Skip Navigation

Does it even make sense to care about privacy?

Heyha !

This is probably going to be long take and it's late here in europe... So for those who bare with me and are ready to read through my broken English, thank you.

I'm personally concerned about how my data and my identity is used against my will while surfing the web or using/hosting services. Self-hoster and networking enthousiast, I have some entry/medium security infrastructure.

Ranging from self-hosted adblocker, dns, router, vlans, containers, server, firewall, wireguard, VPN... you name it ! I was pretty happy to see all my traffic being encrypted through wireshark and having what I consider a solid homelab.

Also having most undesired dns/ads blocked with adguard in firefox with custom configuration, blocking everything, and changing some about:config options:

  • privacy.resistFingerprinting
  • privacy.trackingprotection.fingerprinting.enabled
  • ...

I though I had some pretty harden security and safe browsing experience, but oh my I was wrong...

From pixel tracking, to WebRTC leaking your real ip, fonts fingreprinting, canvas fingreprinting, audio fingerprinting, android default keyboard sending samples, ssl certificate with known vulnerabilities...

And most of them are not even some new tracking tech... I mean even firefox 54 was aware of most of these way of fingerprinting the user, and it makes me feel firefox is just another hidden evil-corp hiding with a fancy privacy facade ! Uhhg...

And even if you somehow randomize those fingerprint, user-agent and block most of those things, this makes you stand out of the mass and makes you even easier to track or fingerprint. Yeah something I read recently and it actually make sense... the best way to be somehow invisible is actually to blend into the mass... If you stand out, you are pretty sure to be notices and identified (if that makes sense :/)

This really makes me depressed right now... It feels like a losing battle where my energy is just being wasted to try to have some privacy and anonimity on the web... While fighting against the new laws ringing on our doors and big tech company always having two steps ahead...

I'm really asking myself if it really matters and if it actually make sense to use harden technology or browsers like arkenfox or the tor browser whose end node are mostly intercepted by private institutions and governemental institutions...

I'm probably overthinking and falling into a deep hole... But the more i dig into security and privacy, the more I get the feeling that this is an already lost battle against big tech...

Some recent source:

https://avoidthehack.com/firefox-privacy-config

32
32 comments
  • That is all about threat models, which people usually define wrong. They do crazy things, very inconvenient things, than get depressed, fall in deep hole as you say and so on. But if you read a lot about privacy/security, and I mean not reddit with dumb comments (like mine, yeah), you will slowly get the whole picture.. Keep calm, find compromises between convenience and privacy, understand personal and non-personal data, telemetry data, etc. Do not overthink they want to know about you everything. They do not actually.

    30
    • Do not overthink they want to know about you everything.

      That's true, they probably already have everything they need... It's not only about my personal data, and my example only points out to the web technology, but everywhere around us are some data hoarding devices that are either used to targeted ads, campaign, profiling, IA dataset feeding... whatever !

      It feels like we already lost our right to privacy and how personal data, telemetry is used as a whole in our society...

      2
      • No. Most data collected are not personal. Think about telemetry in Firefox, it is anonymous data how people use browser, it helps developers to understand what users do, what should be improved or not, so privacy oriented paranoids turn it off and devs do things for those, who use it dumb way, and we are not happy about it. So telemetry is not your enemy, it helps both devs and users. I turn it off, too, lol. Now Firefox Account collects tons of data, it is a spy tool and it collects personal data, too. LibreWolf turns it off by default, BTW. Anyeay I use Firefox account, I am not that much paranoid after all. But my main browser is Brave, their Sync is done right way, it is accountless, no personal data collected. Even their telemetry done right way, I forgot how they call it, but it drops any data that could potentially identify particular person if his results stands out.

        What exactly we lost? Fight is always on! One year ago I was using all Google products, now mostly none. I dont like being under survivalance and whatever I do for it, it counts against them!

        7
  • Edit: Crossed out slightly out of date recommendations, see comments.


    Do not confuse privacy with anonymity. Your goal is not to defend against governments or other entities with limitless resourced, but against profit oriented companies. By reducing the amount of data you leak and obfuscating what is left, your data becomes progressively worthless as you improve your setup. This is a good thing, because companies will focus their limited resources on areas with a higher profit margin.

