Browsers Which Protect Your Privacy? 107
valkraider asks: "Browsers are getting better at protecting user's privacy. Mozilla has pretty good cookie preferences. Many browsers like OmniWeb for Mac OS X will block images from sites based on wildcard expressions (like *ad*). Most browsers have settings to delete cookies and cache and such at the end of each session. Even IE for windows (not Mac) will allow you to 'import' a privacy file and control many things pretty tightly. Currently on PCs I use Mozilla with no disk cache, no persistent cookies, no third party images,and many blocked image sites. I can do almost the same with Chimera on Mac OS X. What are people's favorite browsers for protecting your privacy?" Which browsers provide the best balance between functionality and privacy? What privacy features would you like to see, that are missing from those currently available?"
Site specific Flash blocking (Score:3, Interesting)
Re:Site specific Flash blocking (Score:1)
Treating Flash like images (Score:5, Insightful)
Re:Treating Flash like images (Score:4, Interesting)
Opera 6.1 (at least for Linux) offers one-button disabling of all plugins on a per-window basis.
A quick work around for this (Score:3, Informative)
192.168.0.3 ad.doubleclick.net
This makes my browser look for the flash file (or any other ad.doubleclick.net url) on my own box, thereby breaking the the ad and preventing the cookies.
Re:A quick work around for this (Score:2)
And per the
# By the way, Arnt Gulbrandsen says that 127.0.0.1
# should NEVER be named with the name of the machine. It causes problems
# for some (stupid) programs, irc and reputedly talk.
I just follow directions.
Re:A quick work around for this (Score:2)
heck the whole class a is loopback
Re:A quick work around for this (Score:3, Insightful)
Re:A quick work around for this (Score:2, Interesting)
Re:Treating Flash like images (Score:1)
Then I found Mozilla, and settled for some lame ads, along with the built-in feature to disable pop-up ads, and I've been okay with that.
My biggest irk with Flash ads is when they scroll across the screen or do a jig right in front of the REAL content I'm trying to look at.
I use... (Score:5, Informative)
Re:I use... (Score:1)
So no matter how many things you're able to block and no matter how is it is to do it you still have to deal with that.
Re:I use... (Score:1)
Re:I use... (Score:1)
Internet Explorer 6 for Windows (Score:4, Funny)
Cookies (Score:2, Interesting)
However it would be nice to have logging of which cookies are actually used during a browsing session so you can keep track of who's tracking you. Maybe this is possible and/or exists in other browsers?
Re:Cookies (Score:1)
Being pretty agnostic about browsers (in terms of whether or not it comes from MS), I must say I have moved all of my general browsing over to Pheonix on Win machines -- I still need to use IE to access internal websites for one of the companies I work for who shall remain nameless. The control over cookies and pop-up blocking (javascript) controls along with its lightness is quite nice. I haven't even installed the Flash plugin, so no worries about those adds either.
Re:Cookies (Score:5, Informative)
<MSIEPrivacy>
<MSIEPrivacySetting s formatVersion="6">
<p3pCookiePolicy zone="internet">
<firstParty noPolicyDefault="forceSession" noRuleDefault="forceSession" alwaysAllowSession="no">
</firstParty>
<thirdPa
</thirdParty>
</p3pCoo
<flushCookies/>
</MSIEPrivacySettings
</MSIEPrivacy>
*NOTE* The submit process is adding some spaces..
Line 2: remove space in MSIEPrivacySettings
Line 6: remove space in thirdParty
Line 8: remove space in p3pCookiePolicy
These custom settings force ALL cookies to session lifetime, and does not allow 3rd party cookies. It will flush all your existing cookies when you import it. (you can remove the flush cookies element to not flush them on import).
Re:Cookies (Score:1)
One thing that could be done, I suppose, is to pop up some notification every time the browser sends the cookie, but that wouldn't really tell you when the remote site's using the cookie. And I have to assume that it would be ungodly annoying, but I think having cookies anything but always-accepted is annoying as hell, myself. So I'm sure a lot of pro-Privacy people would like this as a feature.
--AC
Got to say it... (Score:4, Informative)
Re:Got to say it... (Score:2)
Sometimes the best tool isn't always open source.
