Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
The Internet

Browsers Which Protect Your Privacy? 107

Posted by Cliff from the limiting-your-exposure dept.
valkraider asks: "Browsers are getting better at protecting user's privacy. Mozilla has pretty good cookie preferences. Many browsers like OmniWeb for Mac OS X will block images from sites based on wildcard expressions (like *ad*). Most browsers have settings to delete cookies and cache and such at the end of each session. Even IE for windows (not Mac) will allow you to 'import' a privacy file and control many things pretty tightly. Currently on PCs I use Mozilla with no disk cache, no persistent cookies, no third party images,and many blocked image sites. I can do almost the same with Chimera on Mac OS X. What are people's favorite browsers for protecting your privacy?" Which browsers provide the best balance between functionality and privacy? What privacy features would you like to see, that are missing from those currently available?"
This discussion has been archived. No new comments can be posted.

Browsers Which Protect Your Privacy? More

Browsers Which Protect Your Privacy?

Comments Filter:

  • Site specific Flash blocking (Score:3, Interesting)

    by n-baxley ( 103975 ) <nate@baxleysIII.org minus threevowels> on Tuesday November 19, 2002 @05:04PM (#4709979) Homepage Journal
    I can block images from a certian server, but not flash ads^H^H^H elements from sepecific servers.

  • Treating Flash like images (Score:5, Insightful)

    by mrblah ( 229865 ) on Tuesday November 19, 2002 @05:06PM (#4709992)
    So many sites are using flash now instead of normal images that the image blocking, while very nice, is becoming less useful. It'd be nice to be able to enforce the same controls on flash content (and other forms of content delivery) as normal images.

  • I use... (Score:5, Informative)

    by doofsmack ( 537722 ) on Tuesday November 19, 2002 @05:08PM (#4710009)
    Opera and proxomitron [proxomitron.org]. It allows me to filter out flash like everyone's complaining about, and you can set rules for just about everything sent and recieved. Very nice.

  • Internet Explorer 6 for Windows (Score:4, Funny)

    by Anonymous Coward on Tuesday November 19, 2002 @05:09PM (#4710021)
    For complete privacy you can get your hard drvie reformatted with the click of a link.

  • Cookies (Score:2, Interesting)

    by storem ( 117912 )
    I'm quite proud that I switched from IE on Win & Mac to Mozilla on Win, Max & Linux. It's privacy management concerning cookies is far better than the impossible hassle you come against with IE.

    However it would be nice to have logging of which cookies are actually used during a browsing session so you can keep track of who's tracking you. Maybe this is possible and/or exists in other browsers?

    • Does IE still ask each and every time you get a new/modify an existing cookie? To me that was worse than having no control over cookies at all, since you ended up turning off the cookie controls (putting you back at square one) and you'd wasted an hour playing "whack a control."

      Being pretty agnostic about browsers (in terms of whether or not it comes from MS), I must say I have moved all of my general browsing over to Pheonix on Win machines -- I still need to use IE to access internal websites for one of the companies I work for who shall remain nameless. The control over cookies and pop-up blocking (javascript) controls along with its lightness is quite nice. I haven't even installed the Flash plugin, so no worries about those adds either.

    • Re:Cookies (Score:5, Informative)

      by valkraider ( 611225 ) on Tuesday November 19, 2002 @05:50PM (#4710421) Journal
      You can save this as an XML file, and then import it into IE6's privacy settings.

      <MSIEPrivacy>
      <MSIEPrivacySetting s formatVersion="6">
      <p3pCookiePolicy zone="internet">
      <firstParty noPolicyDefault="forceSession" noRuleDefault="forceSession" alwaysAllowSession="no">
      </firstParty>
      <thirdPar ty noPolicyDefault="reject" noRuleDefault="reject" alwaysAllowSession="no">
      </thirdParty>
      </p3pCook iePolicy>
      <flushCookies/>
      </MSIEPrivacySettings>
      </MSIEPrivacy>

      *NOTE* The submit process is adding some spaces..
      Line 2: remove space in MSIEPrivacySettings
      Line 6: remove space in thirdParty
      Line 8: remove space in p3pCookiePolicy

      These custom settings force ALL cookies to session lifetime, and does not allow 3rd party cookies. It will flush all your existing cookies when you import it. (you can remove the flush cookies element to not flush them on import).
    • Wouldn't really be possible to see when a cookie is being used. The way the system works, if the browser is requesting a page from a site for which it has a cookie, it sends the cookie as part of the request. Whether or not the site actually looks at that cookie is completely out of the hands of the browser.

      One thing that could be done, I suppose, is to pop up some notification every time the browser sends the cookie, but that wouldn't really tell you when the remote site's using the cookie. And I have to assume that it would be ungodly annoying, but I think having cookies anything but always-accepted is annoying as hell, myself. So I'm sure a lot of pro-Privacy people would like this as a feature.

