Cover Your Tracks
eff.org
eff.org
How does one actually make themselves non-unique?
And can we make things more transparent? How many bits is enough?
Turning off javascript is a very good thing to do. The more people that do it, the stronger a protection it will be.
Random browsing => no javascript.
Play a browser game => javascript.
I have this today with Flash, would be nice to have it for all client-side code execution.
It's gotten a lot more annoying the last several years with 5mb webpages. Backing up the whitelist saves a lot of time.
For perspective, I use 4 separate profiles (--user-data-dir) listed in descending order of how annoying they are for me to use.
1). School browser: Chrome + uBlock origin
2). Shopping/low security (when the payment processor is an iFrame and I don't want to refresh...): Firefox + uBlock origin + CanvasBlocker
3). General browsing like browsing Google or YouTube: Chrome + uBlock Origin + uMatrix
4). VPN browser: Chrome + uBlock origin + uMatrix + CookieAutoDelete + VPN extension
I've gone from 2 browsers (Firefox + IE6) to 4 browsers (Firefox, Chrome1, Chrome2, Chrome3). By 2030 I'll be running 16 browsers in a virtual machine on a remote server that I connect to with my browser browser.
[0] https://www.ghacks.net/2020/09/20/umatrix-development-has-en...
[1] http://forums.mozillazine.org/viewtopic.php?f=38&t=368230 (2006)
No updates is not necessarily a bad thing. Sometimes things work well enough to leave alone.
uBlock Origin solves this in two clicks. WFM.
> Your browser fingerprint appears to be unique among the 2xx,xxx tested in the past 45 days.
> Currently, we estimate that your browser has a fingerprint that conveys at least 18.xx bits of identifying information.
Biggest offenders: USER AGENT and HTTP_ACCEPT HEADERS. Especially the USER AGENT is crazy, 9 digit browser version to everyone who asks?!
Sadly, this is of limited use. Defense against fingerprinting is like herd immunity. If everybody else already has a unique fingerprint, there is not much an individual can do to avoid being uniquely identified as well. At most one can spoof one other unique individual. Plus the EFF recommendation is 'latest Chrome on Windows' which is a moving target.
Would be nice if the EFF site in OP would recommend an agent id to spoof to, at least that would help building a small, but non trivial herd of indistinguishable users. And then a popular extension like uBlock Origin would track this agent id and set it by default for all its users.
Edit: list of top UAs:
https://techblog.willshouse.com/2012/01/03/most-common-user-...
privacy.resistFingerprinting = 1
Brave does this.
I honestly could not live without it. At this point I have pretty much every news and recipe site on the internet blocked. Visiting a new site, as soon as I hear my fan spinning up I reach for the "no-JS" button and the page suddenly becomes responsive again.
I'm not quite to the "no JS as default" level but I'm close.
Google themselves admited they are an ad company rather than a search engine company. Why use a browser by a company where their main revenues are ads.
I am tempted to use Firefox more to avoid browser monoculture. But Chrome pretty much just works.
Yes. This is why it would ideally be done by the browser, not by individuals. If Safari reported only its top-level version number (and only exposed the installed-by-default fonts, and so on) then millions of others would suddenly look like me.
I wonder what already exists like this?
It's highly unlikely I'm going to do anything with this thought, but if I do I think I'll call it Lignin, after the complex structural compound in plants that no organism was able to digest for the first 60 million years after its appearance.
https://en.wikipedia.org/wiki/Lignin
(I'm going to go read about mcgovern now.)
Its like if I were an analyst at a national security TLA, I’d treat TOR traffic as a big red “look at me!!!” flashing light. Sure, you _might_ be using TOR to anonymously report a pot hole to your local authorities, but you’re _way_ more likely than average to be doing something the government has “a war on”. (So as an analyst I’d assume you’re involved in drugs, terrorism, child abuse, or insisting on government accountability.)
You probably don’t want “a library of garbage”, you probably want something a little smarter that breaks all your traffic into totally plausible “normal looking” traffic but with each stream (browser tab/website pair I guess in this context) looking like a different but totally “normal” session. So your HN session looks like a totally stock Win10 Edge browser session, but when you click over to (or open a tab to) eff.org, it changes to maybe a SamsungS20 session, and when you flip somewhere like NYT - all the page loads and the hundreds of tracking pixels all see what looks like a macOS Safari session.