Opera: "Delete Private Data" (Score:2)
* Cookies (temporary or all)
* Cache (password-protected pages or all)
* History (visited pages, typed-in addresses, visited links, transferred files)
* Clear email passwords (if you use the built-in email)
Of all of these, I think I most like the ability to quickly clear typed-in addresses. I share the computer with the kids, and the last thing I want is for them to type the letter "g" and have "goatse.cx" pop up!
Mozilla (almost) rules (Score:4, Interesting)
Cookies are selectively permitted and pop-ups are blocked.
Security is imho the biggest reason to use Mozilla in stead of IE.
Re:Mozilla (almost) rules (Score:1)
Re:Mozilla (almost) rules (Score:2)
Wrong. (Score:3, Informative)
Re:Mozilla (almost) rules (Score:3, Interesting)
embed[src=*"doubleclick.net"] { display: none!important; }
img[src=*"ads.slashdot.org"] { display: none!important; }
*[src=*"microsoft.com"] { text-decoration: blink!important; }
You get the idea. The "!important" part means "override the author's style sheets", not "not important" which is what I initially thought it meant.
Re: Style Sheets (Score:2)
What I'm trying to figure out is a way to have my stylesheet recognize any image of a given standard banner size (I can do that), and then tell the browser to use the actual size of the image instead of whatever the HTML has encoded for it. Then when my ad blocker substitutes a 1x1 transparent gif, I won't even see a big block of space. I'm new to style sheets (as of reading your post and Googling the web a bit); can I do this?
Re: Style Sheets (Score:2)
*[height="60"][width="468"], *[height="60px"][width="468px"],
*[height="60"][
*[height="600"]
*[height="600"
*[height="120"
*[height="150"
*[height="300"
*[height="336"
*[height="400"
*[height="250"
*[height="90"]
*[height="280"]
{ width: auto !important; height: auto !important; }
Those are based on a list of standard ad sizes I found somewhere, and I'm adding to it based on the blank spaces I run across. The great thing about this is that if I happen to find a page that uses that size of image for something that isn't blocked, I still see it just like normal, but if it is blocked (by my auto-proxy script) and substituted by a 1x1 transparent gif, that's all the space the ad takes up.
Now all I need to do is replace my 1x1 transparent gif with a 0x0 gif or jpeg. Is such an image allowed by the specs?
Re: Style Sheets (Score:2)
Re: Style Sheets (Score:2)
Mozilla also has attributes called "naturalHeight" and "naturalWidth" for images, but they're only available from Javascript AFAICT.
Blocking images without visiting the site... (Score:2)
Right now with Mozilla, if I want to block images from goats.cx (or whatever), I need to visit the site, view the disgusting image, right click, and select "Block images from this site" (or go to Tools: Image Manager: Block images from this site).
Re:Blocking images without visiting the site... (Score:2, Insightful)
Ad Blocking with Mozilla [deftone.com] has some good info. You can also use this in Chimera to some extent. For more info Google [google.com] it.
Re:Blocking images without visiting the site... (Score:2)
Adding something like http*://*/ad/* and http*://*/ad/* really cuts down on a lot, as does http*://*doubleclick*/*
Dynamic filtering (Score:4, Informative)
I use this with both IE and Mozilla. I have Mozilla ask before accepting cookies, so I've added a bunch of usage tracking sites to my proxy script.
You can find a sample of how to do this at a friend's site: no-ads [schooner.com]
iCab (Score:5, Interesting)
It can filter images based on the server, link, size, or anything else.
It can filter cookies based on the server, duration, or anything else.
it can filter JavaScript (InScript) based on server, action, or anything else.
One of the best features: You can set it to only use "Referer" from within the same domain. So if I link to a Sony.com page from Slashdot, Sony has no idea how I got to the page. But Sony can track how I navigate their site (You can also set iCab to never send referer:)
There are more features [www.icab.de] than I could ever list here. Suffice to say it is very powerful and very configurable. Anyone using MacOS deserves to look at it.
it is still missing a few things, and it is compliant to a fault at times (with regards to page layout), but I use it for 99.5% of my browsing without and problems.
Re:iCab/second (Score:3, Informative)
had no idea (Score:1)
Konqueror and cookies (Score:4, Insightful)
'Automatically accept session cookies'
Session cookies are generally those that provide application persistency, applications that often won't work without them - even ones I've written myself
Also, konq has (Mozilla too, I believe) a 'smart' popup window policy, showing only windows that you yourself 'request' by clicking a link etc. Automated popups magically just don't appear.
