I feel like I am commenting this under every post mentioning fingerprinting, but is there a technical reason access to fingerprinting information (screen resolution, battery level, etc) couldn't be made to "taint" the data/code, where the browser would then refuse to send off that data? Or anonymise it and replay the code before sending the request.
Of course, there are legitimate use-cases: downloading specific assets based on client device, etc. And that's a whole can of worms of side channels to open, but that would feel like a useful additional layer of defense, and the paranoia level could be configured. The price might be subtle bugs, and/or a permission dialog that most people will ignore.
I am asking this as, from what I've seen, most websites do not need complex interactions: the battery level will be used to render a battery indicator, etc. XHRs do not usually depend on such data.
I think it's great that Firefox is finally doing more to combat fingerprinting. For a long time, they lagged a bit behind Brave in this regard. That said, unfortunately, neither browser has been able to do anything about Cloudflare Turnstile yet. Kagi, for example, uses it to fingerprint users.
To make your data more accessible AND reduce server load. More and more people are using AI, so there will be more and more bots as the trend seems to be accessing data with your AI, and maybe, only sometimes, actually reviewing what it found. I'm afraid that if you don't at least start to consider how we might accommodate the bots, you'll be walling off more and more real users going forward.
All repositories on git.zajc.tel can be git clone'd from their URL. The clone URL is also listed on every repository's summary page. Unlike the HTML pages, the clone endpoints are not ratelimited, have no bot check, and give you the entire repository with all history without having to crawl billions of pages.
this is bad faith argument. You are well aware that the majority of bots are used for negative purposes, at best, those purposes are neutral.
The situation you describe is certainly legitimate and useful, but is not the norm. Separating legitimate bots from the rest is currently not possible reliably.
Can you please tell whoever it is at Mozilla to stop working on that.
This feedback isn't directed at any one person but that proposal impressively suffers from the simultaneous problems of Being Way Too Fucking Complicated and Proposing to Make the Web Better but Actually Making it Way Worse (for Everyone Except Entrenched Megacorps). It's the exact same problem that Google's "anonymous ad attribution" attestation swarms suffered, and luckily that never came to pass.
From looking at the pictures in that article, it seems like in order for me to be able to browse "protected" sites (aka, most of the corporate-owned web, once they are aware that this exists and turn it on because "bots bad") my browser is going to have to negotiate for some scant amount of "allowed access" tokens or other such thing, through some complicated protocol that halts any chance of us realizing a future for the web that looks any much different from "locked down approved browsers visiting approved sites in an approved way."
The further we allow the Web to stray from cURL http://example.com Just Working, the worse off we all are. So to reiterate, this proposal looks insane and not at all aligned with Mozilla's mission...
One caveat I’ve experienced with Firefox branches that focus on privacy is I get “punished” with captchas from hell because I refuse to let websites siphon and prey on every last bit of private info. Hopefully this doesn’t succumb to the same issue.
I'm tired of identifying buses or stoplights or motorcycles up to five times a day just for Google searches. I'm slowly moving myself over to LLM queries instead.
Why do you want to use services that use such captchas? It’s like going to a club and complaining about the door policy. Don’t go if you don’t like it.
I'd like to have some of the APIs that read the data used to fingerprint browsers be behind a confirmation dialog per site similar to allowing popups or microphone/video access.
> Oh, I see that you'd like to read the canvas pixel data, let me check if that's okay with the user first.
I'm on desktop Firefox v160.0 and I've never seen a permission dialog like that and under settings I see:
Permissions
Manage what websites can access, control, or trigger.
Location
Camera
Device apps and services
Local network devices
Microphone
Speaker
Notifications
Autoplay
Virtual reality
None of those seem to be for accessing canvas data.
Not sure what my settings are but I've definitely seen the pop up at browse time "Website wants to access canvas data" or similar with a decline option. It might be under the umbrella of settings changed by setting Enhanced Tracking Protection to Strict.
Unless I'm misreading the post mentions that the most recent change was added to version 145 which released last year. Personally I haven't had any issues with cloudflare as a firefox user since then with strict mode enabled.
Surveillance fingerprinting will only end with major changes to the web.
If you are among those capable of 3rd order thinking or even just 2nd order thinking, and consider what kind of world you want to live in, you may already know that these changes must happen, even if that means the functional web is bifurcated for a while.
