Hacker News Reader

Hacker News

Comment by OMGWTF | Hacker News Reader

Parent Full thread

OMGWTF

This website wants to know your screen resolution. [allow] [deny]

This website wants to know the list of fonts installed on your system [allow] [deny]

This website wants to access your location. [allow] [deny]

This website wants to use the css attribute a:visited [allow] [deny]

This website wants to record more than 1 mouse event per second. [allow] [deny]

This website wants to read your battery status. [allow] [deny]

This website wants to disable your ad blocker. [allow] [deny]

This website wants to know your timezone. [allow] [deny]

This website wants to know your device temperature. [allow] [deny]

This website wants to open more permission requests. [allow] [deny]

View on HN

You're exactly right that this would be incredibly annoying, but I think that should be the point. 99% of sites have no business accessing a lot of that stuff and popping up warnings every time they try to would make it a whole lot more obvious when a site is taking advantage of your personal data.

Popups like this act kind of like side effect disclaimers in pharmaceutical advertisements. The ad tries to gloss over them as quickly as possible because they're confusing and scary to the potential customers - for good reason! It's annoying to have to hear that list of crazy side effects in every commercial, but it serves a purpose and it would be a mistake to remove it in the name of "convenience".

> 99% of sites have no business accessing a lot of that stuff and popping up warnings every time they try to would make it a whole lot more obvious when a site is taking advantage of your personal data.

I agree, sites should not have access to that data. I would prefer if those features would be removed again instead of introducing more popups.

As a side note, I've often noticed that the disclaimers in the pharmaceutical advertisements state the side effects in a slow, calm voice while the actor calmly walks though an abstract world which functions as a metaphor for living with the disease in question. In the end, the effect is that the listener stops paying attention to the words being said. The speed reading of the disclaimer is especially prevalent other types of advertisements though.

Right, and I can see times when I'd really prefer this behavior. Especially in incognito mode. But let's say at worst case we could categorize those or allow a settings page where I could switch these to opt-in-by-hostname/opt-out-by-hostname.

Try using the uMatrix browser plugin for fine grained control of what external scripts/frames/etc a website may request.

I'm using it (along with uBlock Origin, EFF Privacy Badger and custom Tampermonkey scripts), and while I like the sense of control, I also think it's obvious that fine grained control for such details or further details like battery status is not what most users want or even could handle.

Sometimes it becomes really annoying and I give up on figuring out what minimal set of features a site needs, and I open it in an incognito tab where only uBlock Origin is active.

I run uMatrix too and I agree it gets annoying at times (and it gives you first-hand insight into how rotten the web industry is). That said, pretty much all the stuff from your comment upthread are things 99% of websites have no business accessing. So an uMatrix-like (default-deny) control for permissions should work well IMO, with only occasional cases when you need to whitelist something.

I'm also thinking about another kind of plugin - one that simply monitors access to browser API calls required to get information like resolution, mouse pointer position, battery level, etc. and that would display you only the "spying level" of a site as an icon. Like the padlock icon, changing colors from green to yellow to red or something, and that would expand when clicked to show something like this:

  Spying level: MODERATE.

  This website has accessed following information about your system:

  - screen resolution - 256 requests
  - mouse pointer position - 8192 requests
  - location - 42 requests
  - battery level - 16 requests

  [CLICK] to send an e-mail to webmaster (webmaster@example.com) asking for
  information about how they're using your data.

I'm not sure if current plugin infrastructure has enough power to hook JS APIs like that though.

What about being able to say "Block everything" or "Allow everything", and allow the user to default to one or the other.

I would find it weird if a random blog or ecommerce website wanted to know my battery level or device temperature, but frequently I can only block them finding out by blocking JavaScript entirely, and that often means the site doesn't work at all. So I'm caught between giving them access to all sorts of stuff which they can use to identify for me (and I have no idea whether they're doing that or not), or not using the site at all.

It would be nice to be able to say "let the site execute JavaScript, but don't give access to my machine or OS data".

This would cause site designers to consider if they really need the access (they don't). Problem is, as soon as one browser stops asking, the idiots would flock to it and site designers will stop supporting the good browsers.

None of those things are what a typical website has any business accessing. Even the screen resolution for responsive layouts could (should) presumably be handled by correct application of CSS.

Reply on news.ycombinator.com