Blocking regular ads on pages is an interesting feature in Mozilla, which I'm glad doesn't exist in konqueror or most other browsers - I can't see how this could be good for the user in the long run.
Re:Konqueror and cookies (Score:3, Interesting)
Compromise: How about a feature that allows me to specify that from some sites I do not want ads at all, and from other sites I want to download the ad, but not display it. Thus the site gets their advertising money, and I am not bothered. Haven't seen this in any browser yet, though.
Downloading and not viewing ads (Score:1)
Compromise: How about a feature that allows me to specify that from some sites I do not want ads at all, and from other sites I want to download the ad, but not display it. Thus the site gets their advertising money, and I am not bothered. Haven't seen this in any browser yet, though.
This is unethical behaviour, sure, I hate ads as much as the next guy, and block them when I can (actually, I probably hate ads more than the next guy, I don't own a tv, nor do I watch tv. DVDs at home, and videos at friends places, never tv. HATE tv ads). But downloading ads for the purpose of revenue raising, but not viewing them?
It devalues web advertising for all sites that rely on them for revenue.
What does _who_ want? (Score:3, Insightful)
Web surfers might want a web browser which offers them more control of their surfing experience (privacy enhancements, for example), but web site purveyors want to see features which take control away from the surfer (such as unclosable pop-under windows).
The result of the collision of those two trends is that browsers (such as opera) which offer ad-blocking and privacy enhancing features are going to be discriminated against as opposed to browsers (such as IE) which offer web content providers a rich set of features. And the more empowering (to the user) the browser is, the more quickly web sites will move to degrade support for that browser.
Its' a shame, but phenomenon like this are going to kill the Internet as we know it, or reduce it to something nobody wants to waste their time on (like broadcast television.)
A filtering proxy ususally beats inbuilt features (Score:5, Informative)
I use Privoxy (get if from SourceForge).
It's a filtering HTTP proxy, incredibly configurable, and of course browser and platform independant. The "out of the box" config also does a really good job (IMHO) of filtering without being too intrusive.
Features include:
Filtering images, flash and java applets
Cookie management including transforming permanent cookies to session based cookies.
Pop-up window killing
Filtering of any URL pattern with regular expressions
.... plus much more. Really, to much to list. Try it.
What's the big deal about privacy? (Score:2)
For the record, I use Netscape 7 with all the features that I can.
-BrentRe:What's the big deal about privacy? (Score:1)
Damn activex is the only reason I don't make phoenix my default browser.
Re:What's the big deal about privacy? (Score:2)
There are actually sites that still exist with ActiveX controls?
-BrentRe:What's the big deal about privacy? (Score:1)
Re:What's the big deal about privacy? (Score:3, Informative)
Re:What's the big deal about privacy? (Score:1)
It doesn't matter if the image is coming from a static image file or a script on the server. The HTTP request your browser makes is identical modulo the name of the file. That is, any information that is available to a script is contained in the request for a static file and thus is loggable.
this script grabs all kind of parameters through javascript from the user
Hmm... if you mean that javascript on the client can alter the img src tag based on client-side information, then ok. But again, it being a script on the other hand vs a static file is not relevant.