      --AC

  • Got to say it... (Score:4, Informative)

    by MattCohn.com ( 555899 ) on Tuesday November 19, 2002 @05:12PM (#4710038)
    Opera! It's got a wide array of privacy features. You can not only turn off cookies, images, GIF animation, and all that, but you can do it on the fly by pressing the F12 key. Also, you can choose not to send reffer information along to the site, if you don't want them to know where you came from. One more thing, you can choose to identify as Opera, MSIE, and from 3 different versions of Mozilla. And that's just in the 6.x version, the 7 beta is now availible for download from opera.com! [opera.com]
    • Opera is a great browser to use for that reason. Disable plugins with F12 plus a click. However, if I want to automate it I prefer to use Webwasher [webwasher.com] along with it. If you get the Windows version, get the beta, it's got the flash killing features in it. What I like about Webwasher is I can exclude sites which the flash animation is actually useful. They make a Mac and Linux version as well.

      Sometimes the best tool isn't always open source.

    • Opera [opera.com] wins the privacy contest for me, hands-down, with the "Delete Private Data" option. It's right there in the "File" menu. You get a dialog box asking what you want to delete:

      * Cookies (temporary or all)
      * Cache (password-protected pages or all)
      * History (visited pages, typed-in addresses, visited links, transferred files)
      * Clear email passwords (if you use the built-in email)

      Of all of these, I think I most like the ability to quickly clear typed-in addresses. I share the computer with the kids, and the last thing I want is for them to type the letter "g" and have "goatse.cx" pop up!

  • Mozilla (almost) rules (Score:4, Interesting)

    by nrosier ( 99582 ) on Tuesday November 19, 2002 @05:12PM (#4710039)
    I use Mozilla on all platforms I'm running but combine it with bannerfilter [phroggy.com] on squid. Mozilla doesn't support regexps yet for picture-blocking but is host-based until they fix bug 78104 [mozilla.org]. Disk cache is switched on though as I'm the only user on my system so I don't see this as a possible security problem.
    Cookies are selectively permitted and pop-ups are blocked.
    Security is imho the biggest reason to use Mozilla in stead of IE.
    • If Mozilla supported regex blocking we could block flash with a simple rule for some or all sites. Hell, we could block whatever we think we need to block. This would be my number 1 (privacy) feature request.
      • Go to bugzilla, login/create an account and vote for this bug. The more votes, the more attention it will get in getting fixed in one of the next releases. There's an image attached for the image-block UI and it looks promissing.

    • Wrong. (Score:3, Informative)

      by crow ( 16139 )
      Mozilla does support regexp-based filtering through Automatic Proxy Configuration. See http://www.schooner.com/~loverso/no-ads/ [schooner.com] for information on how to do this. (It's not what the feature was designed for, but it works perfectly.)
    • One way to block images and Flash by substring (not regex) is to use CSS3 selectors in your userContent.css file. For example:

      embed[src=*"doubleclick.net"] { display: none!important; }
      img[src=*"ads.slashdot.org"] { display: none!important; }
      *[src=*"microsoft.com"] { text-decoration: blink!important; }

      You get the idea. The "!important" part means "override the author's style sheets", not "not important" which is what I initially thought it meant. :-)
      • Even better, you can override the height and width elements so that the ads really go away completely.

        What I'm trying to figure out is a way to have my stylesheet recognize any image of a given standard banner size (I can do that), and then tell the browser to use the actual size of the image instead of whatever the HTML has encoded for it. Then when my ad blocker substitutes a 1x1 transparent gif, I won't even see a big block of space. I'm new to style sheets (as of reading your post and Googling the web a bit); can I do this?
        • I figured it out. My ~/.mozilla/default/*/chrome/userContent.css file not includes:

          *[height="60"][width="468"], *[height="60px"][width="468px"],
          *[height="60"][w idth="234"], *[height="60px"][width="234px"],
          *[height="600"][ width="120"], *[height="600px"][width="120px"],
          *[height="600"] [width="160"], *[height="600px"][width="160px"],
          *[height="120"] [width="240"], *[height="120px"][width="240px"],
          *[height="150"] [width="180"], *[height="150px"][width="180px"],
          *[height="300"] [width="250"], *[height="300px"][width="250px"],
          *[height="336"] [width="280"], *[height="336px"][width="280px"],
          *[height="400"] [width="240"], *[height="400px"][width="240px"],
          *[height="250"] [width="250"], *[height="250px"][width="250px"],
          *[height="90"][ width="728"], *[height="90px"][width="728px"],
          *[height="280"][ width="336"]
          { width: auto !important; height: auto !important; }

          Those are based on a list of standard ad sizes I found somewhere, and I'm adding to it based on the blank spaces I run across. The great thing about this is that if I happen to find a page that uses that size of image for something that isn't blocked, I still see it just like normal, but if it is blocked (by my auto-proxy script) and substituted by a 1x1 transparent gif, that's all the space the ad takes up.

