this post was submitted on 15 Apr 2025
19 points (100.0% liked)
Privacy
1986 readers
486 users here now
Welcome! This is a community for all those who are interested in protecting their privacy.
Rules
PS: Don't be a smartass and try to game the system, we'll know if you're breaking the rules when we see it!
- Be civil and no prejudice
- Don't promote big-tech software
- No reposting of news that was already posted
- No crypto, blockchain, NFTs
- No Xitter links (if absolutely necessary, use xcancel)
Related communities:
Some of these are only vaguely related, but great communities.
- !opensource@programming.dev
- !selfhosting@slrpnk.net / !selfhosted@lemmy.world
- !piracy@lemmy.dbzer0.com
- !drm@lemmy.dbzer0.com
founded 5 months ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Which, if I'm understanding correctly, would be exactly the same as if the viewer had set their browser theme to dark, so it's not like the extension is more a loss of privacy than enabling the setting in the browser?
In the end, what we really need is a browsing mode that allows(maybe?) javascript, but doesn't allow it to read properties of the renderer (viewport size, resolution, colors, fonts, etc). Since having that info stopped being necessary for customizing pages back in, like, CSS 2.1.
Yes.
Yeah, we essentially need to split the renderer from the rest of the browser in a significant manner. But HTML, css, js is a fucking mess so its pretty unreasonable to restrict it much further u can't restrict viewport sizing or resolution cos that will fundamentally break almost every framework. Also I'm sure their would be like 1000 exploits to get that data indirectly by comparing the sizes of CSS relative and absolute components.
Swapping out colours/fonts at the rendering layer is essentially what I was thinking but I go a step further by completely separating the rendering/interaction from the actual web sandbox running any code. U could even do something where u only input keyboard/mouse data to the proxy in a way that obfuscates behavioural analysis. If u also do a vm u can introduce noise into webgl making canvas fingerprinting impossible.
Do you have a proof-of-concept? What does this run on?
I haven't written any code yet. Just a concept I was playing with. I mean if u wanted a proof of concept then u could probably do it in js with a browser extension and some python code in a docker image.
U use playwrite to send the Dom over a web socket (keeping the content in sync with decent performance might not be the easiest task) and the extension just passes keyboard and mouse back. Then u just put the virtual browser in docker container.
I wrote and run the bot for !news_summary@hilariouschaos.com and if u go have a look at its source u can see that its pretty easy to have a virtual browser controlled with playwrite.
This would be quite a bit of a shit experience and would probably break extension like ublock that rely on filtering what pages u can access but it would work as a proof of concept.