Privacy Frontends

Thread for discussing privacy frontends to mainstream websites. These are useful if you don't want to enable JS or have functionality that isn't available on the official website (e.g. NewPipe lets you make a playlist of videos without a Google account). LibRedirect is an extension for Firefox and Chromium which redirects websites to their frontends. You can choose which frontends you want and by default filters instances that use Cloudflare. https://libredirect.github.io/ >Notable Frontends Invidious (YouTube): https://github.com/iv-org/invidious Nitter (Twitter): https://github.com/zedeus/nitter Teddit (Reddit): https://codeberg.org/teddit/teddit Libreddit (Reddit): https://github.com/spikecodes/libreddit Rimgo (Imgur): https://codeberg.org/video-prize-ranch/rimgo Scribe (Medium): https://sr.ht/~edwardloveall/Scribe/ Quetre (Quora): https://github.com/zyachel/quetre SimpleerTube (PeerTube): https://git.sr.ht/~metalune/simpleweb_peertube Whoogle (Google): https://benbusby.com/projects/whoogle-search/

>>63947 for imgur I'm fond of https://git.voidnet.tech/kev/imgin (official instance https://imgin.voidnet.tech/)

Frontends do not improve privacy on their own as instance operators can still track you. If anything, frontends actually worsen privacy because you are now trusting both the official website (e.g. YouTube), who can still see what you do, and the instance operator, who can see what you do and who you are. Malicious instance operators could be ubiquitous. Use a VPN if you want to hide your IP address from Google. Though a frontend does allow users to browse a website without enabling JS, but disabling JS has questionable privacy benefits and might actually worsen privacy since it makes you stand out from other users. www.whonix.org/wiki/Tor_Browser#You_should_Disable_JavaScript_by_Default! https://fingerprint.com/blog/disabling-javascript-wont-stop-fingerprinting/ Take SearX for example. By using SearX, you are trusting not only the instance operator but also every search engine SearX gets it's results from because it must send those queries to each search engine. This is how metasearch engines (not just SearX, but Whoogle, DuckDuckGo, and Startpage too) work. By using Google, you only have to trust one company with your searches. Again, you should use a VPN to hide your IP address instead of a frontend. Never assume a "privacy-respecting" service provider is more trustworthy than Google. Just because they claim they don't log does not mean they are to be trusted. If anything, providers like Snopyta and Puffyan.us are actually less trustworthy than Google because nobody is watching them. Google won't steal your SSN because everyone would know, but Snopyta probably could get away with it. TL;DR stay away from "privacy" frontends and use official websites and apps only.

There is also this: https://simple-web.org And centrally compiled list of alt-frontends here: https://github.com/digitalblossom/alternative-frontends

>>63958 Your advice is horrible anon: >frontends actually worsen privacy because you are now trusting both the official website (e.g. YouTube), Depending on the front end, your entire traffic may be masked from the official website. Instead, the official website must try to disentangle your traffic with other traffic mixed by the front end. Front ends also only operate through APIs with the official site, severely limiting the data they leak to the official site. Also, many front ends don't have the technical resources or economic incentives to mine and sell the data they have access to, but big corps do, and if you are behind Tor, the big corp may be able to deanonymize more easily by accessing the official site as opposed to the front end. >but disabling JS has questionable privacy benefits and might actually worsen privacy since it makes you stand out from other users. This argument is no longer relevant, it was 5 years ago, but not any more. Browsers have implemented so many APIs that there is a near 100% chance of having a unique fingerprint using any browser other than Tor browser. Browser APIs can leak your entire hardware stack, they have access to your audio, video, GPU, hardware decoders, font rendering libraries. The only way to have a similar fingerprint as any other person is to use a tor browser with javascript disabled. You cannot blend in with the non tor browser crowd anymore, its just not possible. >Google won't steal your SSN because everyone would know, but Snopyta probably could get away with it. they can literally buy a company that has a database of SSNs, snopyta can't. You'd rather empower a behemonth company that you know is not trustworthy than a small organization that may be untrustworthy? >Again, you should use a VPN to hide your IP address instead of a frontend. No, VPNs are not meant for privacy. You are routing all of your traffic into a single entity, that is a huge risk. Use Tor instead, since it routes your traffic among hundreds or thousands of different entities and makes it hard (but not impossible) to correlate traffic. No one hop gets the full picture in Tor, but a VPN gives the full picture to the VPN provider your thinking is very flawed anon, I can't tell if your a VPN wage slave or someone who has fell for google marketing and is parroting what they have told you is the right thing for privacy. Google wants you to use a VPN since they can likely disentangle the traffic or worst case scenario buy/partner with the VPN while masking their relationship with it.

