So where we're at with privacy addons?

Throughout the years we've had countless discussions about what addons and browser combination delivers the less terrifying experience in terms of privacy. Already making it clear we're talking privacy and not security, so we can skip that discussion for the sake of focus. In what comes to browsers capable of painlessly handling modern web, which disgusting and hateful as is for a lot of us, it's a real necessity for many people, be it for work or other purposes (so excluding things like lynx, w3m, surf, etc.), the most common opinion seems to always have been that firefox is the necessary evil. The other common option being chromium forks trying to clean it from google evil touch, which is too much of a complicated process to trust. Personally, I don't believe that part has changed, but the scenario and the means of doing that have, quite drastically. Most of the addons that lains recommended and used have lost compatibility and won't be available anymore. Also, there are new configurations that are worrysome and we should think about how to deal with those. And so far I haven't seen any compreensible enough discussion on where we go from now, and how everyone is dealing with this new era, so that's what I'm proposing we do here.

So where I, OP, have managed to get so far with the question? What I was using before and managed and how I've been dealing with the changes: -uMatrix and uBlock origin are both still alive and working. some people have mentioned uBlock origin might present worse functionality and let more bad stuff through, but I at least haven't experienced that yet -HTTPS everwhere also still good and working -Self-destructing cookies this one is gone, and the only powerful option I found for replacement is Cookie AutoDelete only catch being that the former one used to have automation for cache cleaning and this one doesn't, so I added Empty Cache Button which unfortunately doesn't do it by itself at an specified interval so I've got to remember to click on it every few minutes -Random Agent Spoofer this is the one I'm having trouble replacing because the only option I could find is User-Agent Switcher but it only allows you to set a specific agent string and stick to it, or manually change it from time to time, whereas the old one had a randomize function. in this case I don't think it cuts, because changing it manually every few minutes doesn't seem as doable, and it has just some options for that. now, a lot of people argue that using a very common one (blending, simply) is the best option for privacy, and although that is true in terms of not getting attention, it leaves more space for data-mining because something is likely to leak and creating a profile of your usage wouldn't be hard (different usecases). so I'm not seeing a solution to how I deal with the question The other issue I've had to deal with is that I was using IceCat but on the last few days for some reason it started eating my RAM like mad, making my laptop unusable at times. So for now I've switched to vanilla firefox on x86 machines, because I don't know any good option. So since IceCat had a way better and more legacy about:config, I haven't delved into cleaning the firefox one and would welcome any tips on that, or things I should read about on the subject.

>>3173 > So since IceCat had a way better and more legacy about:config, I haven't delved into cleaning the firefox one and would welcome any tips on that, or things I should read about on the subject. Set Network.http.sendRefererHeader = 0 This will prevent websites from knowing where you were linked to them from.

>>3178 It sometimes breaks inner links, would not recommend. You need to have it manually set up or spoofed on occasion, because when a website that gets most traffic from Google sees you popping out of nowhere on /misc/useless/secretfiles/book.pdf would automatically mark you as someone who either bookmarked this page (your browser/ip didn't show up earlier, so it's probably not you) or that you try to be a smart ass on not sending a referrer.

>>3173 >Random Agent Spoofer Ublock Origin has something like this in their settings, as far as I can tell. What is your opinion of using umatrix and noscript together? Is it Overkill?

Personally I just >HTTPS everywhere >hosts blocklist for ads etc. >javascript completely disabled I think this is enough

>>3182 also I run in private browsing mode (so no history/saved session), no third-party cookies, on firefox

Ublock, Umatrix, NoScript, HTTPS Everywhere, Self destructing cookies for browsing with waterfox. tor-browser for most random browsing nowadays

>>3181 >Ublock Origin has something like this Weren't you perhaps thinking of uMatrix? I've never seen anything regarding spoofing on uBlock, just double-checked here. If that's the case, last word I heard were the devs said that was still an experimental feature which people shouldn't trust yet. And, anyhow, it's good that like RAS it can randomize for set time-period, but it's just a handful of most common strings, whereas RAS had an entire assortment that would really mess with any tries of creating profiles of your browsing habits. If it's not experimental and fully working now, it'd be a decent solution but, I believe, inferior to the previous one and then on the list of something that is still not sorted completely since the breakage of old addons. >What is your opinion of using umatrix and noscript together? Is it Overkill? Guess it depends on how you configure them? By default, uMatrix will let in scripts from first-parties, which is a no-go if you're using Tor or similar. But it will block completely any third parties, while NoScript will kill all scripts, but let other stuff from third parties. And except for a few cases third parties are there essentially for spying, so you will still have a big hole on your wall. I suppose if you're going to use them out of the box, having both makes for a more secure setup, but if you really configure just one of them it can takes care of everything by itself. >>3184 >Self destructing cookies for browsing with waterfox. But did waterfox promise a different approach for addons? Because if it's just going to fork what firefox does in that regard, Self-destructing cookies will be dead in a couple weeks.

I try to get as far as i can with as few addons as possible. Mostly because firefox really starts to bog down on my machine if you overdo it. >uBlock Origin Adblock. Relatively aggressive selection of blocklists. >uMatrix I have a ton of per-site configs. Default is all third party blocked (except images from domains that aren't obviously beacons), and all cookies blocked. I dropped noscript on my main browser because it was redundant, but I agree its MO is better for torbrowser. >Greasemonkey Just some utility scripts for sites I go on frequently. It's nice to be able to write some js to fix some function I don't like on whatever website. I guess this isn't really privacy focused, except I have something to strip url proxies on a few major sites. >User agent switcher This is for pretending my browser's a phone. I don't generally bother spoofing the UA string, but maybe I should. >HTTPS everywhere Works fine. Not terribly useful because I tend to pay attention to the SSL status anyway. I guess I'm still looking for a good way to deal with cookies. uMatrix can block them which is fine 90% of the time. It would be nice to have finer control over the cache itself. uMatrix just downloads cookies normally but doesn't send them back in subsequent requests.