          Now all I need to do is replace my 1x1 transparent gif with a 0x0 gif or jpeg. Is such an image allowed by the specs?
          • I have a feeling you'd probably have to go hacking with a hex editor and a copy of the image format specification to get a 0x0 gif or jpg, and it might just crash your browser. :-)
        • I didn't think you could do this before I tested it, but yes. Use "width: auto!important; height: auto!important" in your userContent.css stylesheet. This will (according to my pitifully simple test) override the attributes in the tag and also override Javascript resizing of the image.

          Mozilla also has attributes called "naturalHeight" and "naturalWidth" for images, but they're only available from Javascript AFAICT.
  • I'd like the ability to block images from a site without actually visiting the site.

    Right now with Mozilla, if I want to block images from goats.cx (or whatever), I need to visit the site, view the disgusting image, right click, and select "Block images from this site" (or go to Tools: Image Manager: Block images from this site).

  • Dynamic filtering (Score:4, Informative)

    by crow ( 16139 ) on Tuesday November 19, 2002 @05:14PM (#4710057) Homepage Journal
    It turns out that you can filter out anything you want, much like using a Junkbuster proxy, only without using a proxy. Most modern browsers have a feature called "Automatic Proxy Configuration." What this is is a user-provided JavaScript function that parses each URL before it is fetched to determine what proxy to use. You can then use a default of going direct to the real server, but use an alternate proxy for anything that looks like an ad or other unwanted content.

    I use this with both IE and Mozilla. I have Mozilla ask before accepting cookies, so I've added a bunch of usage tracking sites to my proxy script.

    You can find a sample of how to do this at a friend's site: no-ads [schooner.com]

  • iCab (Score:5, Interesting)

    by singularity ( 2031 ) <nowalmartNO@SPAMgmail.com> on Tuesday November 19, 2002 @05:14PM (#4710062) Homepage Journal
    iCab [www.icab.de], available only for the Mac, is one of the best browsers I have seen as far as privacy goes.

    It can filter images based on the server, link, size, or anything else.
    It can filter cookies based on the server, duration, or anything else.
    it can filter JavaScript (InScript) based on server, action, or anything else.

    One of the best features: You can set it to only use "Referer" from within the same domain. So if I link to a Sony.com page from Slashdot, Sony has no idea how I got to the page. But Sony can track how I navigate their site (You can also set iCab to never send referer:)

    There are more features [www.icab.de] than I could ever list here. Suffice to say it is very powerful and very configurable. Anyone using MacOS deserves to look at it.

    it is still missing a few things, and it is compliant to a fault at times (with regards to page layout), but I use it for 99.5% of my browsing without and problems.

    • Re:iCab/second (Score:3, Informative)

      by zogger ( 617870 )
      --I second the nomination of the iCab browser as being just "good" overall. Wicked fast (in my purely anecdotal tests the fastest GUI browser I have ever used), small download, installs easily, updates easily, basically "just works" really well, plus all the features. Cookie control is outstanding and there are a lot more speedy menu choices available directly from the browser rather than opening a preferences dialog window separately, images load and not load, select just one image on a page, etc.. I've only used it on Mac classic, but tell ya what, it allowed me to listen to mp3 streaming audio plus browsing when nothing else would on my semi ancient 1400 powerbook, and runs on a real old one almost as well, an old 280c I setup for my girlfriend, that only has a moto 68k processor in it at I *think* 25 mghz.. I actually wish that it was ported to linux as well, I'd use it if it was the same functionality it has in mac over, say, mozilla.

  • Konqueror and cookies (Score:4, Insightful)

    by aldjiblah ( 312163 ) on Tuesday November 19, 2002 @05:19PM (#4710122)
    Konq has a feature that I really enjoy:
    'Automatically accept session cookies'

    Session cookies are generally those that provide application persistency, applications that often won't work without them - even ones I've written myself :). They're erased when you close your browser, thus rendering them incapable of tracking your long term web surfing. Being able to let all of these through means a lot of 'allow this cookie?' dialogs I don't need to see.

    Also, konq has (Mozilla too, I believe) a 'smart' popup window policy, showing only windows that you yourself 'request' by clicking a link etc. Automated popups magically just don't appear.

    Blocking regular ads on pages is an interesting feature in Mozilla, which I'm glad doesn't exist in konqueror or most other browsers - I can't see how this could be good for the user in the long run.
    • Blocking regular ads on pages is an interesting feature in Mozilla, which I'm glad doesn't exist in konqueror or most other browsers - I can't see how this could be good for the user in the long run.

      Compromise: How about a feature that allows me to specify that from some sites I do not want ads at all, and from other sites I want to download the ad, but not display it. Thus the site gets their advertising money, and I am not bothered. Haven't seen this in any browser yet, though.


