Hi,
mercedes508 wrote (22 Jan 2015 17:54:53 GMT) :
> And I'm wondering how important the fingerrint issue is, considering
> how easy it is to change it (e.g. by enlarging the browser window),
I'm more concerned about behavioral differences (compared to the Tor
Browser) that we ship by default (XXX: we haven't summed up what they
were recently, by the way), than about bits of fingerprinting
information that every Tor Browser user, be it upstream or within
Tails, can individually choose to leak.
I'm tempted to propose that on this topic, just like for resizing the
browser:
* we provide safer defaults;
* we let users manually opt-in if they want to block ads and diverge
from the Tor Browser anonymity set.
(Of course the current behaviour for resizing the window is not a good
implementation of opting-in to diverge, as the security consequences
of this action are completely non-obvious to the user. There are
tickets in the right place about asking for a confirmation in this
case, I think.)
[And I'm starting to wonder if this wouldn't be better to put that
in the upcoming Tor Browser's "security slider". At first glance:
"block ads, not JS" < "block neither ads nor JS" < "block JS, not ads"
(default)
but once you block JS, your fingerprint is so much different anyway
that blocking ads on top don't make a big difference, so possibly this
would be better, although awkward and then perhaps confusing for
users:
"block ads, not JS" < "block neither ads nor JS" < "block JS and ads"
Food for thought.]
> and considering the lack of information on the user-side.
I don't undertand what you mean here. May you please clarify?
Cheers,
--
intrigeri