>>63958 Invidious works fine without javascript and doesn't constantly shows captchas on Tor.

>>63958 Thanks Hacker! That clears up a lot of confusion. It had always seemed to me it'd be much more difficult for huge companies to do sneaky stuff like that than some anonymous Russian. Question: do you think it'd be worth the privacy/security risks if I only care about convenience? If I'm on twitter for longer than an hour my laptop usually gets really hot, but I tried using nutter and it didn't.

Bibliogram is a frontend for instagram that supports rss feeds. https://bibliogram.org/ >>63958 >Frontends do not improve privacy on their own as instance operators can still track you. If anything, frontends actually worsen privacy because you are now trusting both the official website (e.g. YouTube), who can still see what you do, and the instance operator, who can see what you do and who you are. This is somewhat true for things like invidious that embed the video using the googlevideo url in the page since Google will see that you're watching that video, but many frontends will download the contents themselves then serve it to you, which prevents the main service from learning anything about you. And even with invidious, Google will know you loaded a video, but they won't know how much you watched, what you searched to get to it, or have nearly as large of a vector to fingerprint your browser with. >Though a frontend does allow users to browse a website without enabling JS, but disabling JS has questionable privacy benefits and might actually worsen privacy since it makes you stand out from other users. The main benefit of disabling Javascript is not to reduce fingerprinting, but to reduce exploit vectors and to minimize unknown 3rd party code running on your machine. I disable javascript to minimize the chance that a browser exploit is going to deliver ransomware to my computer and to stop the low hanging fruit that is most ad/spam/malware networks, not to reduce fingerprinting. Even so, most fingerprinting that the average person is concerned about (ad tracking) is circumvented by disabling js and using alternate frontends. Yes, you can use css rules, fonts, and other browser features for fingerprinting (or, in fairness, exploits), but this isn't the norm in practice. Javascript is still king of fingerprinting (and browser exploits). >might actually worsen privacy since it makes you stand out This doesn't matter that much for no-JS-friendly frontends since no-JS-friendly frontends will have a higher number of users who disable JS. For frontends that are entirely without JS, it's completely moot as the frontend won't behave differently whether you have js enabled or not. Further, because alternate frontends are usually open source and deliver unobfuscated JS (unlike virtually every major website), it's usually trivial to verify that the content delivered by the frontend instance does not differ from the content delivered by an unmodified instance. This makes it much easier to determine if an instance operator is engaging in certain fingerprinting techniques, and how they're doing it, than it is with the official website. >If anything, providers like Snopyta and Puffyan.us are actually less trustworthy than Google because nobody is watching them. Google won't steal your SSN because everyone would know, but Snopyta probably could get away with it. But Google does track you, scan your emails, record as much about you as it possibly can (which is much, much more than an alt frontend host can - a random nitter operator doesn't have their analytics JS embedded on every major site), and then sell it off to the highest bidder. We know Google is doing this for a fact and they're "getting away with it." It isn't about how trustworthy the person you're connecting to is, anyway. It's about how easy it is to see what they're running on your browser. If a nitter instance starts serving up fingerprinting css, that's easier to detect than whatever new malicious tracker nonsense is added into twitter's main page. Also: even if you do get bad luck and connect to a frontend that logs everything and sells the data, that's just what would happen if you're using the official website anyway. Your choice is "a site that is definitely going to track everything, sell your data, and bombard you with ads" and "a frontend that might track some stuff and sell your data, but says they're not and is much easier to audit, and also has no ads" This is all assuming you're using a frontend hosted by someone else - you can self host most alternative frontends with very little resources. Route the connections to the main service through Tor and you can be virtually certain that the service is unable to track you beyond knowing that someone is using an alt frontend through Tor (assuming the alt frontend downloads and reserves the content to you and doesn't just embed specific content from the official host) >>63963 >Google wants you to use a VPN since they can likely disentangle the traffic or worst case scenario buy/partner with the VPN while masking their relationship with it. They also might not care as much about disentangling it because as long as you're using Google services enough, they've probably fingerprinted you enough to advertise to you effectively.