      • Compromise: How about a feature that allows me to specify that from some sites I do not want ads at all, and from other sites I want to download the ad, but not display it. Thus the site gets their advertising money, and I am not bothered. Haven't seen this in any browser yet, though.


        This is unethical behaviour, sure, I hate ads as much as the next guy, and block them when I can (actually, I probably hate ads more than the next guy, I don't own a tv, nor do I watch tv. DVDs at home, and videos at friends places, never tv. HATE tv ads). But downloading ads for the purpose of revenue raising, but not viewing them?

        It devalues web advertising for all sites that rely on them for revenue.

  • What does _who_ want? (Score:3, Insightful)

    by lynx_user_abroad ( 323975 ) on Tuesday November 19, 2002 @05:20PM (#4710134) Homepage Journal
    It's important to remember that the market for a web browser is not the set of web surfers, but rather the set of web site providers. A browser doesn't gain market share by being less costly or more feature-rich, but rather by being usable at the most sites.

    Web surfers might want a web browser which offers them more control of their surfing experience (privacy enhancements, for example), but web site purveyors want to see features which take control away from the surfer (such as unclosable pop-under windows).

    The result of the collision of those two trends is that browsers (such as opera) which offer ad-blocking and privacy enhancing features are going to be discriminated against as opposed to browsers (such as IE) which offer web content providers a rich set of features. And the more empowering (to the user) the browser is, the more quickly web sites will move to degrade support for that browser.

    Its' a shame, but phenomenon like this are going to kill the Internet as we know it, or reduce it to something nobody wants to waste their time on (like broadcast television.)

  • A filtering proxy ususally beats inbuilt features (Score:5, Informative)

    by SteWhite ( 212909 ) on Tuesday November 19, 2002 @05:26PM (#4710192)

    I use Privoxy (get if from SourceForge).

    It's a filtering HTTP proxy, incredibly configurable, and of course browser and platform independant. The "out of the box" config also does a really good job (IMHO) of filtering without being too intrusive.

    Features include:

    Filtering images, flash and java applets

    Cookie management including transforming permanent cookies to session based cookies.

    Pop-up window killing

    Filtering of any URL pattern with regular expressions

    .... plus much more. Really, to much to list. Try it.

  • I don't understand why some people are so freaked out about privacy? What do you have to hide? Why don't you want the speed benefits that a cache provides you? What's wrong with seeing ads?

    For the record, I use Netscape 7 with all the features that I can.

    -Brent
    • They just want to bitch some more about MSIE. ;-)

      Damn activex is the only reason I don't make phoenix my default browser.
    • I can understand that someone doesn't like cookies reporting info to others, but why is ad blocking mentioned in an article about privacy. If the ads are served up, with no communication from the user, that was not authorized from the user, it is not a privacy issue. An annoyance issue it may be, but that is what you get for free content.
      • if you check the src of many ad images they are sometimes referencing a script (htm, asp, cgi, pl, etc) instead of the actual image (gif, jpg, png, etc). this script grabs all kind of parameters through javascript from the user, then forwards to an image so that all the user sees is an image. i guess some people consider this a violation of privacy.
        • if you check the src of many ad images they are sometimes referencing a script (htm, asp, cgi, pl, etc) instead of the actual image (gif, jpg, png, etc).

          It doesn't matter if the image is coming from a static image file or a script on the server. The HTTP request your browser makes is identical modulo the name of the file. That is, any information that is available to a script is contained in the request for a static file and thus is loggable.

          this script grabs all kind of parameters through javascript from the user

          Hmm... if you mean that javascript on the client can alter the img src tag based on client-side information, then ok. But again, it being a script on the other hand vs a static file is not relevant.
          • well, here's an example:
            <script language="JavaScript" type="text/javascript">
            <!--

            var W="id=1";
            W+="&browserDate="+escape(new Date());
            W+="&title="+escape(document.title);
            W+="&url="+escape(window.document.URL);
            W+="&referrer="+escape(window.document.referre r);
            W+="&appname="+escape(navigator.appName);
            W+="&appversion="+escape(navigator.appVersion) ;
            W+="&cookieOK="+(navigator.cookieEnabled?"Yes":" No ");
            W+="&userLanguage="+(navigator.appName=="Netscap e" ?navigator.language:navigator.userLanguage);
            W+="&platform="+navigator.platform;
            W+="&bgColor="+escape(document.bgColor);
            W+="&javaOK=Yes";
            if(typeof(screen)=="object") {
            W+="&screenResolution="+screen.width+"x"+screen.he ight;
            W+="&colorDepth="+screen.colorDepth;
            W+="&NSpluginList=";
            for( var i=0; i< navigator.plugins.length; i++)
            W+=escape(navigator.plugins[i].name)+";";
            }
            document.write('<IMG BORDER="0" WIDTH="1" HEIGHT="1" SRC="storehit.asp?'+W+'" hspace="0" vspace="0" alt="hello"/>'); //-->
            </script>
            <NOSCRIPT>
            <IMG BORDER="0" WIDTH="1" HEIGHT="1" SRC="storehit.asp?id=1&title=NO%20SCRIPT&url=http: //noscript&javaOK=No&" hspace="0" vspace="0" alt="hi"/>
            </NOSCRIPT>