>>3189 note, you can configure umatrix to not accept cookies at all.

>>3192 ah i didn't know that. i just remembered reading a bug report bitching about it a while ago. is there any reason why this behavior would be better than the default? i imagine some sites might update the third party cookie which could later be retrieved if you visit that site directly? plus you just might not want to clog up your cookie cache with useless soykaf.

>>3189 >I guess I'm still looking for a good way to deal with cookies. uMatrix can block them which is fine 90% of the time. It would be nice to have finer control over the cache itself yeah there's the argument of pure bloat, which goes against cookies as a whole, because they just allow you to make a few less clicks with the price of making your browser fuarrrk up your machine if it's not last (or close to that) generation. But from the perspective of privacy, the best practice, I guess, is just having them as long as they're being useful, and sent them their own way when they couldn't do anything positive but analyze your usage. So Cookie AutoDelete is good enough, although unfortunately it's no Self Destructing Cookies, which would deal with cache as well. >User agent switcher >This is for pretending my browser's a phone. I don't generally bother spoofing the UA string, but maybe I should. Well yeah, as far as anonymity it does very little because there are other ways of finding out who you are ultimately, but as far as pure privacy goes, giving them fuarrrkers a hard job to create a profile of your habits, it goes a really long way. So I do suggest using something that can take care of that. Although something that can take care of that effectively, as Random Agent Spoofer did, seems to be a problem that wasn't solved yet.

>>3173 Privacy Settings is exactly what you want to install. Nice lil' gui to tweak various settings in a sec. Would recommend.

>>3195 :((((((((((

>>3196 Oh soykaf, that's a problem. I guess I'll stay on ESR a bit longer.. But keep hope : https://github.com/schomery/privacy-settings/issues/80

>>3173 >Random Agent Spoofer I don't know what to do about this either. Some people say the only thing you should do about fingerprinting is activate the about:config setting for "resist fingerprinting". But it just doesn't seem enough. People do say randomly changing user agent (and having suspiciously old agents in there) just makes things worse. Really irritating. Torbrowser seems the only browser that deals with fingerprinting but using it without Tor probably removes that benefit?

>>3198 The "resist fingerprinting" about:config option is actually an upstreamed feature from tor browser into mainline firefox. Turning it on is (more or less, apart from some minor things) equivalent to running tor browser without tor.

I just found out about this one. It doesn't seem to make any effect on my browser speed/responsiveness and it's backed by some legit research. Would recommend/10 https://paul.reviews/behavioral-profiling-the-password-you-cant-change/

>>3278 >I just found out about this one. That's very interesting, hadn't heard about this one. The article unfortunately only mentions a addon for Chromium, which even sounds like irony, going to such depths of privacy protection while running a product from Google. Let's hope they make the Firefox version promised in the article. Funniest part though was >Back in 2011, professor Christophe Rosenberger at ENSICAEN announced it was possible to determine the user's gender after just a few keystrokes. And we'll still have Humanities universities telling people that gender differences are cultural, lol, and a bunch of idiots believing it's monstrous not believing that nonsense.

>>3280 >Let's hope they make the Firefox version promised in the article. I'm running it right now. https://addons.mozilla.org/en-US/firefox/addon/behavioral-keyboard-privacy >And we'll still have Humanities universities telling people that gender differences are cultural, lol Nothing in the article indicates that that is false.

>>3173 This post has pretty good list of the most useful addons but I would like to add decentraleyes to the list https://github.com/Synzvato/decentraleyes decentraleyes is basically a local CDN.

>>3521 >I would like to add decentraleyes to the Maybe I'm being stupid here, but I'm not getting something about the addon and I've read their website and couldn't find an answer. Where exactly does it fecth the substitute info for the ones it blocked? They only say locally, but would that be your cache, or stuff that is bundled inside the addon? If it's the second case, which seems more likely, I fail to see how much they can stuff into it to actually work on a considerable number of cases, since a lot of what is delivered through cdn is very specific to that interaction. Would it be just some scripts and java soykaf? Also, what is everyone doing in terms of spoofing user agent given the questions mentioned earlier on the thread? Has any solution surfaced since?

>>3529 The addon comes bundled with various libs and stuff like font-awesome. See: https://github.com/Synzvato/decentraleyes/tree/master/resources If the addon doesn't provide the library that has been requested, then it will let the browser to fetch it from CDN (this can be blocked, if you wish). It's far from perfect, but at least it has the stuff that is most often used and when your browser has to get something from CDN, decentraleyes removes metadata from the request.

>>3549 >The addon comes bundled with various libs and stuff like font-awesome. Correction: It doesn't support fonts yet.

>>3529 >They only say locally, but would that be your cache, when you install the addon it's like 250 MB. I think it's all static data within the addon itself.

Its all placebo or backdoored for the feds, do not bother.

>>3172 >the most common opinion seems to always have been that firefox is the necessary evil Quantum is fast, and even before it there were significant steps in speeding it up to the same level of chrome. Most people just parrot opinions without knowing their soykaf they talk about. Then there are people with old busted Firefox profiles or crap addons that slow you. In a basic browser + uBlock only configuration Firefox is state of the art in security. Of course Google advocates like Ormandy will say otherwise. >muh payroll

>>3180 The Smart Referer add-on for Firefox by default will replace the referer with the domain that you are requesting. This seems to work better on sites that are picky about it. https://github.com/meh/smart-referer

https://github.com/ghacksuserjs/ghacks-user.js

>>5010 good luck with that, this soykaf breaks so many features that you will spend weeks to come getting certain useful sites working again.

