Hello everyone! I saw that disabling JavaScript was good to prevent fingerprinting. However, something’s holding me up from doing so: since only a minority of the Internet users block it, won’t it make me more easy to identify?
Even if it’s harder to load trackers or fingerprinting scripts, what if one manage to load? Will the fact that I disabled JavaScript make me more “unique” ?
Thanks in advance for any help!
Firefox has few tricks to prevent finger printing
- There is a built in finger printing protection which helps a little bit but not perfect
- There is containers: Putting different websites into different containers isolate them from one another so for example opening a website selling toys in one container would prevent your facebook account that is running in different container from knowing about this fact.
- There is an extension called NoScript. This allow you to do what you want (block javascript) but since - as many others said - 99% of website won’t work without javascript, u could selectively allow certain javascript from certain domains while blocking others. By default all javascript are blocked but then u test enabling some to see what is the absolute minimum for certain website to work. NoScript remembers your selections so you only need to do it once per website.
I mean. Yeah, technically, but go on and try it. Most of the web won’t work for you anymore. And you’ll still be tracked by pixels. You can pair the disablement with a tracker blocker to get those, but then a good blocker also handles fingerprinting scripts, so then what was the point?
It’s a technical arms race and good hygiene to review code from untrusted third-parties.
Can’t review code if you don’t know how to. Are we meant to throw the source into AI and go, “hey is this safe”? While it may work, the time and effort sometimes isn’t. It’s literally being stuck between a rock and a hard place, so-to-speak. And before anyone says, “well, you should learn code”, I hear you. All due respect to those that can, I’m not taking the time because I don’t have time. I’m surviving from high gas prices, high grocery prices, higher bills (with for-profit companies reporting their best ever profits YOY), and keeping afloat. “Ain’t nobody got time fo dat.”
Anyone who knows the first thing about web dev knows this is pointless. The scripts are minified and mangled so far it’s impossible to suss out what they do without hours and hours of deobfuscation per script, and it can often be hundreds of scripts. The only thing you can do is use blockers. They don’t try to understand what the script does, they operate by blocking known stuff and known bad origins.
Yeah, people don’t seem to realize that their technical solutions don’t matter.
Tracking and privacy is a problem that can only be solved through legislation and legal means. Big companies have more resources and can work around any technical hurdle you throw up.
Like they don’t even have to work around them technically… Oh you like the encrypted messenger? It would be a shame if they were able to make it useless by convincing everyone to just use their DM system leaving no one on your encrypted messaging network to talk to, wouldn’t it?
I think that disabling JS is worth the price (imo), that doesn’t annoy me very much Also, I believe tracker blockers can sometime fail to block fingerprinting scripts cause they’re could come from unknown domain
Blocking JS will increase fingerprint accuracy, but…
I can’t imagine browsing with all js allowed by default anymore. It’s painful.
With NoScript and Ublock my browsing experience is just so much better - stupid videos don’t autoplay, the screen doesn’t do weird reflow once it fully loads, etc.
That looks much better. I already use uBlock Origin, but now I will disable JS by default too ig!
Since you mentioned Ublock-Origin. I would recommend to disable 3rd party Iframes. That will mean tweets, youtube videos will not play by default but you can manually whitelist them at global or site local way if desired. Not loading Iframes by default should reduce the amount of trackers and potential malware that could be loaded from compromised sites.
You can see what level of blocking you can use according to your convenience here: https://github.com/gorhill/uBlock/wiki/Blocking-mode
I don’t have an answer to your question but I tend to agree with what you wrote.
However - is fingerprinting the only thing to worry about on the www? I’d say not.
Disabling javascript by default is a good way to be able to click links without running the risk of getting pwned by some rogue script.
Then I use an addon* that shows me all the 3rd party shit the site would’ve wanted to load, and if it looks OK to me I then enable javascript. The addon can remember this if I want to, so I don’t have to do it every time for that particular site.
Esp. with news articles js is often not even required to read the article itself. Or I can see content that becomes invisible when js is enabled.
FWIW, the developers of Tor browser are experts in being anonymous online, and they disable js by default. While it might make me more unique, js has enormous capabilities in collecting all sorts of data from my machine, and - I guess - that’s why disabling it makes me more anonymous in the end. Just a hunch.
* uBlock Origin in expert mode
I also block js and for most pages I only enable the scripts which are needed. After a few pages you will get feel.
It feels nice that I don’t need to enable a random script from oneClickTrackYouAndSellYourData.com and enable only the scripts needed for functionality.I guess I will disable it too!
This is Information Theory at work. You’re compacting (n+1) signals, where n is any number between 1 and infinity, to 1. With javascript execution, anyone can get timing, webgl, location, device hardware access, etc… Without it, they just get a single bit that tells them to fuck off.
Good point!
Why not use a security based OS on a thumb drive and boot into it for surfing privately. There was one I played with a while ago but forgot the name.
Tails or Qubes probably.
Thank you, it was tails.
I sometimes use Tails, but the fact that it wipes every files on shutdown is kinda annoying imo
deleted by creator
