privacyguides/privacytools.io
Archived
1
0
Fork 0
Code Issues 304 Pull Requests 47 Activity

📝 Correction | privacy.trackingprotection.enabled makes the browser send the DNT header #2414

New Issue
Open
opened 2021-08-26 10:36:32 +00:00 by lorenzo9uerra · 6 comments
lorenzo9uerra commented 2021-08-26 10:36:32 +00:00 (Migrated from github.com)
Copy Link
Copy Source

Description

I have noticed that setting privacy.trackingprotection.enabled to true makes the browser send DNT to every website. While this was theoretically a nice improvement when it was created, now it's not used by almost any website and insted helps tracking a lot, since very few browsers send this header.

Why I am making the suggestion

This feature is counterproductive to users' privacy

My connection with the software

I use firefox daily and I noticed the header sent to every website

  • I will keep the issue up-to-date if something I have said changes or I remember a connection with the software.
## Description I have noticed that setting `privacy.trackingprotection.enabled` to `true` makes the browser send DNT to every website. While this was theoretically a nice improvement when it was created, now it's not used by almost any website and insted helps tracking a lot, since very few browsers send this header. ## Why I am making the suggestion This feature is counterproductive to users' privacy ## My connection with the software I use firefox daily and I noticed the header sent to every website - [x] I will keep the issue up-to-date if something I have said changes or I remember a connection with the software.
👍 1
ph00lt0 commented 2021-08-26 11:06:58 +00:00 (Migrated from github.com)
Copy Link
Copy Source

I don't see the issue. Most users will have tracking protection and DNT enabled by now.

I don't see the issue. Most users will have tracking protection and DNT enabled by now.
lorenzo9uerra commented 2021-08-26 11:20:43 +00:00 (Migrated from github.com)
Copy Link
Copy Source

They don't, most browsers don't have it enabled by default, including chrome, ungoogled-chromium, firefox, brave and bromite. Which means that only the few that enabled it manually are actually sending DNT, which makes fingerprinting much easier. And websites simply don't respect the DNT header, which is why it's being deprecated

They don't, most browsers don't have it enabled by default, including chrome, ungoogled-chromium, firefox, brave and bromite. Which means that only the few that enabled it manually are actually sending DNT, which makes fingerprinting much easier. And websites simply don't respect the DNT header, which is why it's being deprecated
youdontneedtoknow22 commented 2021-08-27 10:28:31 +00:00 (Migrated from github.com)
Copy Link
Copy Source

Can you please set ETP to Strict (without setting DNT to always) and test if the header is sent? PTIO is moving in the direction of just setting ETP to strict without tweaking from about:config. And it would be interesting to know if then DNT is sent.
It's true, most browsers don't send DNT by default (only librewolf does that AFAIK, which is a really bad idea. But again, who cares)

Can you please set ETP to Strict (without setting DNT to always) and test if the header is sent? PTIO is moving in the direction of just setting ETP to strict without tweaking from about:config. And it would be interesting to know if then DNT is sent. It's true, most browsers don't send DNT by default (only librewolf does that AFAIK, which is a really bad idea. But again, who cares)
lorenzo9uerra commented 2021-08-27 11:59:16 +00:00 (Migrated from github.com)
Copy Link
Copy Source

Yeah, setting ETP to Strict both firefox desktop and mobile send DNT. Using every other tweak privacytools suggests except privacy.trackingprotection.enabled firefox doesn't send DNT

Yeah, setting ETP to Strict both firefox desktop and mobile send DNT. Using every other tweak privacytools suggests except `privacy.trackingprotection.enabled` firefox doesn't send DNT
ph00lt0 commented 2021-08-27 12:52:03 +00:00 (Migrated from github.com)
Copy Link
Copy Source

Yeah, setting ETP to Strict both firefox desktop and mobile send DNT. Using every other tweak privacytools suggests except privacy.trackingprotection.enabled firefox doesn't send DNT

Yeah so you will be in the pool of all people that have strict mode on. As long as you do not modify anything else I do not see the issue. I think Firefox purposefully does this so that more people with have DNT and therefore you won't stand out.

> Yeah, setting ETP to Strict both firefox desktop and mobile send DNT. Using every other tweak privacytools suggests except `privacy.trackingprotection.enabled` firefox doesn't send DNT Yeah so you will be in the pool of all people that have strict mode on. As long as you do not modify anything else I do not see the issue. I think Firefox purposefully does this so that more people with have DNT and therefore you won't stand out.
lorenzo9uerra commented 2021-08-27 12:59:16 +00:00 (Migrated from github.com)
Copy Link
Copy Source

Exactly, you'll be in the small pool of people who use firefox, and in that pool you will be in the section of those who set strict ETP on. That's excactly why it makes fingerprinting easier. And since nobody uses it for its purpose, it can be used to target those who care for their privacy, so they can advertise VPNs and tech-related stuff

Exactly, you'll be in the small pool of people who use firefox, and in that pool you will be in the section of those who set strict ETP on. That's excactly why it makes fingerprinting easier. And since nobody uses it for its purpose, it can be used to target those who care for their privacy, so they can advertise VPNs and tech-related stuff
This repo is archived. You cannot comment on issues.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
:mag:🤖 Search Engines
I2P
The Invisible Internet Project (I2P)
 OS
Operating Systems
 Self-contained networks
Social media
Tor
Anything covering the Tor network
 WIP
active work in progress, do not merge or PR (yet)!
 XMPP
Extensible Messaging and Presence Protocol
 [m]
Matrix protocol
 approved
approved, waiting for a PR
 dependencies
Pull requests that update a dependency file
 duplicate
feedback wanted
high priority
iOS
low priority
stale
A label for stalebot if it gets added
 streaming
Anything related to media streaming.
 todo
wontfix
Issues or bugs that will not be fixed and/or do not have significant impact on the project.
 ₿ cryptocurrency
ℹ️ help wanted
↔️ file sharing
⚙️ web extensions
Browser Extension related issues
 ✨ enhancement
❌ software removal
🆕 software suggestion
🆘 critical
🇦🇶 translations
Anything covering a translated version of the site
 🌐 Social News Aggregators
🌐 hosting
🌐 website issue
*Technical* issues with the website.
 🏠 housekeeping
Anything primarily related to site cleanup.
 🐛 bug
👁️ browsers
👥 team chat
💢 conflicting
💬 discussion
💻 hardware
📁 file storage
📝 correction
Correction of content on the website
 📧 email
🔎 research required
🔐 password managers
🔒 VPN
Virtual Private Network
 🔒 file encryption
🖊️ digital notebooks
🗄️ DNS
Domain Name System
 🗨️ instant messaging (im)
🚫 Windows
🤖 Android
🦊 Firefox
Firefox & forks, about:config etc.
 🧰 productivity tools
No labels 📝 correction
Milestone
No items
No Milestone
Assignees
Clear assignees
jonah
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: privacyguides/privacytools.io#2414