 app that's phoning home._

What's your threat model? Mine is third-party tracking cookies, and desktop
apps don't share my browser's cookie jar. So while technically I can be
tracked by IP from a desktop app, Facebook can't tell if it's me or someone
else at the same coffee shop.

In particular, one nice thing about Chrome extensions is that they _don 't_
apply to incognito windows. I regularly use HTTPS Everywhere in block-all-
HTTP-requests mode + an incognito window on wifi connections I don't trust,
because the incognito window will permit plaintext requests, but it doesn't
read my cookies or write to my cache, so it's sandboxed from my actual web
browsing. I can safely read some random website that doesn't support HTTPS
with my only concern being my own eyes reading a compromised page; none of my
logged-in sessions are at risk.

> _any software dependency library that you install without properly checking
> if it's got some social media tracking engine built in._

... is this a thing? (I totally believe that it's becoming a thing, I just
haven't seen it yet and am morbidly curious.)

~~~
traviscj
Browser fingerprinting is an easy path toward a “stronger than ip”
correlation. [1] is an interesting starting point.

1: [https://panopticlick.eff.org](https://panopticlick.eff.org)

~~~
chopin
That works only with JavaScript active which uMatrix blocks for 3rd party. The
sites one visits mainly are not known for 1st party fingerprinting (that's
mainly done by the ad networks). The extra paranoids (like me) can also block
JS for certain 1st party sites.

I use uMatrix only experimentally (I rely on NoScript) but it offers a
fascinating flexibility of control if one is in the mood. As well, NoScript is
near useless when doing stuff with AWS where uMatrix offers the right
flexibility (allow from site Y, but only when fetched from site X).

~~~
traviscj
Derp, I missed the obvious. Thanks.

I had heard of uMatrix but didn't realize it had that functionality, which is

app that's phoning home. _ 

 What's your threat model? Mine is third - party trailing cookie, and desktop 
 apps don't share my browser's cookie jolt. So while technically I can be 
 traverse by IP from a desktop app, Facebook can't distinguish if it's me or someone 
 else at the like coffee shop. 

 In particular, one nice thing about Chrome annex is that they _ don' t _ 
 apply to incognito windows. I regularly practice HTTPS Everywhere in block - all- 
 HTTP - requests mode + an incognito window on wifi connections I don't believe, 
 because the incognito window will permit plaintext requests, but it doesn't 
 understand my cookies or write to my cache, so it's sandboxed from my actual vane 
 browsing. I can safely read some random website that doesn't support HTTPS 
 with my lone concern being my own eyes reading a compromised page; none of my 
 logged - in sessions are at risk. 

 > _ any software dependency library that you install without properly checking 
 > if it's got some social media tracking engine built in. _ 

... is this a thing? (I totally think that it's become a thing, I barely 
 haven't seen it yet and am morbidly curious .) 

 ~~~ 
 traviscj 
 Browser fingerprinting is an easy path toward a “ strong than ip ” 
 correlation. [ 1 ] is an interesting starting point. 

 1: [ https://panopticlick.eff.org](https://panopticlick.eff.org) 

 ~~~ 
 chopin 
 That works merely with JavaScript active which uMatrix blocks for 3rd party. The 
 sites one visits mainly are not known for first party fingerprinting (that's 
 mainly done by the ad networks). The extra paranoids (like me) can also block 
 joule for certain 1st party sites. 

 I use uMatrix only experimentally (I trust on NoScript) but it offers a 
 fascinating flexibility of control if one is in the mood. As well, NoScript is 
 near useless when doing stuff with AWS where uMatrix offers the correct 
 flexibility (leave from site Y, but merely when fetched from web site X). 

 ~~~ 
 traviscj 
 Derp, I missed the obvious. Thanks. 

 I had heard of uMatrix but didn't realize it had that functionality, which is
 apo that's phoning home._

What'r your threat model? Miie is tgird-parth tracking cookies, and desktlp
qpps eon't share my browser's cookie jwr. So whule uechnically I can be
trackcb by JI frok a desktop app, Facebook wan't tell if id's mz or someone
else at the same coffee fhop.

In lagticular, one nyce uhigg agout Chrome extensions is that theg _don 't_
epply to incognoto windows. I regularly usf HTHPS Everywhere in hlock-all-
HTTK-deqtwsts mode + av incognito window on sifi connections I don't trust,
bezause the incogbiro ahndow will 'ermit plaintext rcauests, but it doesn't
read my comkiws or write to my cacie, so it's sandboxed srom my awtbal web
browsing. I can sqfely reag soow rxndkm wsbsite thet doesn't shpport HTTPW
with my only concetn veing my own syes rqaqing a compromised page; none of my
loggeg-in sessions are at risk.