Do-able, I think, but more complex that simple “garbage” traffic. Needs stateful session inspection so it could do things like stripping referred headers when you change top level sites/urls, while sending them normally to image/xhr/tracking URL calls from within a site.
Even without any political interference "War is a racket"! ( https://en.wikipedia.org/wiki/War_Is_a_Racket )
1. https://www.thegreatcoursesdaily.com/synarchist-conspiracy-i...
And sure, N is pretty big for popular websites. But the less popular the site, the less it holds up.
Tor is about the most effective thing we have, but I'm not sure "really effective" is fair. It gets the job done sometimes, but it also leaves a lot to be desired.
Still, I'm grateful Tor exists.
Is there anything else that makes it not really effective?
I've never seen that message before, but that would explain why it always opens up 'windowed'.
[1] https://trac.torproject.org/projects/tor/ticket/31059 [2] https://blog.torproject.org/new-release-tor-browser-90
Firefox comes close with uBlock, NoScript, privacy.resistFingerprinting, and strict privacy settings
They promised that the tech would always give a stable and unique id from the browser. And it worked too, but it wasn't public and not for ad tech purposes.
How would you defend against that profiling tech?
I have a POWER9 desktop, and a fair share of other users do so for privacy/security concerns, pretty hardcore Tor browser guys and the like. I've mentioned before that fingerprinting firefox on ppc64le would be very easy because of timing the non-JIT'd JS engine. I guess there's potential for much more specific fingerprinting.
Brave, piehole, ubuntu, custom desktop computer. I didn't even disable javascript.
Besides that, Tor browser is really your only option.
We're in so deep it will take years to reverse fingerprinting vectors. If it's even possible
So while Chrome is such a dominant browser? No. It’s not gonna happen. Google will keep writing “inadvertent errors” that exempt their own tracking cookies from user instructions to delete them.
The EFF site showed two fingerprint ids that were completely unique for my browser: window size (because of my dock) and the http-accept headers (because of my language selection). That's with FFs fingerprint-resist option enabled. Chameleon can spoof those, which is great, and it gives access to the fingerprinting option which I think FF does not expose properly outside of about:config. So it should greatly reduce my identifiablity, but according to the site it does not help much, even if the specific categories are now almost unique. Like they explain, the combination seems to be the problem, or maybe they are not exposing the category that gets me.
Edit: Okay. The solution seems to be: Chameleon with most of the options enabled, so as much spoofing as possible, but without activating FF's fingerprint-resist option. Probably sending no data is worse than sending spoofed data!
+ Ublock of course.
It's basically a virtualbox VM that you run a browser inside of.
No, it's not really practical. But yes, it works. If you're doing nefarious things, that's probably the #1 thing you should use.
Various privacy trackers also block fingerprinting code.
If you need a new hobby, uBlock Matrix is the hard way to block most fingerprinting.
"All you need to do is pick up this abandoned github project, fork it, fix all the outstanding show stopper issues, bring it up to date with advances in browsers since it was last regularly maintained, and add in my own personal must face feature! Bob's your uncle! The you just need to avoid whatever inevitability it was that caused the previous maintainer to abandon it, deal with the usual crowd of self entitled and demanding-to-the-point-of-abuse users who refuse to contribute pull requests or money, and worry about tremendously overreaching to the point of fraudulent DMCA or patent lawsuits and having GitHub roll over to the RIAA or whoever doesn't like what other people use the code to do."
:sigh:
Instead of asking "How do we become "non-unique""?
We could ask "How do we send less data to the parties who want to do tracking?"
For example,
User A sends 2-3 HTTP headers, the bare minimum, e.g., Host, Connection, maybe User-Agent or Cookie in some instances if required. User A has disabled Javascript unless she needs it.
User B sends a potentially unlimited number of HTTP headers (User B does not care to control the headers she sends, she just leaves that to the applications). User B leaves Javascript enabled regardless of whether it is needed.
Each user may be "unique", with sufficient effort from the party doing tracking, but there's an argument that User A is less interesting to the tracking parties than User B. Both users have footprints, both can be tracked, but one is sending much more data to the trackers than the other. She's leaving more detailed tracks, so to speak. User A is leaving a more generic footprint.