Re:What's the big deal about privacy? (Score:2)
<script language="JavaScript" type="text/javascript">
<!--
var W="id=1";
W+="&browserDate="+escape(new Date());
W+="&title="+escape(document.title);
W+="&url="+escape(window.document.URL);
W+="&referrer="+escape(window.document.referre r);
W+="&appname="+escape(navigator.appName);
W+="&appversion="+escape(navigator.appVersion) ;
W+="&cookieOK="+(navigator.cookieEnabled?"Yes":
W+="&userLanguage="+(navigator.appName=="Netsca
W+="&platform="+navigator.platform;
W+="&bgColor="+escape(document.bgColor);
W+="&javaOK=Yes";
if(typeof(screen)=="object") {
W+="&screenResolution="+screen.width+"x"+screen.h
W+="&colorDepth="+screen.colorDepth;
W+="&NSpluginList=";
for( var i=0; i< navigator.plugins.length; i++)
W+=escape(navigator.plugins[i].name)+";";
}
document.write('<IMG BORDER="0" WIDTH="1" HEIGHT="1" SRC="storehit.asp?'+W+'" hspace="0" vspace="0" alt="hello"/>');
</script>
<NOSCRIPT>
<IMG BORDER="0" WIDTH="1" HEIGHT="1" SRC="storehit.asp?id=1&title=NO%20SCRIPT&url=http
</NOSCRIPT>
Re:What's the big deal about privacy? (Score:2)
<% 'storehit.asp
function noQuotes(strIn)
' function to replace single quotes
end function
strConnection = "database connection string"
set objDB = server.Createobject("ADODB.Connection")
objDB.Op
objDB.execute("INSERT INTO info (id, browserDate, title, url, referrer, appname, appversion, cookieOK, userLanguage, platform, bgColor, javaOK, screenResolution, colorDepth, NSpluginList, now, user, pass, content_type, user_agent, http_referer, logon_user, remote_addr, remote_host, remote_user) VALUES (" & noQuotes(request.querystring("ID")) & ",'" & noQuotes(request.querystring("browserDate")) & "','" & noQuotes(request.querystring("title")) &
etc., etc.
noQuotes(Request.ServerVariables("REMOTE_ADDR")
response.redirect("spacer.gif")
%>
Re:What's the big deal about privacy? (Score:1)
Re:What's the big deal about privacy? (Score:1)
The REFERER http field for images gives the URL the image is emmeded in, so they can tell what you have searched for (the search results for most search-engines encode the search-text in the URL).
All it takes is for a website to leak personal information (say a web-mail site that has your email addy in the URL), and they can get that as well...
By 'You' I mean the cookie, of course.
Re:What's the big deal about privacy? (Score:2)
Personal favourite.... (Score:1)
Re:Personal favourite.... (Score:1)
I like IE with DMR enabled by default... (Score:1)
Really though, this is an obvious answer: Mozilla has many excellent privacy features, though a bit on the fat side. On the other hand, Chimera, on os x is going to be the one to look out for, as it has many blocking features as mentioned before, but are controlled by either off or on, and not setting different variables as mozilla does. Chimera also lacks (as od todays build) image control.
privoxy (Score:4, Informative)
I find that privoxy [privoxy.org] works better for me than the mechanisms built in to any browser. It's based on the old junkbusters codebase with many more features. It's available for both windows and very nearly any form of UNIX (or UNIX-like) OS you might reasonably use to browse the net. (Of course, I have it set to allow ads for slashdot :-)) In combination with phoenix's popup blocking (which takes care of SSL sites such as hushmail that privoxy can't) I find that it gives me near-perfect control over my browsing experience.
That said, if I really suspect that a particular site may be malicious, as opposed to simply obnoxious, I look it over in lynx first.
About Mozilla (Score:2)
I would like, for example, to allow only slashdot.org and nytimes.com to set persistant cookies. I can do this in explorer by setting it to block all cookies, then putting certain sites in my 'trusted sites' list, but I don't think mozilla works that way.
Re:About Mozilla (Score:2, Informative)
In Mozilla you can block or unblock cookies on a per-site basis using Tools->Cookie Manger->Block Cookies from this Site and Tools->Cookie Manger->Unblock Cookies from this Site.
I suspect you could achieve what you want in Mozilla by setting the default policy to blocking cookies, and then visiting the sites where you want to allow cookies and using the Unblock Cookies from this Site option to enable cookies for just those sites.
Those choices are stored persistently in cookperm.txt in the mozilla directory, so you could possibly even edit that file manually providing you carefully followed the format of existing entries.
Ewen
Re:About Mozilla (Score:2)
Mozilla is certainly heading in a nice direction. Hopefully in the future their cookie management will become more robust.
puck
Re:About Mozilla (Score:2)
No such luck, if I have chosen "disable cookies" then the "unblock cookies from this site" option becomes unhighlighted.
I even tried adding "slashdot.org [tab] 0T" to cookperm.txt, and while the cookie manager lists slashdot as "site can set cookies", it still doesn't override the "disable cookies" option.
