Updated Aug. 28, 2024. Take back your privacy Firefox is rolling out Total Cookie Protection by default to more Firefox users worldwide, making Firefox the
Advertisers track you with device fingerprinting and behaviour profiling now. Firefox doesn’t do much to obscure the more advanced methods of tracking.
Lots do. But do you know anyone that turns JS off anymore? Platforms don’t care if they miss the odd user for this - because almost no one will be missed.
“Anymore”? I’ve never met a single soul who knows this is even possible. I myself don’t even know how to do it if I wanted to.
I do use NoScript, which does this on a site-by-site basis, but even that is considered extremely niche. I’ve never met another NoScripter in the wild.
Roughly similar to using Adblock Plus with many filter lists + NoScript with 1st-party scripts/frames automatically trusted. Unlike NoScript however, you can easily point-and-click to block/allow scripts on a per-site basis.
I like the grid add-on for Firefox. It disables 3rd party pretty much anything by default. And you can control cookies separately from everything else, and I can’t remember any time I’ve needed to enable those cookies to get a site working properly (whereas sometimes you need to enable scripting, media, or iframe for cdn or something).
uBlock origin + NoScript for me. I deal with the bigger umbrella of scripts with uBlock and then fine tune permissions to the ones that uBlock allowed with NoScript.
They might be fingerprinting me using these two extensions though.
I use LibreJS with few exceptions. If I need to use a site that requires non-free JavaScript, I’ll use a private browsing window or (preferably) Tor Browser.
Not all but most, yes. But TBF, sites that still function with JS disabled tend to have the least intrusive telemetry, and might pre-date big data altogether.
Regardless, unless the extent of a page’s analytics is a “you are the #th visitor” counter, all countermeasures must remain active.
It’s really strange how they specifically mention HTML5 canvas when you can run any fingerprinter test on the internet and see that Firefox does nothing to obfuscate that. You can run a test in Incognito mode, start a new session on a VPN, run another test, and on Firefox your fingerprint will be identical.
Well yeah, they’re just blocking known fingerprinting services. If you use a tool that they don’t recognize, it’ll still work, but their approach will still block the big companies that can do the most harm with that data.
The only alternative is probably to disable WebGL entirely, which isn’t a reasonable thing to do by default.
I wish Firefox had a per-site or per-domain preference for WebGL (as well as for wasm, etc), the same way we have per-site cookies or notifs preferences. It’d help clear most issues regarding this.
Honestly would be hard to do. There a perfectly legitimate and everyday uses for pretty much everything used in fingerprinting. Taking them away or obscuring them in one way or another would break so much.
Get fucked, advertisers.
Advertisers track you with device fingerprinting and behaviour profiling now. Firefox doesn’t do much to obscure the more advanced methods of tracking.
Don’t all the advanced ways rely on JavaScript?
Lots do. But do you know anyone that turns JS off anymore? Platforms don’t care if they miss the odd user for this - because almost no one will be missed.
“Anymore”? I’ve never met a single soul who knows this is even possible. I myself don’t even know how to do it if I wanted to.
I do use NoScript, which does this on a site-by-site basis, but even that is considered extremely niche. I’ve never met another NoScripter in the wild.
Why not just use ublock medium mode?
https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium-mode
Am I in the wild? I use it.
I like the grid add-on for Firefox. It disables 3rd party pretty much anything by default. And you can control cookies separately from everything else, and I can’t remember any time I’ve needed to enable those cookies to get a site working properly (whereas sometimes you need to enable scripting, media, or iframe for cdn or something).
uBlock origin + NoScript for me. I deal with the bigger umbrella of scripts with uBlock and then fine tune permissions to the ones that uBlock allowed with NoScript.
They might be fingerprinting me using these two extensions though.
I use LibreJS with few exceptions. If I need to use a site that requires non-free JavaScript, I’ll use a private browsing window or (preferably) Tor Browser.
Not all but most, yes. But TBF, sites that still function with JS disabled tend to have the least intrusive telemetry, and might pre-date big data altogether.
Regardless, unless the extent of a page’s analytics is a “you are the #th visitor” counter, all countermeasures must remain active.
It’s not much but they try a whole lot more than most.
It’s really strange how they specifically mention HTML5 canvas when you can run any fingerprinter test on the internet and see that Firefox does nothing to obfuscate that. You can run a test in Incognito mode, start a new session on a VPN, run another test, and on Firefox your fingerprint will be identical.
Well yeah, they’re just blocking known fingerprinting services. If you use a tool that they don’t recognize, it’ll still work, but their approach will still block the big companies that can do the most harm with that data.
The only alternative is probably to disable WebGL entirely, which isn’t a reasonable thing to do by default.
I wish Firefox had a per-site or per-domain preference for WebGL (as well as for wasm, etc), the same way we have per-site cookies or notifs preferences. It’d help clear most issues regarding this.
Honestly would be hard to do. There a perfectly legitimate and everyday uses for pretty much everything used in fingerprinting. Taking them away or obscuring them in one way or another would break so much.
EU outlaws it
The EU isn’t the only place on the planet, even if its laws have an impact.
Yeah, you need uMatrix. although it can be tricky to use.
There is still plenty of fish for advertisers, sadly.