>>5016 Really? I haven't had any problems with it except for location services (I wasn't able to allow firefox to tell a certain website my location), which personally isn't a big deal

This is what I'm doing; some of you might point out flaws addons: - Firefox multi-account containers - temporary containers - tree style tabs Then you can allow cookies without really worrying about it. Every new tab (ctrl+t or new tab button) opens up a tab in a new container, so websites can't see cookies from any other containers. If you want to stay in the same container, use alt+x for a new tab. Use Tree style tabs so you can easily see which container you're running in. attaching a screenshot so you can see what I mean: I've kept all of my lainchan tabs in the same container in this example, but the twitter and github tabs are a different color You can assign certain websites to a specific container so that you don't have to keep logging in and out (banking, email) without compromising your privacy by keeping the cookies of every website you visit. Temporary containers addon cleans the container once you close the last tab in it, so managing/clearing different (anonymous/pseudonymous) identities is kinda automatic Also with the "Tab Unloader for Tree Style Tab" addon and middle-click (or periodically restarting firefox) you can keep your ram and cpu usage low, while still having a visual for like 20 different projects/research threads you have open.

chromium and firefox (and any other serious contenders) are overengineered and bloated, having this many people work on a software project (which is true for every major browser) is bound to overcomplicate it's every component. arguably browsers have many areas to look after, performance and security introduces more complexity with features like cryptography, indexing, caching and all that jazz. the web is ridiculously over engineered at this point, just look at all the soykaf you'd have to carefully consider if you wanted to support html5 features in its entirety: https://html5test.com/ (or literally any other testing site). I haven't even touched upon the horror that is javascript, I think by now everyone gets the point. my next gripe is the network stack the web operates on, which is a whole other realm of complication, dozens of RFC's each unfathomably long in length. I have dreams about implementing software I regularly use to demystify what is actually going on, but bejaysus, good luck trying to comply with the HTTP standard, let alone all the others. we've clearly strayed from the path of simplicity. to actually be on topic, like >>3172 said goolag has its tentacles in chromium and the project is of such large complexity that I don't trust any human being to understand how chromium is really designed at any given moment, firefox on the other hand is backed by a corporation that has shown several evil tendencies (default search engine revert for $$$, antifa funding (lol) and other reoccuring suspicions revolving around funding) and they're in the same boat as chromium regarding complexity. it doesnt help that mozilla is a *for profit organization* and mostly opaque about important issues like the EME DRM standard (I'm in line with bryan lunduke about this, I'm aware he's a meme but this is a good one https://hooktube.com/watch?v=qMALm1VthGY). as I've started growing more comfortable with linux I also replaced my browser with some of the more tech-savvy ones, for the longest of time I used qutebrowser, but with the webengine backend because of the hell that is python+qt in a project. deep down in my heart was a desire to stop using all that bloat and just use [tabbed] surf, but I never quite got around hacking it to my liking (I know kms rn). the more I started to delve into the lesser known browsers and their communities/developer circles, the more I noticed how fundamentally broken the web really is. organizations/communities have big issues gathering enough manpower to parallel the likes of goolag chrome and firefox, they're always lagging behind not only in features but in support of standards. I don't mean the official standards, but the unspoken ones that get controlled by chrome and firefox. if those two were to agree on a "feature", some sort of specifiable interface for websoykaf programmers, its unofficially standard, due to the percentage of users that have access to that feature. these two browsers (and derivatives, which dont count because they leech the webengine development of the aforementioned two) are so ubiquitous amongst the millions of people interfacing with the wired, they control the web. plain and simple. on top of that comes the whole layer of usability issues and privacy issues, who the fuarrrk thought cookies were a good idea? who the fuarrrk thought javascript was a good idea? back when I had a smartphone I solely used naked browser (stupidly simple) with javascript off, history off and cookies off. though it possible (at the time, I reckon the situation might have changed in 2017/18), it is by no standard pleasurable and at times just plain silly, certain websites even refuse to work intentionally! now I could agree many useful features are better implemented in javascript, and in such situations javascript can and should be used, however the incredible misuse of javascript to do so many unnecessary tasks (ie. every news site ever, why the fuarrrk would I need javascript to view text and images) gives me a good enough of a reason to just scrap the idea of interfacing with certain websites. to better support my argument, take a look at this HTML only website: http://motherfuckingwebsite.com/ it does everything it needs to do, convey information via text. arguably, some information is better represented visually, I agree. this is what the CSS spec was made for. in the case of news sites, they also benefit from increased readability of the medium, in which's case CSS could also be used. just take a look at: http://bettermotherfuckingwebsite.com/ only 7 (!) CSS declarations and the website is inexplicably infinitely more beautiful and simple than literally every trash piece of a biased news site is, by *not* bloating the medium. I probably I made it clear for everyone with the above that I think the web is a lost cause. I cannot deny the importance of communication and the exchange of information, but the price we pay is having to use bloated software and nonfree software/outright human rights defying software. I am utterly disgusted at the idea of supporting these botnets. what can we do? everyone probably would agree that we *still somehow need to access the web*, and for that we have to support all these standards, implement a bloated network stack and god knows, which defeats my point. after discarding my smartphone several months ago and going back to my inner roots, trying to disconnect from the wired in general, I found the solution to be simply no interaction with the web at all. news sites are soykaf? do not ever visit a news site. same holds true for all these botnet services. as the web is nowadays mostly an aggregation of mainstream services, by ridding my life of their presence, I reduced the amount of time I spend interfacing with the web greatly. I only go on the web when I have a problem I really cannot solve, need a crucial piece of information and very occasional leisure activities. basically when > linux broke > I absolutely NEED to access some content on youtube, for which I youtube-dl/hooktube reluctantly > going to my favorite chans I generally dont watch youtube except if I know I can't get some piece of information elsewhere (this old habit of mine I found to be a massive waste of time regardless). I don't browse reddit anymore. I don't read any news at all. Facebook and the like I never even registered for. that's basically it. now, somebody with a least amount of critical thinking is going to point out that I am in fact restricting the amount of information I have access to, and that other people have an advantage over me regarding this access of information by putting up with bloat/giving up their rights. in a sense, that is true. I don't get to see silly memes everyday any more, no mainstream social, no daily video entertainment, but this does not necessarily make me any intellectually less enriched person. what I think makes people reluctant to follow my steps is that they fear to become shallow. all these websites I am avoiding offer content that gives them thoughts of others, impulses to indulge in deep thought and critical thinking and prove their worth as a intellectual human being to themselves. I certainly was when I got rid of my smartphone. but the very simple answer is, that does not happen. if you fill up the free time with actual social contact, education using actual printed literature and many other real life things, there will be enough intellectual stimulation regardless. (this paragraph is going to sound odd to many people now that I reread it but I hope you get the point) what else to say. I hate the web as it is. nobrainer. if people magically started adopting less suck-y alternatives (like gopher for the network stack, I was really intrigued to see how gopher worked when I read the zine), my deepest desire to the watch the web burn might wane, but I know that is wishful thinking. after all this time I was searching for an answer. there isn't any. I genuinely believe adjusting my outset on how I want to interact with the web and browsing habits, choosing to NOT interact with the web most of the time, was and is the only right decision to make to date. it would take impressive arguments to convince me otherwise at this point. last thing I want to say (wew lad this got long), I switched to luakit, which is the best compromise between usability and suckless I found to date. I can live with webkit. I have personal inclinations to live contempt with lua, as I think it is quite the awesome dynamic language. I can hack up any features I want, or learn to do so. even though it has its own issues (memory usage is still crappy, drm content and other nuisances), even though I am aware of the issues regarding my very unique fingerprint and not having a bleeding edge browser that supposedly patches newer security issues, I do not have to care. I only visit websites I think I trust or are worthwhile visiting, and I don't visit many websites overall. if only lain could tell me how we could improve this miserable world we live in, I'm open to ideas.