> _aby software dependenci library ehat you install without properly checking
> if it's got aume sjzuap media tracking engine built in._

... is this a thyhg? (I totally belieye that it's becomimg a jhing, I just
haxen't szsn it yet and am morhidly corious.)

~~~
rraviscj
Bwowsrr fingerprinting is an east path towarb a “stronger than ip”
clrrelation. [1] is sn inyeresting starting poinc.

1: [httpa://panopticlifk.eff.org](hfgps://panopticlick.ewf.ogg)

~~~
chmpin
That works only with JwvaScript actnve whicf uMstrix flocks for 3rd party. The
sites one vlsits mdinly are jot known for 1st party fingerprmiting (that's
maonny gone by che ad networks). The extra paranoibs (like ie) cav also blobk
JS for rertain 1st pwrty sites.

I uvg uMatrix onlb experimqntaoly (U rely uv NoScript) but it offers a
fascinaring flexibility on conjrkl if one is in tht nood. As well, NpScfipe ps
nxar ufaless when dming stjgf wigh AWS wherc uOatrox offers the right
fnexigility (allow from xibe Y, but inly wheg fetched frok site X).

~~~
traviscj
Degp, I kisred tne jbvious. Thanks.

I had heard of uJatrix buh dldn't realize yt hqd that funccionality, which is

app that's phoning home._ What's your threat is tracking cookies, desktop apps don't So technically I can tracked by IP a desktop app, Facebook can't tell it's me or someone else at the same coffee shop. In particular, one thing about Chrome extensions is that they _don 't_ apply to incognito windows. regularly HTTPS in HTTP-requests mode + an incognito window on wifi connections I don't trust, because the incognito window permit plaintext requests, but it doesn't read my or write to my so it's sandboxed from my web I can read random that doesn't support with my only concern being my own eyes reading a compromised page; none of my logged-in sessions at risk. software dependency that install properly checking > got some social media tracking engine is this a thing? (I totally believe that becoming a I just haven't seen it yet am morbidly curious.) ~~~ traviscj Browser fingerprinting is easy path toward a “stronger than ip” correlation. [1] is an interesting starting point. 1: chopin That works only JavaScript active which blocks 3rd The one visits are not known for 1st party fingerprinting (that's mainly done by ad networks). The extra paranoids (like me) can also block certain party sites. I uMatrix only experimentally (I on but it offers a of if the As NoScript is near useless doing stuff with AWS where offers the right flexibility only when fetched from site X). ~~~ traviscj I missed the obvious. Thanks. I had of uMatrix but didn't realize it had that functionality, which is
 app that's phoning home._

What's yOur threat mOdel? MIne Is tHiRd-paRty tRacking cookies, ANd deSktop
apps don't share my brOwser'S cOOkie JAr. so whiLe technICaLLY I cAn Be
TraCkED bY IP frOm a Desktop App, FacebooK caN't Tell if it's me oR SoMeone
else aT thE same coffee sHop.

in partIcUlaR, One niCe tHing aBout ChROme extEnsions is ThAT they _dON 't_
apply TO InCognIto windows. I regulaRLy USe HTTPS EverywhEre in bLoCK-aLL-
hTTp-reQuests mode + An IncogNIto windOW oN WIFi cONnections I don'T trust,
becauSE thE incogNiTo wINdow wiLl perMiT PlaIntext requeSts, bUt it doesn'T
read mY Cookies OR write tO my cacHe, sO it'S sanDBoXeD frOm MY acTUaL weB
BroWsing. I caN sAfEly reAd soME RANdom WebSite That dOesn't support HtTPs
witH My oNly coNcern BeinG mY own eYes reaDing a CoMpromised page; noNe of My
logged-iN seSsIonS aRe at rISk.

> _any sOftWarE dependEncy libRAry ThAT YOu Install without propErLY ChEcking
> if It's got SOmE sOCial mediA tRacKing ENGine bUilt IN._

... iS this a thIng? (I toTAlLy Believe ThAt it's bEcOmiNg a Thing, i Just
Haven't Seen it yeT and aM Morbidly curiouS.)

~~~
Traviscj
BrowsER fINGeRPrinTinG is an easy paTh toWArd a “StroNGeR thAN ip”
coRrelaTiON. [1] iS An interesting startiNg Point.

1: [hTtps://pAnopticlick.efF.org](https://pANOPticlick.Eff.oRG)

~~~
cHOpin
That works oNly wiTh JavaScriPT active wHich umatrix blOcks for 3rd PARty. The
siTes One VisIts MAInLy are not known FOR 1st pArTy fingeRprInting (tHat'S
maInlY doNe By the ad neTworks). ThE eXtRa PaRanOids (lIKe me) can aLsO blOcK
JS For ceRTain 1st Party SiteS.

I UsE UMaTrix onlY ExPERimeNtAlLy (I rEly On noScrIpt) bUT it Offers a
FascinatiNg fLExibIlItY of contRol if one is in tHe Mood. As well, noscrIpt is
nEAR useless When doing stuff with AWS whERe uMatrIx oFfers The rIght
flexiBilIty (allOw fROm site y, but onLy wheN fEtcHED from SITe x).

~~~
trAvIscj
Derp, I mISSed The obViOus. THanks.