Are you talking about a return to a web of one-to-one connections, no broadcasts?
Actually the problem isn't broadcasts but reverse broadcasts. A broadcast sends one signal to all interested listeners - the problematic mode of the web is one listener getting all interested signals, which allows spam and propaganda (which are the same thing) to flood that set. Is there a word for this reverse broadcasting idea?
Maybe you can use your second-order thinking to consider how people might react to a sentence that starts “if you are among those capable of 3rd order thinking.”
-1 it's perhaps offensive but I agree with OP: 3rd order is *very* difficult to reason about, and even really smart, really experienced people have colossal failures at that level of reasoning-depth. It's not just probabilistic (e.g. chess, go), but in addition the way a decision-tree-branch is followed often deeply affects downstream decisions...
See, this is more along what I expect from a place that titles itself "Hacker News".
The reason I mentioned 2nd order and 3rd order cognitive abstraction, is because to fix the web we need to make some tough decisions.
When technical enthusiasts such as people who call themselves "engineer" but aren't real engineers hear these things the response is "nobody is going to do $thing lol". Yet the more big brains are indeed talking about doing thing or lamenting the mal-growth we have collectively experienced, including the recognized inventor of the WWW.
The below is just off the top of my head, "in passing". Some people have done some work on parts of this picture already. Maybe I could post something more "formal" somewhere later on.
Before jumping in with "omg but then how would X/Y/Z work lol", use whatever 2nd order or 3rd order abstraction thinking you might have, and consider that those things were already considered by people working on these problems (or at least attempting to) and yes there are full answers or at least a couple of half-answers for those concerns.
Among those is content-addressing. This eliminates, by avoiding outright through design, most of the Cloudflare/Akamai, "verifying your connection", and captcha bullshit. This also means user metrics are opt-in, which maybe they could be by default unless a user turns it off, but then they would be easy to spoof (which they already are).
The major thing is no more untrusted Javascript and no more untrusted WASM unless loaded in a pop-up window as "external program". See the Free Software Foundation's stance on non-free Javascript. This stance isn't so "out there" to legitimate hackers.
Due to decisions made early on with processors and the feedback loop optimizing for certain styles of programming, our CPUs do speculative execution. Some developments have helped, but the only safe option for CPUs people actually use, which are not the second or third latest generation (often for chipset security concerns), require disabling Javascript JIT and WASM or Javascript all together.
Almost all of the widgets and doodads we need for the web have been figured out by now. We need a trusted collection of libraries for these things. This should include all of the extra fonts we want.
Any GPU/canvas stuff needs to be truly deterministic so as to be useless for fingerprinting.
No more User Agent string.
No more sending screen dimensions. Yes, how to contend with this has been thought of already.
Not every website should be "mobile friendly". Yes, you do need a fucking laptop/desktop to get by in the world. "I can do everything on my phone" is NGMI.
The whole CA thing needs a complete overhaul.
Cookies need to be handled in a way that users can hover over a browser tab and see what cookies are visible to the remote end of that browser tab, and cross-domain cookies must be explicitly allowed by a user.
There are very tough decisions and things that do require serious talent to innovate correctly in a way intuitive to users, that need to happen to eliminate
fingerprinting.
It's not those incapable of 3rd order cognitive abstraction who are going to dig us out of this mess. It's people who actually give a shit and think about these things a lot who will quietly implement the fixes and will never be renowned or heard of by the crab bucket mentality monkeys unless someone in authority tells them too.
I feel like I am commenting this under every post mentioning fingerprinting, but is there a technical reason access to fingerprinting information (screen resolution, battery level, etc) couldn't be made to "taint" the data/code, where the browser would then refuse to send off that data? Or anonymise it and replay the code before sending the request.
Of course, there are legitimate use-cases: downloading specific assets based on client device, etc. And that's a whole can of worms of side channels to open, but that would feel like a useful additional layer of defense, and the paranoia level could be configured. The price might be subtle bugs, and/or a permission dialog that most people will ignore.
I am asking this as, from what I've seen, most websites do not need complex interactions: the battery level will be used to render a battery indicator, etc. XHRs do not usually depend on such data.