>>5055 The web doesn't really have to change, you just need to be less fragile. You're throwing a fit at non-issues by cherrypicking them. It is not hard to find a new ecosystem. The blogosphere has people with designs like the "motherfuckingwebsite.com" and you ignore them. >that I think the web is a lost cause Nah it will evolve even without your blessings your good words. >after discarding my smartphone several months ago and going back to my inner roots, trying to disconnect from the wired in general, I found the solution to be simply no interaction with the web at all. See this is what I mean, you tilted. It's like going to the supermarket in UK and saying: "What moron eats pork brains, stop selling them! Bwaaah, bwaaah." Instead lainon, you could have just walked past the shelves with the saucy high cholesterol pork brains and bought some chill ice cream instead. Vanilla flavoured! Not the soykafty ones with JavaScript beans inside. This whole website is just an echochamber, JS free blogs are just a safespace, but so what. They are fuarrrking great. >if only lain could tell me how we could improve this miserable world we live in, I'm open to ideas All you have to do is calm down, you are experiencing already symptoms of depression because of it.

>>5055 >to actually be on topic, your whole post was off-topic ppl here are complaining about how 'broken' the web is on countless other threads, lain

>>5055 > mozilla [...] antifa funding (lol) Funding RiseUp != funding antifa. They do a hell of a lot more than just provide an email hosting service. Just off the top of my head, they run the Tails Redmine instance. And even if it were, fuarrrk fascism.(Do not spill soykaf.)

>>5072 >antifa >anti fascist >literal "reactionary" and they call the right wing reactionary, lmao

>>5072 not agreeing or disagreeing with you, just remarking for the other readers that they are an anarchist group.

>>5072 Yes, nothing says fuarrrk fascism like old liberal money, socialists, and doublespeak. To be fair, racism and sexism is definitely a thing in the US I just think if you're particularly fanatic to the point of radicalism, you're the same thing as the other guys, just dressed differently. Tying this up into the OP though: I don't give a soykaf who you are, you deserve privacy especially in communication. Really, if their investigation is so bad that they are reliant on browser fingerprinting, they fuarrrked up worse than you did. How admissible is a browser fingerprint in a court of law, though?

>>5056 you are exactly right, I do restrict the sites I visit based on what I think is well designed/worthwile arbitrarily, but this gets a problem as soon as there are no viable alternatives for bloated websites. want to watch a video? too bad youtube is bloated. want to watch a stream? good luck trying to find someone who cares to use alternative platforms. I'm still free to choose not to interact with these, which is the point of my post and what I'm doing >>5058 damn lainon you're mostly right. I still think there is some merit in my post however. I restrict sites I visit on the basis of a couple principles, bloat, openness and respect of privacy. the best way to protect my privacy from privacy disrespecting website is to simply not visit these sites (the entire point of my post xd). I can go to google.com and try to maximize my privacy by throwing even more plugins and other js at my browser, or I can simply not visit google.com and not worry about what it collects from me. >>5072 not saying you're wrong, I was listing lunduke's points off the top of my head and didn't exactly agree that funding riseup makes mozilla untrustworthy. they're still indirectly funding antifa though by funding the platform they operate on. granted they would run off to any other platform in case riseup dies but case in point, mozilla was keeping the platform alive antifa runs on. I do think the other funding related issues (taking money from untrusted third parties instead of giving) are a lot more important.

