← Back to context

Comment by tmtvl

1 day ago

I'm already using CanvasBlocker, Decentraleyes, and the NoScript Security Suite; but getting more protections will be nice. Even if it may take a while for them to land in Waterfox.

15 comments

tmtvl

Reply
hku333  15 hours ago

You are actually easier to track using these addons.

By installing Canvasblocker, Decentraleyes and NoScript you are providing more entropy to trackers and thus making it easier to track you. Imagine how many people worldwide block specifically Canvas, have weird looking network requests to certain js libs and have JS disabled for some (/all) scripts combined with your general setup (window size, font size, and many other factors that do not even require JS).

The Tor project explicitly suggests to not install an adblocker for example because of this.

  • pmontra  6 hours ago

    I more or less use those addons (uMatrix instead of NoScript) plus uBlock Origin. uMatrix doesn't load a large number of JS files. An example from an ecommerce site I'm browsing right now: the site is functional (at least in browsing mode) without the scripts from

        bigcommerce.com
    classyschema.org
    doofinder.com
    elfsightcdn.com
    google.com
    grit.software
    gstatic.com
    hexgator.com
    klarna.com
    skeepers.io
    criteo.com
    googletagmanager.com

    It needs only the JS from the first party domain. So they can track me from there but all the other guys don't know about me, unless they buy data from the first party. At least they have to do more work.

    I also don't get advertising in any form, maybe because I don't have ecommerce apps on my phone and I block a lot of things with Blockada, but that's another story.

    • skydhash  6 hours ago

      I don’t really mind first party telemetry. I’m already interacting with the sites, so they can build a nice profile if they want too. But my pet peeves are loads of non functional JS and not having an html render for web content for a non app website.

  • someothherguyy  5 hours ago

    > (window size, font size, and many other factors that do not even require JS

    Yeah, they require CSS, which you can also block using noscript and other tools, if you want.

    Also, while you might be more "trackable" to those who fingerprint, if you are blocking those cross origin or same origin scripts from loading you are already stopping some of that. You can even blacklist some known hosts completely in your browser's policy settings and prevent those requests from ever reaching their destination.

  • tmtvl  6 hours ago

    Without an ad blocker and JavaScript blocker the average website would be 100GB in size and take several years to load. If I really cared about tracking protection I would just not use the regular internet and stick to Gemini. CanvasBlocker is just because the Tor browser itself has one implemented (source: <https://2019.www.torproject.org/projects/torbrowser/design/#...>) so I figured I might as well.

  • unethical_ban  6 hours ago

    There has to be a happy middle between "no protection" and "complete uniqueness"

    The web without ad blocking is revolting. Browsers building in these features makes them more popular.

    Aside: Fuck the Washington Post. They have a line in their privacy policy that acknowledges the existence of "Do Not Track" flags in browsers. Their acknowledgement: since there is no industry standard for responding to it, they ignore it.

ravenstine  1 day ago

How is your browsing experience with that stuff? I used to go nuts with anti-tracking measures, but enough of my browsing experience kept breaking that it just didn't feel worth it.

  • pmontra  6 hours ago

    My experience with uMatrix: most sites work right away. Others require fiddling with the matrix of media, script, xhr, frames and the third parties serving them. After a while it's easy to remember which ones must be temporary enabled and which ones don't. Sites with videos are a little more difficult. Sites with payments require care. I whitelist the minimum set of scripts that make the sites I use often work. There are usually many scripts that can be left out. If everything fails and it's a one shot site, I start Chrome.

  • tmtvl  11 hours ago

    It's fine. Sometimes I get annoyed by websites which require JavaScript to show static text (apparently HTML is too difficult?) or which block me with a 'please unblock challenges.cloudflare.com to proceed' (that second one seriously pisses me off when I see it on, for example, the website of the Belgian railways), but by and large I'm fine with just saying 'if it breaks I don't need it'. But I handle my e-mail with isync, mu, and mu4e; and as far as I understand e-mail tends to be a sticking point for those who care for their digital rights. I also don't have Xitter or Facebook or any of that nonsense.

    If there's one thing I don't like its the fact that NoScript doesn't integrate with Multi-Account Containers. It would be neat if instead of having to temporarily allow GitHub JavaScript and re-disable it when I'm done; I could just allow GH JS in a GitHub or Microsoft container and it only being enabled in that container.

    • skydhash  6 hours ago

      Libraries documentation that requires javascript to load is the lowest of the bunch in my opinion.

  • MathMonkeyMan  20 hours ago

    I use LibreWolf at work, and I exempt most internal sites from aggressive anti-tracking stuff, but otherwise it works fine.