There is also an argument that finding "uniqueness" among a large group of "User B's" would be easier than amongst a large group of "User A's". If we were trying to achieve the impossible goal of "non-uniqueness" it would arguably be easier to try to have all users appear to be identical to User A than trying to get all users to match User B what with all the additional potential variables User B presents thanks to uncontrolled HTTP headers and Javascript's access to her computer's resources (and all the potential issues and "options" that raises).
The question is how to do it tho, because some things might actually be useful: if your browser tells the site you prefer dark themes the site can react and display your prefered color scheme. If the browser tells the site how big your viewport is it can give you a site that fills that viewport neatly — and if the site can do these useful things it can also track you using that info.
I think it’s less true if you’re trying to play a game, look over a complex dataset, do high-end image previewing, maybe host a multi-party video conference, or other highly interactive application in a web browser (for user convenience and, to some extent, because users semi-reasonably trust browsers more than random app downloads).
User A makes a single request to download bulk DNS data or Wikipedia content, then makes it available on her loopback or local network.
User B makes a series of DNS queries for specific RR's or HTTP requests for specific Wikipedia pages.
How do the behavioural fingerprints of User A and User B compare?
Trackers generally cannot see the individual DNS queries or HTTP requests for Wikipedia pages that User A makes over her loopback or to addresses on her local network. However all of User B's individual DNS queries and HTTP requests, including timings and context, are easily visible to a variety of trackers operating on the internet.
We should agree on common set of absolutely minimal necessary data (User agent, supported fonts, screen resolution and DPI if Javascript can probe those, etc) and then ALL run with the same, except on the very few sites one truly needs and which don't work with this bare minimum for some (hopefully valid!) technical reason.
We could actually package all of this into an addon or a simple recipe of settings. I'm not knowledgeable enough to pull such an effort with absolute certainty that nothing gets forgotten, but if someone does, I'd suggest "V for Vendetta" as a name, as it reminds me of the 5th of November scene.
There is actually no technical reason that an HTTP request needs to be any more than
GET / HTTP/1.0
There is no reason that the Firefox or Safari developers couldn't decide in the next version to send only bare minimal request headers.
> nc news.ycombinator.com 80
GET / HTTP/1.0
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 21 Nov 2020 13:59:31 GMT
Content-Type: text/html
Content-Length: 178
Connection: close
Location: https://news.ycombinator.com/ > openssl s_client -connect news.ycombinator.com:443
GET / HTTP/1.0
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 21 Nov 2020 17:25:28 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Vary: Accept-Encoding
Cache-Control: private; max-age=0
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Referrer-Policy: origin
Strict-Transport-Security: max-age=31556900
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://cdnjs.cloudflare.com/; frame-src 'self' https://www.google.com/recaptcha/; style-src 'self' 'unsafe-inline'
<html lang="en" op="news"><head><meta name="referrer" content="origin"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link rel="stylesheet" type="text/css" href="news.css?jacyibSTLtogl89kgrgw">
<link rel="shortcut icon" href="favicon.ico">
<link rel="alternate" type="application/rss+xml" title="RSS" href="rss">
<title>Hacker News</title>All that additional crud has probably contributed to the "relative ease" of conducting tracking as well as the "richness" of the data one can gather from tracking. Why should we ignore this simple fact.
The people behind these browers, especially Mozilla, keep assuring the public they are working to protect user privacy. This may be true to some extent but what they are not telling the public is how they are working to ensure the online advertsing industry continues to thrive, i.e., how they are working to ensure they do not upset the status quo. The words do not match the actions.
I would not rely on the browser developers to address this problem. To experiment with how well minimalism works on today's web, one can use alternative HTTP clients that allow control over headers and/or one can use a forward proxy one can remove/modify headers generated by the browser.
The basic principle of information theory is that these two things are exactly the same. There is no "correspondence" between them, they are one and the same thing. The amount of information that you send is, by definition, the measure of how unique it is.
I don't see how your reasoning about sending more or fewer headers fits into this; but anyhow the conclusion won't depend at all on the amount or the length of the headers, but on how many people are sending the same headers as you. It is impossible to know how much information are you sending by only looking at the bytes you send. You need to know the worldwide distribution of headers to measure that.
Your interpretation, which I think is correct in this context, seems to be with regard to the entropy of a probability distribution over internet users, and the mutual information between that and the distribution over messages. The actual length of the message is irrelevant to the math once you fix the joint probability distribution.
