Hacker News Reader

Comment by randomwalker | Hacker News Reader

Personally I think there are so many of these APIs that for the browser to try to prevent the ability to fingerprint is putting the genie back in the bottle.

But there is one powerful step browsers can take: put stronger privacy protections into private browsing mode, even at the expense of some functionality. Firefox has taken steps in this direction https://blog.mozilla.org/blog/2015/11/03/firefox-now-offers-...

Traditionally all browsers viewed private browsing mode as protecting against local adversaries and not trackers / network adversaries, and in my opinion this was a mistake.

View on HN

Google has explicitly WontFix'd bugs on the subject of expanding incognito to be hardened against fingerprinting: https://bugs.chromium.org/p/chromium/issues/detail?id=142214...

Don't you think this sort of thing warrants a separate sort of browsing mode? A lot of people who use the likes of incognito mode just use it for e.g. browsing porn where they don't want the local history to be preserved.

Turning that mode into one that's highly hardened against fingerprinting would in practice ruin the browsing experience for those users. Just look at what the Tor browser needs to do with fixed preset resolutions, no JavaScript etc.

> Google has explicitly WontFix'd bugs on the subject of expanding incognito to be hardened against fingerprinting

Obviously. Google is in the business of destroying your privacy: Advertising revenue is maximized when the consumer is/remains completely tracked and profiled at all times.

Other browser vendors which are not in the ad business could use this as an opportunity to differentiate themselves from Google:

Introduce a 3rd browsing mode which kills fingerprinting (with the "cost" of reduced user friendliness).

Or just let the user decide at the start of a private session. Firefox already does this with tracking protection. If Mozilla decides to improve tracking protection at the cost of usability (such as hiding you preferred language), than offering that as a toggle-able option on that page might be sufficient to empower the user to decide for on his own.

> offering that as a toggle-able option on that page might be sufficient

Technically speaking yes.

From a marketing/communication standpoint, I would separate this "feature" clearly from the 2 known browsing experiences. It not only clearly communicates to the user that a different browsing experience is about to start. By selling it as "the third browsing mode", it definitely also adds more perceived value to the product.

Google already has that info without these hacks.

In fact it is in googles best interest to remove these security holes so other advertisers lose whatever minor advantage they can get.

> Don't you think this sort of thing warrants a separate sort of browsing mode? A lot of people who use the likes of incognito mode just use it for e.g. browsing porn where they don't want the local history to be preserved.

Think about it this way, would those using incognito mode for porn be OK with their normal browsing being peppered with ads claiming to "Improve your <fetish> with our range of <sexual implements>"?

Whilst I think incognito mode's warnings about not hiding data from network operators should remain (i.e. your boss can find out what sites you were visiting at work), that doesn't mean efforts to prevent it shouldn't be made.

> there are so many of these APIs that for the browser to try to prevent the ability to fingerprint is putting the genie back in the bottle.

I disagree. If there were billions to be made from this new tech, secure browsing, then the browser vendors would be moving rapidly toward it. Certainly, more difficult technical challenges are overcome regularly.

Surveillance was implemented without users' knowledge and without public debate, presented as a fait accompli, and now the latest tactic is to say there's nothing that can be done about it. People accept that because they feel helpless, but I don't think we should be perpetuating this rhetoric of inevitiability. There's no technical reason it can't be done.

That's not effective, because very few people use private mode.

Reply on news.ycombinator.com