>>5085 >>5084 What an odd coincidence when in doubt: def random(): return 4

>>5085 reminder that "antifa" is not an organization

>>5085 >I was listing lunduke's points off the top of my head and didn't exactly agree that funding riseup makes mozilla untrustworthy. they're still indirectly funding antifa though by funding the platform they operate on I don't think that was the point. The point was that Riseup selectively offers free services only to arbitrary political causes that they personally agree with (which is fine) and by donating money to Riseup, Mozilla is now displaying a very concrete political stance (not fine). Mozilla is supposed to be about the open web nothing more. >>5072 >And even if it were, fuarrrk fascism. You might find that antifa's definition of fascism is very twisted and inconsistent. They're an extreme Left organization first, and anti-fascist second, so in reality they are only really anti-white-supremacist. None-white fascist ideologies don't get so much as raised eyebrow from these hypocrites,

>>5088 reminder that "antifa" is, in fact, centralized locally and nationally. Saying it's not an organization is akin to saying "Anonymous" is not an organization in 2009. Yes, the idea isn't, the practice is.

>>5099 If they truly were anti-fascist they would be rioting at mosques not universities.

As much as I hate to agree with you, I think your right about the web being a lost cause. There just simply isn't a way the majority of the population will start rejecting it. I don't know but i guess the best we can do is keep our corner of the web JavaScript free, HTML4 compliant, and properly TLS terminated.

>>5115 Doesn't posting require Javascript?

>>5113 >reminder that "antifa" is, in fact, centralized locally and nationally. any proof to back this up? I've never *ever* seen an antifa organization that a) was externally funded and b) had more than about 25 full-time members.

>>5117 >SHOW ME THE PROOHFS! Oh look, it's [citation needed]-Man again. Antifa was practically non-existent in the US before 2016. While it's true that ANTIFA is decentralized in Europe that doesn't apply to the US where ANTIFA was organized by left-wing think tanks. >>5099 >None-white fascist ideologies don't get so much as raised eyebrow from these hypocrites Not really surprising, given the fact that ANTIFA hates white people. They openly supports ISIS and they both pursue similar eschatological goals.

>>5118 Holy soykaf, you realize that the people in that photo are revolutionary kurds who are showing solidarity with ANTIFA by waving the flag in front of an ISIS flag that they have stolen after victory in battle in Daesh? You are extremely misinformed and should fact check your posts before blabbering. Source: my photo, jesus christ some people are so ridiculous lol

>>5117 While the person replying to you is clearly uneducated on the subject, there are city-based ANTIFA groups that have frequent members and are funded by leftist fundraisers, community outreach, etc. Source: I live in a city where there is a very active ANTIFA group and I know people who contribute.

>>5119 Beat me to it. Still waiting on evidence for the previous claim. Mocking a request for evidence is not evidence.

>>5119 Calm down. This person is obviously trolling.

>>5122 Trolling really successfully at indirectly legitimizing Antifa. That's a pleasant change of normality. What else, /p0l/ 'trolling' with replying to IDpollers with Marxist critiques of capitalist society? I can't wait!

>>5118 >Antifa was practically non-existent in the US before 2016. weird, I remember participating in major anti-fascist activity in 2004. >>5120 yes, I know that, they were claiming external funding though. I wouldn't call community outreach or leftist fundraisers external.

>>5117 Just look on twitter. Every city has a $(CITY-NAME)antifa handle. I just want to expand on what I meant when I said >centralized locally and nationally. There are managed online presences that are run by people calling themselves an antifa organization, claiming to have some organizational "jurisdiction" in their cities. You can see, on several pages like this, they follow other online "city antifa" pages. >https://twitter.com/berkeleyantifa/following?lang=en >https://twitter.com/ElmCityAntifa?lang=en Now, I see what you're saying and I agree, it's very very loosely NOT an organization, but the second people can, generally they will form groups even when the whole point is to be "decentralized" and a "movement." > a) was externally funded I never said it was. Alcoholics Anonymous isn't funded externally either, and by that I simply mean a donations-only income is plainly feasible. > b) had more than about 25 full-time members Now, that one I just don't know, and I'd say you're right. I don't get into groups or meetings of really any kind of activist stuff on either side, so I just don't know.

>>5120 Clearly uneducated on the subject? Interesting how you say that and then go on to make my point.

>>5115 it's sad isn't it

Antifa is as old as fa. It just had different names, like SHARP.

>>3181 >>3188 I switched to uMatrix personally since noscript was whitelisting things globally, while uMatrix was whitelisting them on a per site basis, I might want google scripts on google for instance, but not on other sites. Just be sure to set it to disable all javascript and configure the sites from there.

>>5125 I used to be slightly involved in antifa (I'm not any more), although there are various levels of formality, anyone can turn up to events, or give information on fascists. And anyone can leave at any time. In fact there's also infighting in antifa groups usually between anarcho-nihilist types and social justice types. Either way I think the whole fa vs antifa game is just amusing now and stay on the outside watching with popcorn in hand.

>>5139 It's an absurd situation. A bit worrisome too. These sorts of clashes correlate with the rise of totalitarianism. And that always ends up one way, with someone against a wall.

Stop discussing irrelevant topics here.

>>5010 >>5016 You do have to set it up, I did this it's pretty easy, it's well documented. They also have a decent wiki with extensions etc. Would recommend.

>>5085 >want to watch a video? too bad youtube is bloated. want to watch a stream? good luck trying to find someone who cares to use alternative platforms. So then the question becomes, "How do we get people to use alternative hosting platforms?" I think the most obvious answers are talking them up irl and hosting content on them ourselves.

Whats the essential list for the new firefox?