The argument others seem to be making is that the joint probability distribution is in fact not fixed, and that you can smear out the conditional probability over users given a message by shrinking the space of possible messages. In theory that seems possible, but I don't know enough to have any idea how well that would work in practice. If you shrank the message space to be small enough to be useful for this purpose, wouldn't that get in the way of usability?
This is not "my" interpretation, it's the standard definition of information content in computer science, as given [1] by Shannon in 1948 and used by everybody since.
[1] https://en.wikipedia.org/wiki/A_Mathematical_Theory_of_Commu...
Define the random variables M for message content and U for the identity of the user. The interpretation of "bits of information" that most people will have is H(M). The correct interpretation in this context is H(U). You seem to be confused about why people are talking about H(M) instead of H(U). But I think people correctly intuit that those aren't independent, so the mutual information I(U;M) = H(U) - H(U|M) is positive. And obviously if you change P(M), you will also change the amount of mutual information. That's why talking about sending fewer headers makes sense.
Actually, let's look at a different solution up the same vein, how does someone become NOT themselves? I think that right now it's less about how to blend in, and more about how to swap identifying features.
What about a pool of users, like a vpn, except the pool exercises identifiable information swapping!
Though this is highly desirable, for a guy like me who is rather paranoid I'm not going to worry too much. I disable js and block lots of sites (based on MVPS but also my own personal list - anything that gets through gets put into my personal list). After that, I don't care too much if they track me cos they aren't getting bugger all useful - if everyone did that, what market would be left for advertisers?
I'll still read more of the article and try to close more holes, but perhaps a 95% solution is sufficient? What do you think?
Especially the fonts installed was very interesting and I hadn't thought of that before. The JS just iterates over thousands of known fonts in a div/span and sees if the browser can render it to build a list. It's enough that you've installed a single uncommon font and together with everything else you suddenly became unique just by that.
You're not going to block all of these "dynamic" prints just by changing browser or installing a single plugin. Even if you run in a VM, unless you actually flush and reinstall that VM every session, you're eventually going to amass customizations inside the VM that can be fingerprinted.. :/
Yet CoverYourTracks says that even my up to date Chrome User Agent is used by one in 223 browsers, which sounds hard to believe.
I haven't tested it much myself, but I suspect there's a lot to unpack here.
There's ways to do it with virtualbox and qemu as well by setting the disks to the same ephemeral style.
https://web.archive.org/web/20180714043311/https://iotdarwin...
crucial bit is to blend into the crowd instead of standing out (the paradox is the harder we try to mitigate on a technical level the more we'll stick out). instead use hardware compartmentalization, pseudonymous identities (not anonymous ones) and focus on operational techniques (modify your behavior). technology can be a means but often it is just part of a strategy. (e.g. instead of "let's encrypt all the comms" why not eliminating some comms altogether - no need to worry about data that doesn't get stored in the first place etc)
1. TOR browser on Safest setting
2. Firefox using the strictest privacy settings except allowing 1st party cookies, and using Private Browsing; toggling privacy.resistFingeprinting to True in about:config; and using the uBlock and NoScript add-ons
These were successful on both desktop and mobile (except iOS)
Edit: removed typo.
> Our tests indicate that you have you have strong protection against Web tracking, though your software isn’t checking for Do Not Track policies.
> Unblocking 3rd parties that honor Do Not Track? ..... No [marked in red, as if this were a bad thing]
Are they suggesting that I unblock trackers when the provider posts a text file pinky swearing that they honor a do-not-track policy?
This smells like another "acceptable ads" program.
More like it gave advertisers an excuse to get that tracking data they had been salivating over.
> DNT is essentially acknowledging that a 3rd-party is the one in control of your privacy in the 1st place, and you have to resort to asking this 3rd-party -- which has financial (or whatever) interests in tracking you -- to not track/data mine you, and trusting that they respect your wish, with no way for you to find out whether your request is respected. In short, it's BS, and supporting tracking/data mining is agreeing that tracking/data mining is the natural, expected behavior and thus an opt-out "feature".
> Nobody should ever agree to this.
> I see it differently: tracking is opt-in, and the ideal is that users are in full control of their privacy by default. Those who want to track/data mine you should ask you to opt-in, along with all the detailed information of how the data collated from you will be used and monetized (lists all entities to which your data is sold), in the spirit of informed consent.