    Given your description, I think the network side of IT security is pretty much top notch, firmly in the top 0.1% if not 0.01% of users. However most of the tracking happens at the browser level, so it alone does not protect you that much.

    Firefox is a solid base, but it is optimized to not break any websites, rather then providing maximum privacy. You can try to tweak settings manually, but I'd rather recommend you to use LibreWolf on PC and Mull on Android. Both are pre-configure, hardened versions of Firefox, that also have proprietary Mozilla features like "Pocket" and some telemetry removed form the source. A standard install has basically no downsides, 99.9% of sites work normally and privacy is quite good.

    Librewolf has ublock origin pre-installed and pre-configured with sane defaults. I'd recommend the following additional addons:

    • Decentraleyes: Local CDC cache to reduce third party requests. Improves privacy, performance and doesn't break anything. No configuration needed.
    • Privacy Badger: Prevents some interactive features (disqus comment section, embedded youtube player, etc) from loading until explicitly confirmed with a mouse click. Also prevents some tracking in the background, but that might eb covered by ublock already.
    • Cookie AutoDelete + I still don't care about cookies: This combo silently suppresses all cookie pop-ups, allows them for the session and cleans up afterwards. This is different then disabling all cookies, and does not brake websites then rely on them while providing all privacy benefits.
    • Disable WebRTC: WebRTC can leak your IP address, but disabling it breaks eg. real-time video calls. This plugin is a simple toggle, only turn it on when you need to.

    If you are willing to do some fine tuning or accept broken sites, consider also:

    • noscript: Most privacy leaks happen because of Javascript, but disabling it basically makes the modern web unusable. noscript offers a middle ground to enable/disable javascript on a domain-by-domain basis. Can be annoying at times, but arguably the best way to defend yourself.
    • Canvas Blocker: WebGL powers most of the advanced visuals, and can read out a lot of data that is used for fingerprinting. This plugin can randomized requested data to protect you, but it also brakes sites in weird and unexpected ways. It's powerful, but I rarely use it these days.

    And finally consider some obfuscation techniques to throw of the remaining trackers. Right now I only use one, and highly recommend it because of its effectiveness:

    • Font Fingerprint Defender: Using javascript, websites can read out the list of installed fonts on your device. Some programs install fonts in the background when opening a document with missing fonts, so this list is highly unique for each user and effective for tracking. The plugin throws is some noise, and causes automatic systems to detect you as a new unique user each time.

    All of this throws off the vast majority of trackers, and puts you in the top 0.1% of users. Yes, this also makes you kinda "unique", because websites may notice the effort you put in to defend yourself. Bad idea if you try to hide from the government, you should be using TOR for that anyway, but great to signal companies that you are not worth the squeeze.

    Keep your head up bro. The situation is not as terrible as it may seem, but companies want you to believe that, so that you don't even try.

    21
    • Some of your recommendations on extensions are a bit out of date

      5
      • Thanks for the heads up, my setup is indeed 6-12 months old. My thoughts on the linked list:

        • uBlock origin is the #1 recommended plugin, and can make some other plugins redundent, see below
        • Decentraleyes only helps only for some scripts/sites and may be fingerprintable. Considering that it targets major CDNs and it's widespread use, I still think it's benefits outweigh the possible downside, especially if used in conjunction with a good VPN, so its optional but I'd keep it.
        • Privacy Badger used to be unique in that it creates a custom blocking list based on your behavior. There was some security and privacy vulnerability with this method, so it's no longer done. It depends now solely on a pre-trained list just like uBlock origin, offers no additional features and should be removed.
        • Cookie extensions may give you a false sense of privacy as they do nothing for IP tracking or other vectors. However they do patch one area, and are useful if used correctly and together with other methods.
        • noscript is technically covered by uBlock origin as well, but the UI is far superior and you'll be using that a lot.
        • Canvas Blocker was an optional plugin to begin with, and starting Firefox 120 the FPP (Fingerprint Protection) can subtly randomize canvas, hopefully with less problems. You should be using this build in feature instead of the plugin.
        • Font Fingerprint Defender is the one plugin that broke tracking on fingerprint.com, combined with VPN IP change, despite javascript being enabled. If you care about privacy, and not anonymity, you should still be using this.
        3
  • Is this about browsers or about privacy in general?

    But your privacy should be tailored to your specific threat model and desires. Or, you can choose to be private as possible while keeping your convenience, and slowly be more private. You should not just be hardcore and right away. This will leave you feeling hopeless.