A different way to filter ads? (Score:2)
The Browser's not the solution (Score:5, Insightful)
The proxy'll work with any browser that allows you to set a proxy, so that you can set up a rule set that doesn't change when/if you change browsers (i.e., in cases where the site only supports, e.g., IE).
More importantly, the proxy (if it supports regexed grepping) can be set up to remove or alter any arbitrary HTML -- something most browsers aren't set up to do. And it provides a additional layer of defense when the browser is buggy (see the earlier
I use Proxomitron [proxomitron.org] under Windows. It does arbitray regex, so I can remove ads, flash, abitrary javascript, etc. I can also add or change elements (showing hidden fields is useful in debugging). And I suspect I'll be able to come up with a filter for the IE bug I mentioned above.
Re:The Browser's not the solution (Score:2)
Disagree (Score:2)
But I don't want to have two separate HTTP layers. I've used Junkbuster, and it's slow, and results in different behaviours (particularly in cases of servers not responding).
We already have a URL-fetching layer in the browser. Let's extend it to have plugins that let you control what it does. You can already do this with automatic proxy configuration to decide where (if at all) to fetch a given URL based on a JavaScript function. The only thing you can do with a real proxy that isn't yet available through a plugin is modification of retreived content. You can block the ads, but you can't eliminate the HTML that chews up a big block of space for the ad.
Get a good HOSTS file for this (Score:2, Informative)
Really its only a few websites which do the majority of the ads, so not that many sites actually need to be blocked. Anything that makes it through my HOSTS file is usualy on a site that I enjoy (ie. Slashdot) and so I'm not bothered by the ads. One drawback could be that you see an annoying message where the image is supposed to be, however there is software to change that as well.
The hosts file I use can be found here: Kazaa Lite Webpage [doa2.host.sk], you'll have to click on the "supertrick" button on the left, since I'm too lazy to figure how to directly link.
How I get ultimate browser privacy (Score:2)
GET / HTTP/1.0
Re:How I get ultimate browser privacy (Score:1)
Don't neglect the 80; it's vital. Depending on what telnet program you use, you may need to figure out how to direct it to connect to port 80 instead of the standard telnet port.
one feature no browser has (Score:4, Insightful)
I really don't get why this is not implemented. it seems to me that form submissions are of much more interest to the user than plain http gets.
there is a bug for this feature filed for mozilla, and I even tried implementing it. but there is little interest, which amazes me.
Re:one feature no browser has (Score:1)
Re:one feature no browser has (Score:2)
You'd spit out a copy of the form url, formatted as you wish, and also spit out the original unaltered.
(In fact, there's already a Proxomitron filter (regex) to display hidden inputs, which is useful in html page debugging.)
Re:one feature no browser has (Score:2)
1. Open Mozilla
2. Surf to a page containing a form
3. Right click->View Page info
4. Click the Forms tab
5. Witness the action, method, name, and fields of every form on this page.
A question. (Score:5, Insightful)
How is the process of blocking Ads protecting my privacy?
Re:A question. (Score:5, Insightful)
Advertising companies (especially DoubleClick [doubleclick.net]) serve up ads for a lot of websites, they also note down what sites you goto, and build up a profile. (Note: this can be stopped using DoubleClicks opt-out feature, however not all advertising sites have this option, and then, they are all opt-out, not opt-in)
This might not seem like such a bad thing, (eg hey, now I'm only getting ads for games and linux stuff, not tampons and other crap (appoligies to woman and everyone else I offended with that remark)), however they also try their hardest to link this profile with your real name, address, etc.
This all comes back to a case awhile ago, where a woman sued a supermarket because she slipped on a large patch of water in one of the aisles. The supermarket then, using her "discount" card, produced logs in court showing she would regularly purchase large ammounts of alcohol.
In the end, do you really want companies you don't know, knowing a lot about what you do on the web, and where you go?
True, your ISP knows almost everything (if they bother), unless you use FreeNet or something, and Visa/Mastercard/Amex know a lot about your spending habits, but just how much are you willing to put up with?
Re:A question. (Score:3, Insightful)
How is the process of blocking Ads protecting my privacy?
It's simple, yet insidious.
Those ads contain cookies. Also, those ads are present on many different web sites.
So some random third party ad agency (DoubleClick being the most infamous) is able to track you across many of the web sites you visit. Slashdot many not know that you visit porn.com, and porn.com may not know that you read Slashdot, but DoubleClick does.