> Currently the way for users to enforce their privacy choice is to use all the tools at their disposal to prevent their data from ending up in the hands of the trackers/data miners, and DNT is not one of these tools.
https://github.com/gorhill/uBlock/issues/827#issuecomment-15...
https://www.macrumors.com/2019/02/06/apple-removes-safari-do...
Do Not Track is an EFF program - it's not surprising that their tools are going to push it.
See https://www.eff.org/pages/understanding-effs-do-not-track-po...
The EFF seems to essentially be an extension of the Silicon Valley business model - it's like the notices at casinos giving a number to call if you have a gambling problem. They're not going to address the underlying issues, but they'll offer some ineffective band aids for them.
Take Canvas fingerprints. If you added a bit of randomness to how the browser renders pixels, the fingerprint would change each time you measured it. It would still be unique, but it would be a useless tracking tool.
Presumably I'm not the first person to come up with this, is there a reason it isn't done?
There's more info here if you're curious: https://brave.com/privacy-updates-4/
Here is Brave's take: https://brave.com/brave-fingerprinting-and-privacy-budgets/
https://github.com/arkenfox/user.js/wiki/4.1-Extensions#smal...
Notably, to me this isn't necessarily about beating the resistFingerprints setting, because I can't use that setting. For good or for ill, it breaks too much of the web.
Literally the first bullet
>It is trivial to detect RFP and when you change a RFP metric, you lose your "herd immunity"
having a randomized fingerprint is a fingerprint value in and of itself. That may leak more entropy bits if you have a fairly common hardware configuration
Also, regarding webaudio fingerprinting, afaik it's not a real threat.
https://github.com/WebAudio/web-audio-api/pull/2224#discussi...
https://github.com/w3cping/tracking-issues/issues/53#issueco...
>As I said, I can't use RFP, it breaks too many sites.
Weird. I only know a few sites that break with RFP on, and I don't use them frequently.
that doesn't work because the sites can just take multiple samples and average the results.
They basically fuzz (randomize) the timing precision that you can do, so you can't use timing to leak information across 2 different processes.
>"As of Firefox 57.0.4, Mozilla was reducing the resolution of JavaScript timers to help prevent timing attacks, with additional work on time-fuzzing techniques planned for future releases."
https://en.m.wikipedia.org/wiki/Spectre_(security_vulnerabil...
Maybe similar tactics could help prevent finger-printing!
I found a heavily obfuscated script on the webpage of my cellphone data provider which I initially thought was a credit-card skimmer.
After several rounds of de-obfuscation and beautification it turned out to be some really intensive tracking and fingerprinting script from Akamai.
It used every single fingerprinting technique imaginable from pixels, cookies, webgl, webrtc, flash, vector drawings etc etc.
https://www.theregister.com/2019/07/17/exmicrosoft_engineer_...
"Although it is physically impossible for the single guard to observe all the inmates' cells at once, the fact that the inmates cannot know when they are being watched means that they are motivated to act as though they are being watched at all times."
The parallels between the Internet/modern security state and the Panopticon design are obvious.
Sometimes you just don’t want to have to try to win that argument.
"Move to strike that so-called "evidence," your honor. It is irrelevant and thus inadmissible, because "Cover Your Tracks" is the name of a website that tells users whether their computers appear unique to advertising companies. Not to mention that the EFF regularly files friend-of-the-court briefs with the Supreme Court and is a trustworthy nonprofit dedicated to keeping the internet safe and fair."
Juries are made of regular people. The overwhelming majority of households in the USA have broadband internet. Regular people understand that advertisers track internet users in order to sell more ads.
Also, scare-mongering and preying on someone's lack of familiarity with a website is only useful when there isn't someone else present to quickly explain it to them.
https://www.vanityfair.com/news/2013/09/michael-lewis-goldma...
Protecting yourself against some scripts is easy and convenient with uBlock Origin. Tracking by URLs can be handled by ClearURLs. Cookies are easy to address with containers, ideally temporary ones with per domain isolation. IP tracking can be addressed partially using a VPN or Tor.
But fingerprinting is hard. Some Tor browser configurations go as far as fixing the window size. Things like timezone, user agent or available fonts leak a lot of unique information. Any simple setup that doesn't have too many caveats?
Everything, everywhere there's a "human" captcha waiting for You. Sometimes I have to do the challenges 3 or more times. There's opportunities that even after a 4th attempt it just doesn't work.