          • here's the other file, pretty basic stuff here:
            <% 'storehit.asp
            function noQuotes(strIn)
            ' function to replace single quotes
            end function

            strConnection = "database connection string"
            set objDB = server.Createobject("ADODB.Connection")
            objDB.Ope n strConnection
            objDB.execute("INSERT INTO info (id, browserDate, title, url, referrer, appname, appversion, cookieOK, userLanguage, platform, bgColor, javaOK, screenResolution, colorDepth, NSpluginList, now, user, pass, content_type, user_agent, http_referer, logon_user, remote_addr, remote_host, remote_user) VALUES (" & noQuotes(request.querystring("ID")) & ",'" & noQuotes(request.querystring("browserDate")) & "','" & noQuotes(request.querystring("title")) &

            etc., etc.

            noQuotes(Request.ServerVariables("REMOTE_ADDR")) & "','" & noQuotes(Request.ServerVariables("REMOTE_HOST")) & "','" & noQuotes(Request.ServerVariables("REMOTE_USER")) & "')")

            response.redirect("spacer.gif")
            %>
            • Right, but my point is that all of the information that you insert into the database is loggable by the web server - it's part of the HTTP request. You can tell because you get it with "request.querystring(x))". So it doesn't matter if it's a script on the server side or a static image. With the script you mention, the data goes in real time. With a static image, you would probably have to process the server logs. But that's the only difference.
      • Except with good data mining, the ad company can record every ad served to you*, which ones you click on (they redirect throught their site).
        The REFERER http field for images gives the URL the image is emmeded in, so they can tell what you have searched for (the search results for most search-engines encode the search-text in the URL).
        All it takes is for a website to leak personal information (say a web-mail site that has your email addy in the URL), and they can get that as well...

        By 'You' I mean the cookie, of course.

    • Good troll subject, but don't make it quite as obvious next time.
    • You could consider switching to w3m [sourceforge.net], a very cool console web browser. It's cool. I'd used it a lot. Because of my job, I have to use Windows so now I'm surfing with IE6.
  • ...or telnetting to a server using lynx while logged in as root.

    Really though, this is an obvious answer: Mozilla has many excellent privacy features, though a bit on the fat side. On the other hand, Chimera, on os x is going to be the one to look out for, as it has many blocking features as mentioned before, but are controlled by either off or on, and not setting different variables as mozilla does. Chimera also lacks (as od todays build) image control.

  • privoxy (Score:4, Informative)

    by petard ( 117521 ) on Tuesday November 19, 2002 @05:38PM (#4710301) Homepage

    I find that privoxy [privoxy.org] works better for me than the mechanisms built in to any browser. It's based on the old junkbusters codebase with many more features. It's available for both windows and very nearly any form of UNIX (or UNIX-like) OS you might reasonably use to browse the net. (Of course, I have it set to allow ads for slashdot :-)) In combination with phoenix's popup blocking (which takes care of SSL sites such as hushmail that privoxy can't) I find that it gives me near-perfect control over my browsing experience.

    That said, if I really suspect that a particular site may be malicious, as opposed to simply obnoxious, I look it over in lynx first.

  • I like using mozilla too, but I don't like the cookie management.

    I would like, for example, to allow only slashdot.org and nytimes.com to set persistant cookies. I can do this in explorer by setting it to block all cookies, then putting certain sites in my 'trusted sites' list, but I don't think mozilla works that way.

    • Re:About Mozilla (Score:2, Informative)

      by ewen ( 218843 )
      I would like, for example, to allow only slashdot.org and nytimes.com to set persistant cookies. I can do this in explorer by setting it to block all cookies, then putting certain sites in my 'trusted sites' list, but I don't think mozilla works that way.

      In Mozilla you can block or unblock cookies on a per-site basis using Tools->Cookie Manger->Block Cookies from this Site and Tools->Cookie Manger->Unblock Cookies from this Site.

      I suspect you could achieve what you want in Mozilla by setting the default policy to blocking cookies, and then visiting the sites where you want to allow cookies and using the Unblock Cookies from this Site option to enable cookies for just those sites.

      Those choices are stored persistently in cookperm.txt in the mozilla directory, so you could possibly even edit that file manually providing you carefully followed the format of existing entries.

      Ewen

      • What your saying is true. However, it would not solve the problem the parent message brings up. Like the parent message, I only want some sites, like slashdot, to have persistant cookies. Otherwise, I want to allow cookies, but only for the current session. This is different than all together blocking cookies.