    As far as browsers, i recommend Librewolf or mullvad browser, or Brave for Chromium. You do not need to use TOR for everything. A good quality VPN like mullvad vpn or proton is more than sufficient for most people.

    13
  • My mindset is that, if they make me work so hard to be private, I'm gonna do all in my power to make sure they work even harder to get my data.

    11
  • Don't lose sleep over privacy. Just set goals and try to meet them.

    7
  • I’ve kind of come full circle on all this to where I no longer care. The slippery slope arguments are largely hypothetical imo…Google knows some stuff about me and attempts to show me ads, the vast majority of which I block, so what?

    I pay taxes, have a social security number, my bank and credit card companies know my purchase history, the credit bureaus know my mortgage payment and lender, etc…

    The myth of an off the grid life is exactly that, a myth. And what does it achieve for you other than some vague sense of idealistic pride?

    Google provides tremendous utility to the world essentially for free; its search engine, maps, mail client apps, browser, etc. are tools billions of people use every day. How do they maintain a global network of data centers and localize their products to hundreds of languages…none of that is free. If big companies want to give them money in an attempt at to get me to pay attention to them then so be it, let them finance it. Imagine if only those who could afford to pay could use these tools.

    6
  • Privacy is a personal thing. Everyone does it for their own reasons. For me, I'm just sick of wading through adverts, targeted outrage and my details being sold to every company under the sun for profit so I cut down on every opportunity for those companies to harvest that stuff.

    As far as governments go, I'm not sure anything I say or do is remotely of interest to them so it matters less to me on a personal level, but I also appreciate that people like whistle-blowers, activists, abuse survivors and journalists do care about those things so I fully support any measures that help support them.

    From pixel tracking, to WebRTC leaking your real ip, fonts fingreprinting, canvas fingreprinting, audio fingerprinting, android default keyboard sending samples, ssl certificate with known vulnerabilities

    All those things have ways of being tackled to some degree or other. Depending on your browser, WebRTC leakage for example is either a setting or an extension away.

    6
  • My model is more about the ability to surf the web without SPAM coming at me from all possible sides and avoiding services like Google Drive, iCloud etc not much because of the data privacy aspect but more because I don't to become hostage of one of those companies because they'll decide to charge more and/or lock me out of my account without any way to get back to it.

    Doing things like self-hosting, using ungoogled chromium, LibreWolf and a bunch of the extensions listed by others fixes the "SPAM and hostage issue" with the added bonus of some privacy.

    5
  • If you don't protect yourself they will easily find you because of the information you leave everywhere, if you go full privacy mode you will stick out like a sore thumb and they will find you too but at least they don't have much info.

    3
  • Glad you asked.

    South Carolina is offering free genetic profiling that does a full sequence and gives you health information and ancestry. My wife shared it to me and waited for me to go off about handing that information over to the government.

    I didn't even blink before saying let's do it. Privacy is an illusion. Anyone that wants my DNA can get it by grabbing a discarded cigarette butt. The police do need warrants because they can just buy whatever information they want on you.

    In the open source software movement "information wants to be free". That applies to personal private information too.

    3
    1. Use DoT
    2. Use Librewolf
    3. TOR has been compromised, use it sparingly.

    Understand the fight. We have three major pipelines for leakage of inferences/data on the internet:

    1. IP
    2. Metadata
    3. Content we produce
    2
  • Here is a well-written summary of why it is important to keep things about you hidden to other entities.

    No, you have something to hide

    The text ist written is in Dutch. You can translate the website via Firefox to English.

    2
  • Don't get stuck into https://en.wikipedia.org/wiki/Learned_helplessness or perfectionism! So :

    • every step counts
    • even if you are not entirely private in anything you do, you can still be more or less exposed
    • you are not alone in that struggle, we ALL are, from CEOs to politicians to random folks, we are all threatened and must help each other
    • alternatives DO exist (as a personal example, I don't use Google, WhatsApp, TikTok, etc) and enjoyable
    • it's not just technical but also psychological. If you focus on the technology it can be daunting, if you focus on usage it gets easier, ideally you combine both while insuring you don't burn out.

    You can do it, WE can do it! :D

    1
  • Permanently Deleted

    1
You've viewed 32 comments.