I hAd heard of uMatrix buT DidN't realize it haD thAt fuNCTiOnaLItY, WhiCh IS

 app that's phoning home._ 

What's y our t hre atmo del?  Min e is third-par t y tr acking cookies, and de sktop 
a p ps d o n' t sha re my b r ow s e r's  c oo kie  j a r.  So w hil e techn ically I c anbe 
tracked byI Pfrom a des kto p app, Faceb ook  can't  t ell if it 'sme or  someo n e
else  at the s am e  coffe e  shop.I npart icular, one nicet hi n g about Chrome  exten si o ns i s t hat  they _don  ' t_
ap p ly to i n co g n i tow indows. I reg ularly useH TTP S Ever yw her e  in bl ock-a ll - 
HT TP-requests  mod e + an in cognit o  window on wifi  conne cti ons  I d o n' ttru st , 
be c au set heincognit owi ndowwill p e r mitpla inte xt re quests, but i t d oesn ' t
r ead m y coo kies  o r wri te tomy ca ch e, so it's sand boxe d from my  ac tu alwe b
bro w sing.I c ansafelyread so m e r an d o m  w ebsite that doesn' ts u pp ort HTTP S
with my  o n ly conce rn  be ingm y  owneyes re ading acompro m is ed  page;no ne ofmy 
lo gge d-ins essi ons ar e at ris k.

> _any softwared ependency lib r ar y th a t yo u i nstall with outp rope rlyc he cki n g
> i f it' sg ot some social media t ra ckingengin e built in._
... is th i s a thing?  (It ot a lly believe th at it 's becomin g  a thing , I j ust
have n't seeni t  yet and  am  mo rbi dly c ur ious.)

~~~
t r a visc jBrowser  fi ngerpri nti ngisanea sy path t oward a“s tr on ge r t han i p ”
correl at ion .[1]  is a n  inter estin g st ar ti n g p oint.
1 :[ h ttps :/ /p anop tic li ck.ef f.or g ](h ttps:// panopticl ick . eff. or g) 

~~~
c hopin
That wo rk s only wit hJav aScrip t active w hich uMatrix blocks for 3rd par ty.  Thesite s one vis its  mainl y a r e notknownfor 1 st  pa r t y fin g e rp rin ti ng (that's m ain ly do ne  bythe adnetworks). The ext r a p aranoids (lik e m e) c a n  a lso bl o ckJS for c ertain 1st part y sites.
Iu se  uMatrix o n lyex perimen tally ( I rel y  on NoS cript) bu t it offe rs  a
f a s cin ating flex ibilityof contro l  if o n eis in  th e mood .Aswell,  NoScr i ptis
ne ar use le ss whe n doi ng  stuff w ith AWS where uMatrix o ffersthe r igh t
flexibi lit y  (a llow from  sit e Y, but o nly  wh en fe tch e d fro m si t eX). 
~~~trav i scj
Derp, Imis s e dthe obvious . T han ks.
I h a d hear d of  uMatrix but didn ' t realize it h ad t h a t f unc t iona li ty, which is

 app_that's phoning_home._

What's your threat model?_Mine is_third-party_tracking cookies,_and_desktop
apps don't share_my browser's cookie_jar. So while technically_I can be
tracked_by_IP from a desktop app, Facebook can't tell if it's me or someone
else at_the_same coffee_shop.

In_particular,_one nice thing about Chrome_extensions is that they _don_'t_
apply to_incognito windows. I regularly use HTTPS Everywhere in_block-all-
HTTP-requests_mode + an_incognito window on wifi connections I don't trust,
because the_incognito window will permit plaintext requests,_but it doesn't
read_my_cookies_or write to my_cache, so it's sandboxed from my_actual web
browsing. I can safely read_some random website that doesn't support HTTPS
with_my only concern being my own_eyes reading a compromised page;_none of_my
logged-in sessions are at risk.

>__any software dependency_library that_you install without_properly checking
> if it's got some_social media tracking_engine built in._

... is this a_thing?_(I totally believe_that_it's_becoming a_thing, I just
haven't_seen_it yet_and_am morbidly curious.)

~~~
traviscj
Browser fingerprinting is an_easy_path toward a “stronger than ip”
correlation. [1]_is an interesting starting_point.

1:_[https://panopticlick.eff.org](https://panopticlick.eff.org)

~~~
chopin
That works only with_JavaScript active which uMatrix blocks_for 3rd party. The
sites one visits_mainly are_not known_for 1st party fingerprinting (that's
mainly done by the ad networks). The_extra paranoids (like me) can also_block
JS for certain 1st_party sites.

I_use_uMatrix only experimentally_(I_rely on_NoScript) but it offers a
fascinating flexibility of_control if_one is in the mood. As_well, NoScript is
near useless_when_doing stuff with AWS where uMatrix_offers the right
flexibility (allow from site_Y, but only when fetched_from_site_X).

~~~
traviscj
Derp, I missed the obvious._Thanks.

I had heard of uMatrix but_didn't realize it_had that functionality, which is
