I think it's great that Firefox is finally doing more to combat fingerprinting. For a long time, they lagged a bit behind Brave in this regard. That said, unfortunately, neither browser has been able to do anything about Cloudflare Turnstile yet. Kagi, for example, uses it to fingerprint users.
Can you please tell whoever it is at Mozilla to stop working on that.
This feedback isn't directed at any one person but that proposal impressively suffers from the simultaneous problems of Being Way Too Fucking Complicated and Proposing to Make the Web Better but Actually Making it Way Worse (for Everyone Except Entrenched Megacorps). It's the exact same problem that Google's "anonymous ad attribution" attestation swarms suffered, and luckily that never came to pass.
From looking at the pictures in that article, it seems like in order for me to be able to browse "protected" sites (aka, most of the corporate-owned web, once they are aware that this exists and turn it on because "bots bad") my browser is going to have to negotiate for some scant amount of "allowed access" tokens or other such thing, through some complicated protocol that halts any chance of us realizing a future for the web that looks any much different from "locked down approved browsers visiting approved sites in an approved way."
The further we allow the Web to stray from cURL http://example.com Just Working, the worse off we all are. So to reiterate, this proposal looks insane and not at all aligned with Mozilla's mission...
I'd like to have some of the APIs that read the data used to fingerprint browsers be behind a confirmation dialog per site similar to allowing popups or microphone/video access.
> Oh, I see that you'd like to read the canvas pixel data, let me check if that's okay with the user first.
I'm on desktop Firefox v160.0 and I've never seen a permission dialog like that and under settings I see:
Permissions
Manage what websites can access, control, or trigger.
Location
Camera
Device apps and services
Local network devices
Microphone
Speaker
Notifications
Autoplay
Virtual reality
None of those seem to be for accessing canvas data.
One caveat I’ve experienced with Firefox branches that focus on privacy is I get “punished” with captchas from hell because I refuse to let websites siphon and prey on every last bit of private info. Hopefully this doesn’t succumb to the same issue.
Why do you want to use services that use such captchas? It’s like going to a club and complaining about the door policy. Don’t go if you don’t like it.
I'm tired of identifying buses or stoplights or motorcycles up to five times a day just for Google searches. I'm slowly moving myself over to LLM queries instead.
Unless I'm misreading the post mentions that the most recent change was added to version 145 which released last year. Personally I haven't had any issues with cloudflare as a firefox user since then with strict mode enabled.
Surveillance fingerprinting will only end with major changes to the web.
If you are among those capable of 3rd order thinking or even just 2nd order thinking, and consider what kind of world you want to live in, you may already know that these changes must happen, even if that means the functional web is bifurcated for a while.
Maybe you can use your second-order thinking to consider how people might react to a sentence that starts “if you are among those capable of 3rd order thinking.”
I’ll spell it out for you: it comes across as condescending. Long-term, especially if you do this in real life too, that means people are less likely to listen to what you have to say, and makes you less effective at tasks that require other people’s cooperation.
Systemically, you might be thinking too much about rationalism, and feeling superior, and not enough about how your choices make other people feel. Feelings aren’t rational; in fact, studies of the brain show that feelings come first and the rational explanation comes later. The only way to elicit a rational response from people is to talk in a way that makes them feel interested in what you have to say, at that comes from how you say it as much as what you say.
I didn't "feel superior" when I posted that, but I do now.
This is a forum frequented by VCs, programmers, and other sophisticated people, man. IRL is a totally different thing.
If you're itching to longhouse your intellectual superiors, go to Facebook, a place even yet more distant than IRL in its own twisted ways but that's what that place is for.
-1 it's perhaps offensive but I agree with OP: 3rd order is *very* difficult to reason about, and even really smart, really experienced people have colossal failures at that level of reasoning-depth. It's not just probabilistic (e.g. chess, go), but in addition the way a decision-tree-branch is followed often deeply affects downstream decisions...
Are you talking about a return to a web of one-to-one connections, no broadcasts?
Actually the problem isn't broadcasts but reverse broadcasts. A broadcast sends one signal to all interested listeners - the problematic mode of the web is one listener getting all interested signals, which allows spam and propaganda (which are the same thing) to flood that set. Is there a word for this reverse broadcasting idea?
I think it's great that Firefox is finally doing more to combat fingerprinting. For a long time, they lagged a bit behind Brave in this regard. That said, unfortunately, neither browser has been able to do anything about Cloudflare Turnstile yet. Kagi, for example, uses it to fingerprint users.
I believe the relevant work to mitigate that is https://hacks.mozilla.org/2026/06/pact-anonymous-credentials...
(I do work at Mozilla but not on any of this.)
There's a third option: allow bots and give them access as efficiently as possible.