        Mozilla is certainly heading in a nice direction. Hopefully in the future their cookie management will become more robust.

        puck
      • I suspect you could achieve what you want in Mozilla by setting the default policy to blocking cookies, and then visiting the sites where you want to allow cookies and using the Unblock Cookies from this Site option to enable cookies for just those sites.

        No such luck, if I have chosen "disable cookies" then the "unblock cookies from this site" option becomes unhighlighted.

        I even tried adding "slashdot.org [tab] 0T" to cookperm.txt, and while the cookie manager lists slashdot as "site can set cookies", it still doesn't override the "disable cookies" option.

  • What if you could have automatic ad filtering work just like spam filtering using the Bayesian classification [paulgraham.com] technique?

  • The Browser's not the solution (Score:5, Insightful)

    by orthogonal ( 588627 ) on Tuesday November 19, 2002 @05:58PM (#4710476) Journal
    Use a proxy to filter out what you don't want. Use the browser to render the pages.

    The proxy'll work with any browser that allows you to set a proxy, so that you can set up a rule set that doesn't change when/if you change browsers (i.e., in cases where the site only supports, e.g., IE).

    More importantly, the proxy (if it supports regexed grepping) can be set up to remove or alter any arbitrary HTML -- something most browsers aren't set up to do. And it provides a additional layer of defense when the browser is buggy (see the earlier /. story today on IE's 'ability' to run arbitray code from a supposedly 'local' page).

    I use Proxomitron [proxomitron.org] under Windows. It does arbitray regex, so I can remove ads, flash, abitrary javascript, etc. I can also add or change elements (showing hidden fields is useful in debugging). And I suspect I'll be able to come up with a filter for the IE bug I mentioned above.
    • Yeah, but this breaks the tight coupling possible in a browser. For instance, with mozilla, you can right-click on an image and say "block images from this server". Of course, this sucks and should be expanded to give more control (like block from this server, block from this domain, look at the url and create your own regex, etc.)
    • I disagree. If you're using a browser with a proxy, you're going through two separate layers of code that are designed to process HTTP requests. Now perhaps in a perfect world based on the Unix philosophy of combining small tools, the browser would actually be several separate applications glued together: HTML renderer, Cookie manager, URL fetcher, etc.

      But I don't want to have two separate HTTP layers. I've used Junkbuster, and it's slow, and results in different behaviours (particularly in cases of servers not responding).

      We already have a URL-fetching layer in the browser. Let's extend it to have plugins that let you control what it does. You can already do this with automatic proxy configuration to decide where (if at all) to fetch a given URL based on a JavaScript function. The only thing you can do with a real proxy that isn't yet available through a plugin is modification of retreived content. You can block the ads, but you can't eliminate the HTML that chews up a big block of space for the ad.
  • About a year ago when Kazaa-Lite came out I changed my hosts file to include a list of thousands of ad websites. Suprisingly, I now rarly see ads, and combined with Mozilla's popup blocking I'm really spoiled. When I'm on others computers I can't believe how bad the web has gotten lately.

    Really its only a few websites which do the majority of the ads, so not that many sites actually need to be blocked. Anything that makes it through my HOSTS file is usualy on a site that I enjoy (ie. Slashdot) and so I'm not bothered by the ads. One drawback could be that you see an annoying message where the image is supposed to be, however there is software to change that as well.

    The hosts file I use can be found here: Kazaa Lite Webpage [doa2.host.sk], you'll have to click on the "supertrick" button on the left, since I'm too lazy to figure how to directly link.

  • telnet www.microsoft.com 80
    GET / HTTP/1.0

  • one feature no browser has (Score:4, Insightful)

    by farnsworth ( 558449 ) on Tuesday November 19, 2002 @07:29PM (#4711155)
    one feature no browser has (that I have seen) is a ui to see the url of a form submission. if I'm at https://www.store.com/checkout I want to be able to quickly see that the form does not submit to http://www.3rdParty.com/buy?ccnum=xxxx or whatever.

    I really don't get why this is not implemented. it seems to me that form submissions are of much more interest to the user than plain http gets.

    there is a bug for this feature filed for mozilla, and I even tried implementing it. but there is little interest, which amazes me.

    • Mozilla's View|PageInfo shows form actions, and the action of every link on a page. It seems to cut off long URL without an easy way to resize columns, though.
    • Not to sound like a broken record, but you could easily write a regex in Proxomitron to do this.

      You'd spit out a copy of the form url, formatted as you wish, and also spit out the original unaltered.

      (In fact, there's already a Proxomitron filter (regex) to display hidden inputs, which is useful in html page debugging.)

    • 1. Open Mozilla
      2. Surf to a page containing a form
      3. Right click->View Page info
      4. Click the Forms tab
      5. Witness the action, method, name, and fields of every form on this page.

