Hacker News Reader

Comment by quesera | Hacker News Reader

> What I want for Christmas is javascript disabled by default, plus one-click ability to enable for specific sites.

uBlock Origin solves this in two clicks. WFM.

It does! I had to manually disable Javascript in UO settings, which solved the problem for me. FWIW, it doesn't solve the problem at scale, per opt-in / opt-out dynamics. It's a feature worth building into the browser, and setting it to disable JS by default. Make site owners ask for permission to use JS, and they better have a good reason.

And yet, not enough:

> Your browser fingerprint appears to be unique among the 2xx,xxx tested in the past 45 days.

> Currently, we estimate that your browser has a fingerprint that conveys at least 18.xx bits of identifying information.

Biggest offenders: USER AGENT and HTTP_ACCEPT HEADERS. Especially the USER AGENT is crazy, 9 digit browser version to everyone who asks?!

Use an extension to spoof your user-agent string. Something like this: https://addons.mozilla.org/en-US/firefox/addon/user-agent-st...

Thanks. What is the most common user agent out there?

Sadly, this is of limited use. Defense against fingerprinting is like herd immunity. If everybody else already has a unique fingerprint, there is not much an individual can do to avoid being uniquely identified as well. At most one can spoof one other unique individual. Plus the EFF recommendation is 'latest Chrome on Windows' which is a moving target.

Would be nice if the EFF site in OP would recommend an agent id to spoof to, at least that would help building a small, but non trivial herd of indistinguishable users. And then a popular extension like uBlock Origin would track this agent id and set it by default for all its users.

Edit: list of top UAs:

https://techblog.willshouse.com/2012/01/03/most-common-user-...

If you give random UA's to websites, you cannot be tracked between them even if you're unique

You can still be tracked with all your other identifying bits. Especially if your the only one who’s doing this.

    privacy.resistFingerprinting = 1

Among many other things, it sets UA to the LTS release, and `HTTP_ACCEPT` to a vanilla en-US string.

Unfortunately breaks windy :-(

> It's a feature worth building into the browser, and setting it to disable JS by default

Brave does this.

Reply on news.ycombinator.com