As Reddit's API used to.
Don't want to? Tough, they'll do it the hard way and put more load on your servers and your countermeasures will drive away more humans than bots.
Of course our current bot plague doesn't understand this and seems to be optimizing for maximum server load, which is still bad.
Or just block all bots and give them a big F U :)
Can you please tell whoever it is at Mozilla to stop working on that.
This feedback isn't directed at any one person but that proposal impressively suffers from the simultaneous problems of Being Way Too Fucking Complicated and Proposing to Make the Web Better but Actually Making it Way Worse (for Everyone Except Entrenched Megacorps). It's the exact same problem that Google's "anonymous ad attribution" attestation swarms suffered, and luckily that never came to pass.
From looking at the pictures in that article, it seems like in order for me to be able to browse "protected" sites (aka, most of the corporate-owned web, once they are aware that this exists and turn it on because "bots bad") my browser is going to have to negotiate for some scant amount of "allowed access" tokens or other such thing, through some complicated protocol that halts any chance of us realizing a future for the web that looks any much different from "locked down approved browsers visiting approved sites in an approved way."
The further we allow the Web to stray from cURL http://example.com Just Working, the worse off we all are. So to reiterate, this proposal looks insane and not at all aligned with Mozilla's mission...
Too bad they still generate a random unique ID for each installed extension that can expose a trackable UUID...
https://bugzilla.mozilla.org/show_bug.cgi?id=1717671
I'd like to have some of the APIs that read the data used to fingerprint browsers be behind a confirmation dialog per site similar to allowing popups or microphone/video access.
> Oh, I see that you'd like to read the canvas pixel data, let me check if that's okay with the user first.
HTML5 canvas data access has been behind such a permission dialog on Firefox (at least on desktop) for a long time now.
I'm on desktop Firefox v160.0 and I've never seen a permission dialog like that and under settings I see:
None of those seem to be for accessing canvas data.
One caveat I’ve experienced with Firefox branches that focus on privacy is I get “punished” with captchas from hell because I refuse to let websites siphon and prey on every last bit of private info. Hopefully this doesn’t succumb to the same issue.
Why do you want to use services that use such captchas? It’s like going to a club and complaining about the door policy. Don’t go if you don’t like it.
Thanks for reminding me that Elon Musk got rejected from Berghain.
I'm tired of identifying buses or stoplights or motorcycles up to five times a day just for Google searches. I'm slowly moving myself over to LLM queries instead.
Am I the only expecting it to completely break the sites behind cloudflare on Firefox?
Was also thinking this, would like an answer.
Unless I'm misreading the post mentions that the most recent change was added to version 145 which released last year. Personally I haven't had any issues with cloudflare as a firefox user since then with strict mode enabled.
It links to this post when talking about it: https://blog.mozilla.org/en/firefox/fingerprinting-protectio...
Surveillance fingerprinting will only end with major changes to the web.
If you are among those capable of 3rd order thinking or even just 2nd order thinking, and consider what kind of world you want to live in, you may already know that these changes must happen, even if that means the functional web is bifurcated for a while.
Maybe you can use your second-order thinking to consider how people might react to a sentence that starts “if you are among those capable of 3rd order thinking.”
Sorry to hear about your 3rd order thinking (or lack thereof, more specifically).
I’ll spell it out for you: it comes across as condescending. Long-term, especially if you do this in real life too, that means people are less likely to listen to what you have to say, and makes you less effective at tasks that require other people’s cooperation.
Systemically, you might be thinking too much about rationalism, and feeling superior, and not enough about how your choices make other people feel. Feelings aren’t rational; in fact, studies of the brain show that feelings come first and the rational explanation comes later. The only way to elicit a rational response from people is to talk in a way that makes them feel interested in what you have to say, at that comes from how you say it as much as what you say.
I didn't "feel superior" when I posted that, but I do now.
This is a forum frequented by VCs, programmers, and other sophisticated people, man. IRL is a totally different thing.
If you're itching to longhouse your intellectual superiors, go to Facebook, a place even yet more distant than IRL in its own twisted ways but that's what that place is for.
-1 it's perhaps offensive but I agree with OP: 3rd order is *very* difficult to reason about, and even really smart, really experienced people have colossal failures at that level of reasoning-depth. It's not just probabilistic (e.g. chess, go), but in addition the way a decision-tree-branch is followed often deeply affects downstream decisions...
Are you talking about a return to a web of one-to-one connections, no broadcasts?
Actually the problem isn't broadcasts but reverse broadcasts. A broadcast sends one signal to all interested listeners - the problematic mode of the web is one listener getting all interested signals, which allows spam and propaganda (which are the same thing) to flood that set. Is there a word for this reverse broadcasting idea?