  • A question. (Score:5, Insightful)

    by leastsquares ( 39359 ) on Tuesday November 19, 2002 @08:11PM (#4711466) Homepage
    Maybe I am being naive, but...

    How is the process of blocking Ads protecting my privacy?

    • Re:A question. (Score:5, Insightful)

      by Zaffle ( 13798 ) on Tuesday November 19, 2002 @11:35PM (#4712771) Homepage Journal

      Maybe I am being naive, but...

      How is the process of blocking Ads protecting my privacy?

      Advertising companies (especially DoubleClick [doubleclick.net]) serve up ads for a lot of websites, they also note down what sites you goto, and build up a profile. (Note: this can be stopped using DoubleClicks opt-out feature, however not all advertising sites have this option, and then, they are all opt-out, not opt-in)

      This might not seem like such a bad thing, (eg hey, now I'm only getting ads for games and linux stuff, not tampons and other crap (appoligies to woman and everyone else I offended with that remark)), however they also try their hardest to link this profile with your real name, address, etc.

      This all comes back to a case awhile ago, where a woman sued a supermarket because she slipped on a large patch of water in one of the aisles. The supermarket then, using her "discount" card, produced logs in court showing she would regularly purchase large ammounts of alcohol.

      In the end, do you really want companies you don't know, knowing a lot about what you do on the web, and where you go?

      True, your ISP knows almost everything (if they bother), unless you use FreeNet or something, and Visa/Mastercard/Amex know a lot about your spending habits, but just how much are you willing to put up with?

    • Re:A question. (Score:3, Insightful)

      by bluestar ( 17362 )
      Maybe I am being naive, but...

      How is the process of blocking Ads protecting my privacy?

      It's simple, yet insidious.

      Those ads contain cookies. Also, those ads are present on many different web sites.

      So some random third party ad agency (DoubleClick being the most infamous) is able to track you across many of the web sites you visit. Slashdot many not know that you visit porn.com, and porn.com may not know that you read Slashdot, but DoubleClick does.

      Worse, most people aren't even aware that DoubleClick exists.
  • Like another post I read on here, I too am wondering what it is you are viewing that you need to hide? Is it porn? Complaining that browsers to hide the fact that you look at porn is kind of strange... I mean if you do it, why be ashamed of it? Dynamic pages generally shouldn't be saved in cache, but aside from that......

    ... if you are worried about privacy, why not be security conscious at a higher level (or lower depending on how you look at it). Don't leave your computer unlocked, or use a system that supports user accounts. If you have a cache full or porn, bomb making information, or top secret information but are logged in under your name, your cache shouldn't be readable... if it is then (a) get a real OS and/or (b) look into user permissions.

    Don't blame the web browser for your own carelessness.

    • Re:Web privacy? (Score:1, Informative)

      by Anonymous Coward
      Um, you've now got a lot more to worry about than clearing your cache. I'm not sure why Slashdot hasn't covered this, since the events of the last two days were such a big deal when it comes to privacy.

      In any event, Ashcroft and Poindexter just got authorized by a secret court to feed their $200 million Total Information Awareness system that is part of the Homeland Security Act all the data they can eat. What that means to the average Slashdot reader is that come this time next year, if someone in the FBI, for whatever reason, wants a list of IP addresses who visited slashdot.org from Jun 2003 to Sep 2003, who viewed any posts containing references to Public Key Cryptography or Afghanistan, and then given that list wants to see all search terms that they have entered at www.google.com during the same period, they can have it.

      Again I say: You've got a lot more to worry about than the contents of your cache. None of us are above suspicion.
  • If you're interested in blocking ads on the Internet, I suggest Ad Shield. It's very efficent, easy to use, and blocks graphical ads and shockwave ads, and it also blocks pop-ups and unders.

    http://adshield.org [adshield.org]

    From their webpage, "AdShield is a freeware banner ad blocker that improves browser performance and usability by suppressing the download and display of ad images, pages and popups."

    The only requirement is IE5.0+ on a Windows machine.

    • Install Linux with encryption for at least /tmp and /home.
    • Install VMware.
    • Install the operating system of your choice in that VM, entering no personal information or other identifiers.
    • Optional: repeat with another VM and find differences in registries/dot files between the two installs and clobber them. (This would give you the oppotunity to change GUIDs, and other unique identifiers).
    • Install JAP or any other favorite anonymizing proxy.
    • Assign your VM a static IP on your network.
    • Turn on all the locked down browser security settings. Don't forget to set proxies for all the protocols, not just http:// and https://. (It'd be a bummer to go through all that trouble and get nailed by loading a 1x1 GIF from an ftp:// or gopher:// link that went around your proxy.)
    • At your firewall (you're using a separate box for a firewall, right?), block access to all ports and addresses for the VM's static IP save those needed to reach your anonymizing proxy.
    • Make your VMware settings use non-persistent disks. That virtual machine will remember no changes each use once you've done this. (It keeps track of the state of the disk while running in /tmp--that's why you're using an encrypted filesystem on the host.)
    • Surf away, secure in the knowledge that it would at least be difficult to find out what nefarious things you're doing from your machine through forensic analysis
    • Don't get so comfortable that you forget that there are lots of other ways, including subverting your favorite anonymizing proxy (which may well be run by the MIB/TPTB/FBI/NSA/CIA/HSS).
    • When you've done something that can land you in prison (like violating the DMCA), ideally, physically destroy your hard disk--but if that isn't an option, wipe (dd if=/dev/urandom of=/dev/hd? bs=512 count=? a few times) your host machine and start over, using the VM you saved with the fresh install. Remember that wiping won't overwrite any spare sectors that might contain incriminating stuff. If you're working for the mob or what have you, wiping, then destruction (think grinding to a fine powder or melting to slag) is the most prudent option.