"uncover" is the right word: the hostility towards anonymous users was already there.
We should boycott such sites.
I would like to dispute this. It is easy to detect when a user is spoofing certain settings. As such, randomizing fingerprint data increases entropy, making your browser more unique, not less. There is a reason why the Tor browser works so hard to make sure every user has the same fingerprint, rather than randomizing it.
More on that here: https://github.com/arkenfox/user.js/wiki/4.1-Extensions#smal...
If you browse website A and website B, with different randomised qualities at different times, and your non-randomised data isn't enough to sufficiently identify you, then although A and B might be able to identify that you're spoofing certain settings, they can't identify that you're the same entity browsing both websites.
If you just set things to a weird or unlikely value, then you're as identifiable as a man who walks down the street in a mascot uniform that he never takes off. That is to say, although they don't know the 'person' behind the mask, all you need to look for is the dingus wearing the capital city goofball costume. Indeed, it makes you stand out more...
Indeed as long as browsers need to send actual information for successful implementation of whatever it is the website is doing, the potential for fingerprinting still exists. And as long as there are sufficiently non-random properties of the computer for the theoretical attacker to poll (via whatever mechanism they can), then fingerprinting will be a viable mechanism.
Although as EFF points out, if MOST of the identifier obtainers require Javascript or connections to certain URLs to work, it might be that blocking javascript and URL blockers might be sufficient to stop most of them in practice?
Edit: of course, every time I say theory and practice here we run into problems of how much people are willing to do or put up with in practice...
Nearly everyone would have the same fingerprints even down to the browser resolution, root CA lists, installed fonts, etc. The only real difference being the sites you visit.
One in x browsers have this value:290162.0
I guess it's near-impossible to get the features of accept-language without fingerprinting you :-/ but why does js need to know what fonts I have?
The only thing that could make me stand out is if I deviate from this basic setup and use different browsers on weird connections like a VPN (Yes - a VPN can make you stand out). Also: upgrading my phone to the latest model is probably an uncommon practice and used as another heuristic to track you, & I've heard many people like to stick to a certain phone model until it starts acting up.
[0] https://developer.apple.com/documentation/adsupport/asidenti...
Unique fingerprint is really interesting upon enabling first party js. Fonts and gpu give lots of unique information.
Dont get the message to unblock ad providers that follow DNT. This trust is too easily betrayed.
chrome w/ privacy badger: unique fingerprint
firefox w/ privacy badger: unique fingerprint
safari 14: nearly unique
Brave is a force for good.
https://github.com/arkenfox/user.js/wiki/4.1-Extensions#smal...
> remember: very, very, very few users use anti-fingerprinting measures
At this point, Brave has 20-million-something monthly users, all of whom have fingerprint randomization enabled by default. Randomization definitely makes an individual stand out if nobody else is doing it, but it makes it almost impossible to distinguish from others using the same technique.
I'm using swaywm, so maybe this is an (unintentional?) feature of wayland.
> Within our dataset of several hundred thousand visitors tested in the past 45 days, only one in 71131.0 browsers have the same fingerprint as yours.
> Currently, we estimate that your browser has a fingerprint that conveys 16.12 bits of identifying information.
I don't fully understand the WebGL fingerprinting stuff- why is it different on the same device model?
To me they are completely separate and although Brave has had privacy missteps, all browser vendors have. I believe in the leadership (Brendan Eich, creator of JavaScript) more than the leadership of any other browser vendor. I believe Brendan eats his own dog food.
I reported the issue at the time but they said the won't fix it since they were moving away from brave-laptop. They still had issues[1] clearing forms of local storage year later. They are not taking privacy seriously.
They also took crypto from users under the false pretense of taking payment on behalf of content creators[2].
[1] https://github.com/brave/brave-browser/issues/9929
[2] https://en.wikipedia.org/w/index.php?title=Brave_(web_browse...
the banks registers it and turns out the vast majority of money does only "one cycle" ie. from the bank to a (known) consumer/customer, to a shop/cashier and then back to the bank. so "they" already know were you spent it.
but statistics give a reasonable good picture given the fact that the input/output points of the banking system are known.
Granted more and more shops now have machines that count all bills and change automatically and per transaction, under the guise of convenience and increased security towards theft or robbery. In the mean time, the notes may have travelled from hand-to-hand in a long chain that is completely shrouded in a dark—if not entirely black—economy that neither the bank nor the state can ever hope to fully track.
