5 ms·

You will be part of the rare minority that uses that configuration which by itself is a fingerprint.

by ayrx 7y ago

anonymfus 7y ago
The point probably was to make that configuration default
- tptacek 7y ago
  That configuration will not be the default. You might just as productively argue that the best way to defeat fingerprinting would be to default to Gopher.
  - progval 7y ago
    You can do a lot of things with just HTML and CSS, more than what Gopher allows. And for what you can't, a banner asking for permission to run Javascript, like we have/had for Java/Flash/ActiveX
    - olliej 7y ago
      Can a user meaningfully determine the correct answer to that question? The experience is “I clicked no and nothing worked” vs “I clicked yes and the site worked”. I get that you don’t like it, but the reality is that the web is a platform that includes JS as a core technology. The reason for limiting java and activex was because they had catastrophically terrible security properties more or less by design. Even flash had problems, but was sensible enough to correct many deficiencies and defer to the browser for interaction with anything outside of its view. Which is why you weren't asked about running flash on every website you went to. JS and the various web/html/dom APIs all have much much stricter constraints than anything flash had - they are designed to be safe in spite of all content being untrusted. More over dialogs like that are largely recognized among browser developers as being a form of blame shifting - a regular user has no reasonable way to determine whether or not saying “yes” is safe. The purpose of asking them, is so that if something does go wrong you can say “they shouldn’t have clicked yes”.
      - progval 7y ago
        > Can a user meaningfully determine the correct answer to that question? > The experience is “I clicked no and nothing worked” vs “I clicked yes and the site worked”. I agree; but the extra click may be an insentive for web developpers to try not to use JS. > Which is why you weren't asked about running flash on every website you went to. Firefox did ask about running Flash, because "attackers can also use the security flaws in Flash": https://support.mozilla.org/en-US/kb/set-adobe-flash-click-play-firefox https://support.mozilla.org/en-US/kb/set-adobe-flash-click-p... > they are designed to be safe in spite of all content being untrusted But they have flaws, like Flash.
        tptacek 7y ago
        Just as long as we're all clear that this is not a real debate, and a serious programming language connected to the DOM is not going anywhere; you are stuck with that design.
    - pgeorgi 7y ago
      > just HTML and CSS, yes, @media queries for example that trivially let the site fingerprint you again.
  - tomjen3 7y ago
    That would be pretty nice in many ways.

You will be part of the rare minority that uses that configuration which by itself is a fingerprint.

by ayrx 7y ago

You will be part of the rare minority that uses that configuration which by itself is a fingerprint.

anonymfus 7y ago

The point probably was to make that configuration default

tptacek 7y ago
That configuration will not be the default. You might just as productively argue that the best way to defeat fingerprinting would be to default to Gopher.
- progval 7y ago
  You can do a lot of things with just HTML and CSS, more than what Gopher allows. And for what you can't, a banner asking for permission to run Javascript, like we have/had for Java/Flash/ActiveX
  - olliej 7y ago
    Can a user meaningfully determine the correct answer to that question? The experience is “I clicked no and nothing worked” vs “I clicked yes and the site worked”. I get that you don’t like it, but the reality is that the web is a platform that includes JS as a core technology. The reason for limiting java and activex was because they had catastrophically terrible security properties more or less by design. Even flash had problems, but was sensible enough to correct many deficiencies and defer to the browser for interaction with anything outside of its view. Which is why you weren't asked about running flash on every website you went to. JS and the various web/html/dom APIs all have much much stricter constraints than anything flash had - they are designed to be safe in spite of all content being untrusted. More over dialogs like that are largely recognized among browser developers as being a form of blame shifting - a regular user has no reasonable way to determine whether or not saying “yes” is safe. The purpose of asking them, is so that if something does go wrong you can say “they shouldn’t have clicked yes”.
    - progval 7y ago
      > Can a user meaningfully determine the correct answer to that question? > The experience is “I clicked no and nothing worked” vs “I clicked yes and the site worked”. I agree; but the extra click may be an insentive for web developpers to try not to use JS. > Which is why you weren't asked about running flash on every website you went to. Firefox did ask about running Flash, because "attackers can also use the security flaws in Flash": https://support.mozilla.org/en-US/kb/set-adobe-flash-click-play-firefox https://support.mozilla.org/en-US/kb/set-adobe-flash-click-p... > they are designed to be safe in spite of all content being untrusted But they have flaws, like Flash.
      - tptacek 7y ago
        Just as long as we're all clear that this is not a real debate, and a serious programming language connected to the DOM is not going anywhere; you are stuck with that design.
  - pgeorgi 7y ago
    > just HTML and CSS, yes, @media queries for example that trivially let the site fingerprint you again.
- tomjen3 7y ago
  That would be pretty nice in many ways.