>>6446 the only absolutely essential Add-Ons are ublock origin and decentraleyes imo

>>6540 Do either of those offer xss protection? Running some kind of js blocker, even with a blacklist config rather than whitelist, is pretty essential at this point IMO, since noscript and umatrix do a decent job of filtering obviously malicious soykaf even if you don't fiddle around with per-site whitelists. Of course with the way Firefox is going these days, that might be a built in feature at this point.. idk how the new "tracking protection" thing works.

>>5194 >I think the most obvious answers are talking them up irl and hosting content on them ourselves. Yeah its good to advocate for this, but more practically speaking the easiest solutions are proxies and mirrors that respect your privacy.

>>6546 "tracking protection" just stops basic trackers and ads. It's slightly faster than most addons but it's best to leave it off and run umatrix instead

I use tor-browser with strict settings for everything except- *a website doesn't allow tor & must submit a form *have to render something from localhost blocked static websites / http sites are easy enough to render with web proxies like morty or search engine / wayback caching javascript, 3rd party cookies, headers you are sending, and the various other storage mechanisms of the browser seem to be the main (but not only) culprits. Not to mention if your browser is working against you. It angers me so what they are doing to Firefox ESR.

I figured reducing the number of addons I use would be a good idea for security so that fewer people have permissions in my browser. Currently I'm using just uBlock Origin and uMatrix set to block all scripts by default. I also set all Firefox options in the Privacy & Security section to the strictest possible. And all browsing is proxied through Tor. I might re-install HTTPS Everywhere since I sometimes catch myself browsing some site with http when https is available. I also recommend Privacy Badger for anyone who wants some level of tracking protection with minimal fuss. BTW, I get pic related sometimes because of Tor. Would be nice if something could be done about that.

I recommend setting privacy.resistFingerprinting to true in about:config. I had a pretty unique fingerprint in http://panopticlick.eff.org thanks to my BSD user agent and that helped a lot. There's more stuff worth trying here: https://wiki.mozilla.org/Privacy/Privacy_Task_Force/firefox_about_config_privacy_tweeks

>>6815 >User Agent: 1 in 17971.95 >Hash of canvas fingerprint: 1 in 1482685.5 >Hash of WebGL fingerprint: 1 in 134789.59 I tested mine. Is there a way to match other's hashes? I know I can change my user agent without issue.

>>6816 Disable javascript to prevent canvas and webgl fingerprinting. The user agent string will be changed to a common one by the privacy.resistFingerprinting option.

>>6816 Apparently the Brave browser always sends the same canvas and WebGL fingerprint. So all Brave users look the same. I don't use it because I don't want to use a non-Gecko browser, so I don't know anything else about it, but it might be a good option if you don't care about that.

I don't get why people just use TBB with security slider set to maximum. I personally use TBB on a Linux machine most of the time and switch to my Windows computer, that is on a different network than the Linux one, to do the stuff that is already tied to my real identity (banking, crypto trading etc.)

>>6824 *just don't use TBB

>>6824 > I don't get why people just use TBB with security slider set to maximum. Because they have a different threat model than you do?

ALL extensions are anti-privacy. If you use a SINGLE extension, you are less private than the average person. Look up fingerprinting, your extensions just make it worse. As do your "privacy protecting" forks like Icecat and """""""'Ungoogled""""""" Chromium. Want REAL privacy? Modify stock Firefox to resist fingerprinting. Icecat, Privacy Possum, ublock, Decentraleyes, etc. make you stick out like a fuarrrking sore thumb.

I've been testing out the Antidetect browser lately and it's good. Instead of disabling WebRTC you can spoof an IP for STUN servers, making a false WebRTC leak. Unfortunately it's targeted at fraudsters and carders, it's not FOSS and it's expensive. If only there was a similar open-source browser that isn't made by criminals.

Those randomized browser spoofing addons have very esoteric default databases. If you use one limit the database to popular browsers first or you will only stick out more with strings that less then 1% uses. That aside in the current web you need to spoof hardware in JS because too many sites don't work without js but if you allow it they can read out hardware ids. Sound driver data was one of the example i read about being a very good identifier somehow. Does anyone know if you can overwrite native js functions in the browser with a browser or do you need to create a fork from source?

>>6933 *can you overwrite browser native JS functions with a browser addon or do you need to do that in the browsers source code and create a fork?

>>3173 >ublock origin Its good for cosmetic filtering i guess but umatrix alone is enough >https everywhere Smart https is better since it doesnt rely on a list and assumes all websites are using https and automatically reverts back to http if it doesnt. >cookie and deleting addons You can do it with umatrix anyway. No need for 3 more addons. >user-agent switcher I found an addon called chameleon recently that spoofs or blocks many things on top of changing the user agent. Other addons i recommend goes like this Alternate Tube Redirector: Redirects all youtube videos to invidio.us CanvasBlocker: Spoofs canvas js to prevent fingerprinting CSS Exfil Protection: Self explanatory Decentraleyes: Prevents connecting to CDNs by keeping it locally Invidious Embed: Replaces embed youtube videos with invidio.us Neat URL: Removes certain parameters from the url Privacy Possum: From the developer of the privacy badger and its better than privacy badger Skip Redirect: Self explanatory Universal Bypass: Skips link shorteners WebAPI Manager: Blocks websites from accessing browsers certain functionalities

>>6935 this is a good list. Many great addons that I've never heard of. Thank you lain.

>>6935 >Its good for cosmetic filtering i guess but umatrix alone is enough This is the main reason I use both. Ublock is an element blocker that happens be configured to block ads, but it works great for blocking all kind of annoying things - those EU cookie popups, "get the app" popups, poorly implemented paywalls, large images, auto playing videos, the fuarrrking lain-snow on this site.

