define the cookies by site/domain, and restrict to just those. And normally would, for security reasons.

        But some asshole sites like Facebook are cookies that are world-readable for tracking, and this breaks that.

        Someone correct me if I got it wrong.

        • ArchRecord@lemm.ee
          link
          fedilink
          English
          arrow-up
          31
          ·
          3 months ago

          Total Cookie Protection was already a feature, (introduced on Feb 23st 2021) but it was only for people using Firefox’s Enhanced Tracking Protection (ETP) on strict mode.

          They had a less powerful third-party cookie blocking feature for users that didn’t have ETP on strict mode, that blocked third party cookies on specific block lists. (i.e. known tracking companies)

          This just expanded that original functionality, by making it happen on any domain, and have it be the default for all users, rather than an opt-in feature of Enhanced Tracking Protection.

          • ripcord@lemmy.world
            link
            fedilink
            English
            arrow-up
            9
            ·
            edit-2
            3 months ago

            That’s not what I was thinking of, which was even more fundamental. But that’s good info (and another way to cover stuff in the article).

            Edit: what I was thinking originally was really stupid, that 3rd-party cookies weren’t allowed at all. Which was really dumb since of course they are.

            • catloaf@lemm.ee
              link
              fedilink
              English
              arrow-up
              8
              ·
              3 months ago

              No, you weren’t far off. A single site can only get and set cookies on its domain. For example, joesblog.com can’t read your Facebook session cookie, because that would mean they could just steal your session and impersonate you.

              But third-party cookies are when joesblog.com has a Facebook like button on each post. Those resources are hosted by Facebook, and when your browser makes that request, it sends your Facebook cookies to Facebook. But this also lets Facebook know which page you’re visiting when you make that request, which is why people are upset.

              With this third-party cookie blocking, when you visit joesblog.com and it tries to load the Facebook like button, either the request or just the request’s cookies will be blocked.

              Although that raises an interesting question. Facebook is at facebook.com, but its resources are all hosted under fbcdn.com. Have they just already built their site to handle this? Maybe they just don’t strictly need your facebook.com cookies to load scripts, images, etc. from fbcdn.com.

        • Telorand@reddthat.com
          link
          fedilink
          English
          arrow-up
          26
          ·
          3 months ago

          They’ve been doing this with container tabs, so this must be the successor to that idea (I’m going to assume they’ll still have container tabs).