>>63963 People should really make a guide showing how to make your laptop more privacy friendly.

>>63994 >They also might not care as much about disentangling it because as long as you're using Google services enough, they've probably fingerprinted you enough to advertise to you effectively. Yeah, there's no reason for any advertisement company to spend the effort of de-anonymizing VPN users. In fact I would bet 'uses a VPN' automatically gets you slotted into a certain advertisement category because it's easy and effective. If your main goal is to circumvent tracking by advertisement companies there's honestly little reason to even use Tor, just use a browser with a sufficient amount of fingerprint-smudging addons and an aggressive ad blocker.

there are still not good instagram frontend btw I recommend libredirect extension for using these stuff easily. it just automatically redirect. https://addons.mozilla.org/en-US/firefox/addon/libredirect/

>>64120 Hopefully this won't become too popular and get shut down but imginn.com I find to be a pretty good Instagram frontend if a little slow at times.

>>64121 there are also https://www.pixwox.com/ it doesn't matter if they shut it down, news will be created for example I was watching pirated football stream recently, then they shut the site, then I find new stream cycle continues

>>64001 There are already a lot out there.

Startpage uses Google for search results. >Process your search query through Google’s best-in-class search technology. https://www.startpage.com/privacy-please/startpage-articles/how-does-startpages-private-search-engine-work

>>64132 Yeah I saw about Privacyguides.org

fuarrrk this is for real Wikiless has been taken down by Codeberg. source: https://orenom.fi/ >>64144 Privacyguides.org is a joke https://privacyraccoon.tk/fake-privacy-initiatives/privacyguides.html

>>64247 >fuarrrk this is for real Wikiless has been taken down by Codeberg. Why would they do that? >Privacyguides.org is a joke It is.

>>64133 Startpage is owned by a US company called Privacy One Group, which is a division of System1, a “data science” company that specializes in targeted advertising. https://restoreprivacy.com/startpage-system1-privacy-one-group/

>>64247 wow time to change instance

>>64247 I use wikiless because the searx instance I'm currently using redirects all wikipedia links to one of the instances but I don't see the point of this frontend to be honest. If you don't want to get (((targeted))) you should be using tor, the wikipedia doesn't have adds or artificial paid walls.

>>64255 The current version of mediawiki runs a lot of untrustworthy JS and it seems like it will only get worse in the future.

>>64247 You guys should make a repository or something like that yourself for guiding people towards better alternatives. Something like Lain's Guide to better Tech Life? it could have stuff like Privacy , Security , Tech Recommendations , OS Recommendations etc etc.

>>64250 DMCA. It's a serious crime to use or develop alternative frontends to services. >>64262 If you want something done, do it yourself, lain.

>>64266 If only I was that knowledgeable , I would have done it.

pixiv frontend https://pixivviewer.netlify.app

>>64347 Now that's nice, since pixiv was pretty much broken on firefox the last time I checked. I guess it's something you can host yourself: https://github.com/YieldRay/pixiv-viewer

https://www.imginn.com for instagram

>>64247 Shit, so are there any more updates on what's happening with this? And is there another alternative that we can use in the meanwhile? It's a shame that InfoGalatic isn't anywhere near as useful.

>>63958 There is searx.neocities.org which is a randomiser for searx instances. You can download that page and access it from your file system. This splits your searches between currently 75 searx instances. The code for it is on a git page somewhere and you could add more. This way the instance hosts cannot log your entire activity unless they cooperate.

>>63947 https://breezewiki.com/ Breezewiki is an alternative frontend for fandom.com. This one is not as much about privacy as it is about the awful layout of the real fandom website.

is there any way do RECAPTCHA without javascript?

>>64913 yes and I think if you've ever done any web programming it should be obvious how you get a program that generates an image with some text (lets say), and then offers the image to the user in an html form. user reads the image containing the text and feeds it into the form which is then checked against the sourcetext. Can do it with 100% server side cgi in basically any computerlanguage. I see this sort of system from time to time. Unless you mean there's something special about recaptcha but please elaborate. In any case, there's a very good chance you could impliment something similar with cgi.

Are alternative front-ends for services legal? Could google or facebook or whoever, sue the maintainers of the front-end/the hosts of the instances?