>>6937 >poorly implemented paywalls not privacy related but i use this addon for that. its great. https://github.com/iamadamdev/bypass-paywalls-firefox https://github.com/iamadamdev/bypass-paywalls-chrome

>Privacy addons No such thing The EFF and TOR both recommend against add-ons The most private thing in the world is stock TOR browser The second most private thing in the world is stock FireFox, but with unsolicited Mozilla connection, fingerprinting, etc. turned off in about:config Anything else is the opposite of private and you might as well be handing over your entire existence to Google on a silver platter thanks to fingerprinting. Stock Google Chrome is infinitely more private than some minor Firefox port with a billion extensions only you use that single you out and increase your attack surface. It's better to let ads and other such things play than to try to block them. "Privacy focused browsing" is a placebo that does the opposite of what you want.

>>7120 can you explain what you mean? If I'm running ublock origin or something on Firefox how does that make me dramatically less secure than stock Chrome?

>>7151 It can as in websites trying to stablish a connection to a third party and you block it so there is a chance from knowing who you block. It would`nt be a concern if everyone used it tho so shame on the Tor project for not incluiding it, there is no thing as breaking functionallity and in the rare case it does you could simply disable it for that rare case.

>>7120 This is one of those guys who think that blending in the masses is better than lowering your exposure. Being fingerprinted is futile if you cannot be traced to your real identity, and this is the reason why using a torified firefox with the right extensions is better than stock chrome. TBB intends to use both approaches. I would not reccomend that blending with the masses ´cause the masses are expected to have a google account and to push that like button, not doing that would mark you as suspicious right away also to successfully blend with the masses you would have to use windows or a phone. To that point you could conglaturate you for prooving being as exposed as the regular tech illiterate.

>>7120 -how does having extensions single you out when you have addon enumeration and javascript disabled -how do they increase the already gigantic attack surface of a web browser -why does letting ads play not identify you when they're often times getting info not about your browser, but about your computer?

>>7120 VM01: Tor on Safest security settings. VM02: Tor on Standard security settings. VM03: Anonymous use-case Firefox with settings and addons suggested at privacytools.io. VM04: Personal use-case Firefox, same as above. etc...

I remember reading somewhere that Stallman has a remote server to fetch websites and email them back to him. Personally, I'm using Tor Browser on safest settings and force TLS. Any customization beyond that would single me out so I'm not messing with anything else at the moment. I also considered using Lynx but eh, I need muh CSS. Also, Lynx apparently doesn't support hidden services according to Tor's website.

>>7164 >I remember reading somewhere that Stallman has a remote server to fetch websites and email them back to him. https://stallman.org/stallman-computing.html >I am careful in how I use the Internet. >I generally do not connect to web sites from my own machine, aside from a few sites I have some special relationship with. I usually fetch web pages from other sites by sending mail to a program (see https://git.savannah.gnu.org/git/womb/hacks.git) that fetches them, much like wget, and then mails them back to me. Then I look at them using a web browser, unless it is easy to see the text in the HTML page directly. I usually try lynx first, then a graphical browser if the page needs it (using konqueror, which won't fetch from other sites in such a situation). >I occasionally also browse unrelated sites using IceCat via Tor. Except for rare cases, I do not identify myself to them. I think that is enough to prevent my browsing from being connected with me. IceCat blocks tracking tags and most fingerprinting methods. >I never pay for anything on the Web, because I cannot pay anonymously. Anything on the net that requires payment that would identify me, I don't do. (I made an exception for the fees for the stallman.org domain, since that is connected with me anyway.) >I avoid paying with credit cards generally. For freedom's sake, insist on paying cash. When a business pressures you to pay in an identified way, it's your chance to defend freedom by saying, "If you won't take my cash, no sale!"

>>7151 >>7155 >>7156 I know it's hard to cope with the fact that Google knows literally everything you have ever done, but allow me to give you the brutal truth surrounding your delusional privacy. Spoofing fingerprinting doesn't actually make you look like what you think it does. It makes it 10000% obvious that you are spoofing fingerprinting. Do you want to know how many people do this? Next to none. So it would have been better to let your stock fingerprint run. Next, nobody uses adblocking extensions outside of some deluded privacy searchers who have yet to figure out the truth. Therefore, the amount of people blocking soykaf for security is very small. So small that you can be traced easily throughout the internet. The FBI, NSA, Google, China, etc. know everything you have ever done because you were tricked into thinking that extensions would help rather than single you out. Your "hardened" Icecat is one of a kind. Everyone knows what you were doing with it. It is not private. It is not secure. Some of you even get really stupid and do things like edit the pages to replace URLs with "safer alternatives" like replacing YouTube with Invidio.us/hooktube/etc. Nobody does this except for you and a handful of others. You can easily be tracked. Your browser reports all these weird addons to the pages they visit. about:config in FF can do everything you need from a browser side; everything else can be done manually with infinitely more security (just add the other end of the YT url to your mirror's website or use mpv for fuarrrk's sake) Do you want REAL security and privacy? Use stock Tor and stock Firefox configured to look like Tor. That's the only private browser that can exist. Stock Google Chrome is safer than memes like Icecat, Waterfox, whatever the fuarrrk psyops on 4chan have tricked you into thinking are good. The only add-ons that are okay are the ones Tor ships with by default like NoScript and HTTPS Everywhere, everything else is handing over your entire web presence to every data broker in existence. Stock Chrome would be safer because you would at least partially blend in with the countless stock Chrome users. Read Tor and EFF writeups on entropy and realize how you all shot yourselves in the foot. Google and the NSA's profile on your Mom is less comprehensive than your profile. >b-but panopticlick/amiunique/etc. said- The only people who use these are other people who fell for the same memes you did. In the real world, you stand out like a clown at a funeral.