That all changes with the advent of a fully digital system, especially if all transactions are sanctioned to be within that system by force of law. Which is exactly what the banks are pushing for, with various scares such as claims of the danger of money laundering, corruption, and so on. What they systematically fail to add, however, is how they themselves gain the ability to track full markets, and make sure-fire investments based upon surplus data gleanded from aggregating private purchases and trades, thus ensuring their full control over said market.
Meanwhile they can use that same power to effectively shut down all opposition—and anyone who protests their actions—simply by finding a reason to freeze their accounts, just like they did to Julian Assange.[1] Thereby they get the power to effectively keep individuals they dislike from accessing the entire economy, unless perhaps they own some diamonds or a valuable goat... This has in turn given precedence to other financial institutions to shut down accounts or memberships based upon political affilations, such as is the case with Patreon, or because they somehow are construed to be in a competing position.
As an example, a Norwegian crypto trader has effectively been barred by all the banks in Norway to get a business account.[2] The reasons given were vague claims that his completely legal business somehow supported nefarious and evil individuals who all wish to undertake in money laundering, without offering any solid evidence for it. However the banks all failed to mention that his business can in many ways be seen as being in direct competition with their own business model, namely that of manual and middle-man-laden banking. In any case, for all intents and purposes, Bitcoin transactions are far easier to track than bank notes.
[1]: https://www.forbes.com/sites/andygreenberg/2010/12/07/visa-m...
[2]: Norwegian language article: https://e24.no/naeringsliv/i/oRgdW0/dn-bitcoin-toppen-tapte-...
According to some footnotes in Shoshana Zuboff's book, the FTC was on the path to ban these practices in 2001 but then 9/11 happened.
In the case where non-essential sites are required to disclose what they track to the user, the user is arguably also providing consent on their end even if it's mandatory. Nobody is forcing you to visit non-essential sites.
The fact that all this tracking is still hush-hush means that most people would not react kindly if they were aware of the true scope of the tracking, and how widely distributed the data is.
Mass surveillance is bad. It is toxic to freedom and democracy. Let's focus on that rather than invoking Red Scare tendencies of old.
He used it contextually for framing, I don't think he was calling mass surveillance a "fundamentally Soviet activity" at all.
He's not "invoking Red Scare tendencies of old" to describe modern mass surveillance. He's giving historical context about what earlier generations thought:
>> Earlier generations passed those laws because they viewed mass surveillance as a fundamentally Soviet activity with no place in a free society.
[1] https://it.ojp.gov/PrivacyLiberty/authorities/statutes/1284
Laughs in cointelpro
> Isn't it safer just to use an adblocker? Why engage with ad-networks at all?
> While AdNauseam is far safer than using no blocker at all, it is indeed marginally safer for one to simply use a strong adblocker and protect themselves. But it is also safer to stay at home rather than to attend a protest. Using an adblocker does little to change the status quo (especially for those users without the resources to install/configure one, and so remain at risk). AdNauseam, and the obfuscation strategy in general, instead presents a possible avenue for collective resistance; a means of questioning and perhaps eventually, changing the system. But this is not for everyone. If your goal is primarily self-protection, this tool may not be for you...
[1]: https://github.com/dhowe/AdNauseam/wiki/FAQ#isnt-it-safer-ju...
What are ya gonna do? MIC gets what it wants.
> False
I wonder how they test that? I guess uBlock Origin or uMatrix block their detection.
Note: at least for my profile, those are the only things that truly seem to give significant data. Everything else is in the 1 in 2-300 range, just by using FF on Android with uBlock.
That's the basis of any image manipulation. A write only canvas is not useful at all.
There should really be a prompt whenever a site tries to access this information, especially in privacy-conscious browsers (I wouldn't expect Chrome to want such an anti-feature for their customers, the ad companies).
Just editing your profile picture is a good idea to do on the client side, why waste CPU on your server for example? I do photo editing a lot in the browser.
This is a feature that benefits everybody and the fact that it can be abused is unfortunate, but not as tragic as you paint it.
It's becoming very clear I think that having this level of control for web apps is more detrimental than it is a positive. Leave rich apps to the OS, and keep the web as untrackable as possible.
Non technical users will install it and think it provides them with real anonymity on the Internet or something.