I think it's great that Firefox is finally doing more to combat fingerprinting. For a long time, they lagged a bit behind Brave in this regard. That said, unfortunately, neither browser has been able to do anything about Cloudflare Turnstile yet. Kagi, for example, uses it to fingerprint users.
I believe the relevant work to mitigate that is https://hacks.mozilla.org/2026/06/pact-anonymous-credentials...
(I do work at Mozilla but not on any of this.)
There's a third option: allow bots and give them access as efficiently as possible.
As Reddit's API used to.
Don't want to? Tough, they'll do it the hard way and put more load on your servers and your countermeasures will drive away more humans than bots.
Of course our current bot plague doesn't understand this and seems to be optimizing for maximum server load, which is still bad.
> There's a third option: allow bots and give them access as efficiently as possible.
Why?
To make your data more accessible AND reduce server load. More and more people are using AI, so there will be more and more bots as the trend seems to be accessing data with your AI, and maybe, only sometimes, actually reviewing what it found. I'm afraid that if you don't at least start to consider how we might accommodate the bots, you'll be walling off more and more real users going forward.
what does the site get out of ai users? it doesn't seem like they have a strong incentive to let you not actually visit the site
shopping makes some sense if the bot can still buy things at least, but a lot of other ad dependent sites really have little reason
All repositories on git.zajc.tel can be git clone'd from their URL. The clone URL is also listed on every repository's summary page. Unlike the HTML pages, the clone endpoints are not ratelimited, have no bot check, and give you the entire repository with all history without having to crawl billions of pages.
Guess which option the bots pick.
Or just block all bots and give them a big F U :)
Why shouldn't bots (who work on behalf of users after all) not get access to information?
I just found something via LLMs and bought it from a website that I would have never found with traditional search engines (because I didn't).
this is bad faith argument. You are well aware that the majority of bots are used for negative purposes, at best, those purposes are neutral.
The situation you describe is certainly legitimate and useful, but is not the norm. Separating legitimate bots from the rest is currently not possible reliably.
Can you please tell whoever it is at Mozilla to stop working on that.
This feedback isn't directed at any one person but that proposal impressively suffers from the simultaneous problems of Being Way Too Fucking Complicated and Proposing to Make the Web Better but Actually Making it Way Worse (for Everyone Except Entrenched Megacorps). It's the exact same problem that Google's "anonymous ad attribution" attestation swarms suffered, and luckily that never came to pass.
From looking at the pictures in that article, it seems like in order for me to be able to browse "protected" sites (aka, most of the corporate-owned web, once they are aware that this exists and turn it on because "bots bad") my browser is going to have to negotiate for some scant amount of "allowed access" tokens or other such thing, through some complicated protocol that halts any chance of us realizing a future for the web that looks any much different from "locked down approved browsers visiting approved sites in an approved way."
The further we allow the Web to stray from cURL http://example.com Just Working, the worse off we all are. So to reiterate, this proposal looks insane and not at all aligned with Mozilla's mission...
Too bad they still generate a random unique ID for each installed extension that can expose a trackable UUID...
https://bugzilla.mozilla.org/show_bug.cgi?id=1717671
One caveat I’ve experienced with Firefox branches that focus on privacy is I get “punished” with captchas from hell because I refuse to let websites siphon and prey on every last bit of private info. Hopefully this doesn’t succumb to the same issue.
I'm tired of identifying buses or stoplights or motorcycles up to five times a day just for Google searches. I'm slowly moving myself over to LLM queries instead.
tbf that's on you for still using google
Why do you want to use services that use such captchas? It’s like going to a club and complaining about the door policy. Don’t go if you don’t like it.
Thanks for reminding me that Elon Musk got rejected from Berghain.
Berghain, is that located in this failed state where arab gangs perpetrate daily shootings?
I'd like to have some of the APIs that read the data used to fingerprint browsers be behind a confirmation dialog per site similar to allowing popups or microphone/video access.
> Oh, I see that you'd like to read the canvas pixel data, let me check if that's okay with the user first.
HTML5 canvas data access has been behind such a permission dialog on Firefox (at least on desktop) for a long time now.