Worse, most people aren't even aware that DoubleClick exists.
Web privacy? (Score:1)
Don't blame the web browser for your own carelessness.
Re:Web privacy? (Score:1, Informative)
In any event, Ashcroft and Poindexter just got authorized by a secret court to feed their $200 million Total Information Awareness system that is part of the Homeland Security Act all the data they can eat. What that means to the average Slashdot reader is that come this time next year, if someone in the FBI, for whatever reason, wants a list of IP addresses who visited slashdot.org from Jun 2003 to Sep 2003, who viewed any posts containing references to Public Key Cryptography or Afghanistan, and then given that list wants to see all search terms that they have entered at www.google.com during the same period, they can have it.
Again I say: You've got a lot more to worry about than the contents of your cache. None of us are above suspicion.
Ad Shield (Score:1)
http://adshield.org [adshield.org]
From their webpage, "AdShield is a freeware banner ad blocker that improves browser performance and usability by suppressing the download and display of ad images, pages and popups."
The only requirement is IE5.0+ on a Windows machine.
Security in depth: (Score:2)
Good luck. Please chip in if you can think of anything I haven't--this is pretty off-the-cuff.
Re:Security in depth: (Score:2)
Please chip in if you can think of anything I haven't--this is pretty off-the-cuff.
Do that bit in Neal Stephenson's Cryptonomicron: make your door frame out of a big electromagnet, so when The Man carts your PC away for analysis, the HDD get degaussed.
Mozilla needs configurable zones (Score:4, Insightful)
Right now you can set privacy properties based on *content*. But it is much much more likely that you will want to set them based on *site*, not *content*. Mozilla needs to take a page from IE, and reorganize its settings so that all content settings belong to a zone, which maps to a set of URLs (set of regular expressions, etc.). In IE there is a fixed number of zones, and hence, only a fixed number of security settings/levels. There is no reason that in Mozilla this could not be expanded to arbitrary zones. It is really burdensome to have to configure things on a content-by-content basis, when it is really the *site* for which you want to configure settings.
Here is what I would do:
default zone: most security risks are disabled...not all though, because many common sites would just be broken (javascript, etc.)
trusted zone: all security settings are open (e.g., my own local network, my office network, etc.)
untrusted zone: goatse.cx, etc. Any sites which I absolutely want EVERYTHING disabled on. In reality I haven't found much to stick in here because my default settings are pretty strict.
somewhat-trusted sites: some sites I "sorta" trust...in that I use them daily and they need a lower level of security than default sites, yet, I still don't want everything on (e.g. nytimes.com)
IE has no notion of the latter because it only has fixed zones. In Mozilla there could be an arbitrary number of zones/setting configurations (maybe some sites you want ONLY flash enabled and nothing else? maybe some javascript development sites you want ONLY javascript enabled? etc.)
Re:Mozilla needs configurable zones (Score:2)
Mozilla could satisfy a lot of image/cookie blocking schemes with a single pref:
[ ] Block images and cookies that do not originate from the same domain as the current page.
I think I read somewhere in a Bugzilla comment that some suits at AOL don't want this kind of pref to exist (one reason is that it would totally destroy all netscape toolbars that sites add to themselves). Think about it: browse anywhere.com, never see the ads that originate from *.mediaclick.net. Bliss.
Re:Mozilla needs configurable zones (Score:2)
In addition to / instead of
[]Block images and cookies that do not originate from the same domain as the current page
I'd like to see
[]Disallow scripts to spawn new windows (Override using the SHIFT key)
Automatically stop popups, in the browser itself--no need for a "popup blocker" type software.
Re:Mozilla needs configurable zones (Score:1)
Re:Mozilla needs configurable zones (Score:1)
But I'm not one of those over-cautious people that need privacy everywhere. I see all pictures, use flash, and have cookies enabled for site only. I'm just really glad all those pop-ups are gone. =)
IE of course!! (Score:1, Flamebait)
Privacy is a lack of personal data freely accessable.
Computers have hard drives and yours is full of personal data (yes, your midget porn collection says something about you).
IE make it simple for you or anyone else to format your hard drive [slashdot.org].
Once the data is gone, your privacy is ensured!
SD