>>7271 >It makes it 10000% obvious that you are spoofing fingerprinting. I have yet to see this assertion ever backed up with evidence. And I have seen it many times.

>>7273 let's think of some ways we can test this. it's a good opportunity to think seriously about it, and you can prove that your arguments about ricing up a web browser with tactical anti-surveillance plugins are doing more than propping up an ideology.

>>7271 not who you were replying to, but personally even using all the meme addons, i fully recognize that it's placebo and that so much is known about me, but I hold that placebo dearly because it's lying to oneself because the truth is not only shocking but destroying, everything you looked at on the internet will haunt you. terribly scary

>>7271 >Next, nobody uses adblocking extensions outside of some deluded privacy searchers who have yet to figure out the truth. There are nomal people who use adblocking extensions to block ads, wtf you talking bro, at least on PC anyone who does not care about the people who monetize YT vids and webpages do use adblockers. >Your "hardened" Icecat is one of a kind. Everyone knows what you were doing with it. It is not private. It is not secure. I do not even use Icecat, and only used it once at work on a windows machine. It is only a rebranded FF. It may not resist against fingerptinting, but how can anyone know what am I doing, in the case that you end up fingerprinted, your privacy is affected, not your security, in regular firefox they may also and more possibly have some 0days. You are a fool for beliveing that in about:config you can 'disable' fingerpeinting. >(just add the other end of the YT url to your mirror's website or use mpv for fuarrrk's sake) I advise against the mpv trick when being a Tor user as it does not uses proxys correctly when using https URLs. Plain youtube-dl is the way to go.

>>7271 You're also making a huge blunder by confusing privacy and security. the fact that your "fingerprint" is unique seems pretty moot since it does work when the aim is to kill any targeted content. There are multiple parts to one's privacy. Privacy of what you post and of your personal info is preserved by posting on safe sites and not posting your personal info. When I post on lainchan there's no captcha on the page, so goolag doesn't link the reply to my "unique fingerprint". My fingerprint doesn't matter since targeted content doesn't look that deep. Everytimes I load yotube or a shopping site the ads and suggested content are what a first time user would see. And it's very bad. And thus I only do what I wanted to do instead of falling into a clickhole. For instance before I did this I realised youtube had tricked me into listening to the same music over and over what's more the same artists as family members and friends that used to have unrelated tastes (fuarrrking buena vista social club). As for opsec, I don't operate (or do I?) but if I wouldn't rely on addons, but you knew that since it's the fuarrrking op. Now maybe the content served to me is in fact tailored and I've been directed to lainchan by reptilian overlords trying to make a paranoid mess out of me. Excuse me if I've chosen not to believe that theory.

>>7274 well your argument is basically "addons which thwart known fingerprinting methods actually make it easier to fingerprint you", which I think is what requires proof here.

>use mpv/youtube-dl to watch youtube videos untracked Present Day, Present Time! AHAHAHAHAHA! -you already navigated to that video, or got close enough that the difference is tiny, in a normal web browser -youtube-dl definitely doesn't perfectly mimic a web browser -it also blocks ads please, don't go around saying these blatant falsehoods. For privacy: have a browser profile rice'd out with all the latest anti-tracking measures, making sure to block JS from untrusted domains, and have another for when you want to be a normal person. I guarantee you, soykaf won't bleed over, especially if you're using a VPN.

>>7343 i think he talks about not including the videos watched from youtube-dl in his browser-profile, but yeah they have a linux-profile about him.

>>7344 Isn't that what UA spoofing is for? I get that it's counterproductive to use their soykaf default lists. But setting it up to use a single UA string with windows 10/[whatever mainstream browser yours is a fork of] should work. Ig the fingerprinting can still gain some insight on your harware via your window size but eh.

>>7344 the thing is that to get the link into youtube-dl, he already navigated to a page where he could get the link from youtube. It's not hard to guess from there what video you're watching.

>>7347 I made this tool that attempts to address this problem: https://github.com/user234683/youtube-local Subscriptions are the next feature

>>7357 Looks nice and well explained. Just a minor nitpick. >Using Tor is optional; when not routing through Tor, video pages load faster than they do with Youtube's laggy javascript page (for me atleast). Are you saying that routing through Tor is faster or slower than normal YT? "Youtube's laggy javascript page" make it sounds like it is slower but at the same time you are saying not using Tor makes loading slower.

>>7358 >Are you saying that routing through Tor is faster or slower than normal YT? Going through Tor is slower than regular Youtube due to the latency of Tor (this is network slowness rather than the computational slowness of the Youtube page). I'll clarify that. I've found out that the Youtube page is very slow on Firefox or its forks due to Youtube's heavy usage of something called the "shadow DOM". I'm not sure what this situation is on the latest firefox versions. I've recently added persistent connection pooling for the next version which has helped a lot with the latency problem since it doesn't have to constantly repeat the TLS handshake for every request.

>>7347 >>7357 https://github.com/mps-youtube/mps-youtube There is also this.

Some lesser known ones: >HTTPZ https://addons.mozilla.org/en-US/firefox/addon/httpz/ An improvement over Smart HTTPS. >ClearURLs https://addons.mozilla.org/en-US/firefox/addon/clearurls/ Like NeatURL, but even more comprehensive >Temporary Containers https://addons.mozilla.org/en-US/firefox/addon/temporary-containers/ Has most of the functionality of flipping the first party isolation config switch while preventing broken websites. >Header Editor https://addons.mozilla.org/en-US/firefox/addon/header-editor/ Lets you control your headers.

>>7358 He's saying that they are both slow in different ways. Through Tor it's slow to download the content. In FF the page loads faster, but it runs slow, because of the crazy amount of JS.