I'm on desktop Firefox v160.0 and I've never seen a permission dialog like that and under settings I see:
None of those seem to be for accessing canvas data.Not sure what my settings are but I've definitely seen the pop up at browse time "Website wants to access canvas data" or similar with a decline option. It might be under the umbrella of settings changed by setting Enhanced Tracking Protection to Strict.
Am I the only expecting it to completely break the sites behind cloudflare on Firefox?
Unless I'm misreading the post mentions that the most recent change was added to version 145 which released last year. Personally I haven't had any issues with cloudflare as a firefox user since then with strict mode enabled.
It links to this post when talking about it: https://blog.mozilla.org/en/firefox/fingerprinting-protectio...
Was also thinking this, would like an answer.
Surveillance fingerprinting will only end with major changes to the web.
If you are among those capable of 3rd order thinking or even just 2nd order thinking, and consider what kind of world you want to live in, you may already know that these changes must happen, even if that means the functional web is bifurcated for a while.
Are you talking about a return to a web of one-to-one connections, no broadcasts?
Actually the problem isn't broadcasts but reverse broadcasts. A broadcast sends one signal to all interested listeners - the problematic mode of the web is one listener getting all interested signals, which allows spam and propaganda (which are the same thing) to flood that set. Is there a word for this reverse broadcasting idea?
Maybe you can use your second-order thinking to consider how people might react to a sentence that starts “if you are among those capable of 3rd order thinking.”
-1 it's perhaps offensive but I agree with OP: 3rd order is *very* difficult to reason about, and even really smart, really experienced people have colossal failures at that level of reasoning-depth. It's not just probabilistic (e.g. chess, go), but in addition the way a decision-tree-branch is followed often deeply affects downstream decisions...
See, this is more along what I expect from a place that titles itself "Hacker News".
The reason I mentioned 2nd order and 3rd order cognitive abstraction, is because to fix the web we need to make some tough decisions.
When technical enthusiasts such as people who call themselves "engineer" but aren't real engineers hear these things the response is "nobody is going to do $thing lol". Yet the more big brains are indeed talking about doing thing or lamenting the mal-growth we have collectively experienced, including the recognized inventor of the WWW.
The below is just off the top of my head, "in passing". Some people have done some work on parts of this picture already. Maybe I could post something more "formal" somewhere later on.
Before jumping in with "omg but then how would X/Y/Z work lol", use whatever 2nd order or 3rd order abstraction thinking you might have, and consider that those things were already considered by people working on these problems (or at least attempting to) and yes there are full answers or at least a couple of half-answers for those concerns.
Among those is content-addressing. This eliminates, by avoiding outright through design, most of the Cloudflare/Akamai, "verifying your connection", and captcha bullshit. This also means user metrics are opt-in, which maybe they could be by default unless a user turns it off, but then they would be easy to spoof (which they already are).
The major thing is no more untrusted Javascript and no more untrusted WASM unless loaded in a pop-up window as "external program". See the Free Software Foundation's stance on non-free Javascript. This stance isn't so "out there" to legitimate hackers.
Due to decisions made early on with processors and the feedback loop optimizing for certain styles of programming, our CPUs do speculative execution. Some developments have helped, but the only safe option for CPUs people actually use, which are not the second or third latest generation (often for chipset security concerns), require disabling Javascript JIT and WASM or Javascript all together.
Almost all of the widgets and doodads we need for the web have been figured out by now. We need a trusted collection of libraries for these things. This should include all of the extra fonts we want.
Any GPU/canvas stuff needs to be truly deterministic so as to be useless for fingerprinting.
No more User Agent string.
No more sending screen dimensions. Yes, how to contend with this has been thought of already.
Not every website should be "mobile friendly". Yes, you do need a fucking laptop/desktop to get by in the world. "I can do everything on my phone" is NGMI.
The whole CA thing needs a complete overhaul.
Cookies need to be handled in a way that users can hover over a browser tab and see what cookies are visible to the remote end of that browser tab, and cross-domain cookies must be explicitly allowed by a user.
There are very tough decisions and things that do require serious talent to innovate correctly in a way intuitive to users, that need to happen to eliminate fingerprinting.
It's not those incapable of 3rd order cognitive abstraction who are going to dig us out of this mess. It's people who actually give a shit and think about these things a lot who will quietly implement the fixes and will never be renowned or heard of by the crab bucket mentality monkeys unless someone in authority tells them too.