      Good luck. Please chip in if you can think of anything I haven't--this is pretty off-the-cuff.

    • [snip of several paragraphs of thoughful security paranoia]
      Please chip in if you can think of anything I haven't--this is pretty off-the-cuff.

      Do that bit in Neal Stephenson's Cryptonomicron: make your door frame out of a big electromagnet, so when The Man carts your PC away for analysis, the HDD get degaussed.

  • Mozilla needs configurable zones (Score:4, Insightful)

    by Hard_Code ( 49548 ) on Wednesday November 20, 2002 @09:25AM (#4714646)
    Mozilla needs configurable zones.

    Right now you can set privacy properties based on *content*. But it is much much more likely that you will want to set them based on *site*, not *content*. Mozilla needs to take a page from IE, and reorganize its settings so that all content settings belong to a zone, which maps to a set of URLs (set of regular expressions, etc.). In IE there is a fixed number of zones, and hence, only a fixed number of security settings/levels. There is no reason that in Mozilla this could not be expanded to arbitrary zones. It is really burdensome to have to configure things on a content-by-content basis, when it is really the *site* for which you want to configure settings.

    Here is what I would do:

    default zone: most security risks are disabled...not all though, because many common sites would just be broken (javascript, etc.)

    trusted zone: all security settings are open (e.g., my own local network, my office network, etc.)

    untrusted zone: goatse.cx, etc. Any sites which I absolutely want EVERYTHING disabled on. In reality I haven't found much to stick in here because my default settings are pretty strict.

    somewhat-trusted sites: some sites I "sorta" trust...in that I use them daily and they need a lower level of security than default sites, yet, I still don't want everything on (e.g. nytimes.com)

    IE has no notion of the latter because it only has fixed zones. In Mozilla there could be an arbitrary number of zones/setting configurations (maybe some sites you want ONLY flash enabled and nothing else? maybe some javascript development sites you want ONLY javascript enabled? etc.)

    • Mozilla could satisfy a lot of image/cookie blocking schemes with a single pref:

      [ ] Block images and cookies that do not originate from the same domain as the current page.

      I think I read somewhere in a Bugzilla comment that some suits at AOL don't want this kind of pref to exist (one reason is that it would totally destroy all netscape toolbars that sites add to themselves). Think about it: browse anywhere.com, never see the ads that originate from *.mediaclick.net. Bliss.

      • This is one of the best ideas ever. I can't imagine for a skilled programmer, it would be too difficult to add to a Mozilla clone.

        In addition to / instead of

        []Block images and cookies that do not originate from the same domain as the current page

        I'd like to see

        []Disallow scripts to spawn new windows (Override using the SHIFT key)

        Automatically stop popups, in the browser itself--no need for a "popup blocker" type software.
      • That already exists in Mozilla. Under the "Privacy&Security" section in preferences. Under Cookies select: []enable cookies for the originating web site only Under images select: []accept images that come from the originating server only
    • Isn't this part of the reason why IE had that huge hole in it? They opened help and it ran as what you would call a default zone. Then they ran other [bad] stuff from there. I'm sure moz programmers would make sure that didn't happen (insert free software .vs non free software speech). I do agree with the fact that moz doesn't use security zones. For instance, my school network runs rampid with viruses. I don't want low security there. I think that the best way to go would be to use a proxy (maybe someone could make a specific one for moz and put it on mozdev).

      But I'm not one of those over-cautious people that need privacy everywhere. I see all pictures, use flash, and have cookies enabled for site only. I'm just really glad all those pop-ups are gone. =)

  • IE of course!! (Score:1, Flamebait)

    by stinkydog ( 191778 )
    Let's consider this a moment:

    Privacy is a lack of personal data freely accessable.

    Computers have hard drives and yours is full of personal data (yes, your midget porn collection says something about you).

    IE make it simple for you or anyone else to format your hard drive [slashdot.org].

    Once the data is gone, your privacy is ensured!

    SD

Slashdot Top Deals

What is research but a blind date with knowledge? -- Will Harvey

Close