GNOME Bugzilla – Bug 739631
Improve tracking protection
Last modified: 2017-01-24 14:39:52 UTC
We should add EasyPrivacy [1] tracking protection to Epiphany. It should be implemented by adding it as an additional filter to our existing list of adblock filters if and only if the setting "Tell web sites I do not want to be tracked" is active. That setting should be renamed to something like "Attempt to prevent tracking by advertisers" and it should only be selectable when adblocking is enabled (which means moving the adblock setting to the privacy page, unfortunately) as the list would otherwise not be effective. (Alternatively we could add this as a new setting, but I don't think there's any value in having a setting that controls only the useless do not track header.) Another dependent setting, "Also block social media tracking buttons" should add a third subscription to Fanboy's Social Blocking List to stop tracking by Facebook and Google as well, but we need to think more about how to name that to make it clear that the like and +1 buttons are themselves trackers... and also consider completely merging it to the tracking prevention setting, as having three levels of dependent settings seems like too much. [1] https://easylist.adblockplus.org/en/
(In reply to comment #0) > We should add EasyPrivacy [1] tracking protection to Epiphany. It should be > implemented by adding it as an additional filter to our existing list of > adblock filters if and only if the setting "Tell web sites I do not want to be > tracked" is active. That setting should be renamed to something like "Attempt > to prevent tracking by advertisers" and it should only be selectable when > adblocking is enabled (which means moving the adblock setting to the privacy > page, unfortunately) as the list would otherwise not be effective. > (Alternatively we could add this as a new setting, but I don't think there's > any value in having a setting that controls only the useless do not track > header.) How does it compare to the pruning we do on tracking URLs?
They're orthogonal. Some trackers will be foiled by URL pruning, but many (most?) won't be. Try the Ghostery Firefox extension, it will show you which trackers it is blocking and you can see which URLs have tracking parameters -- I guess it's usually roughly half.
Hi, note that Firefox now includes Disconnect tracking sites list as port of their Polaris project, although it's not active bu default Maybe Web could use the same list for tracking protection ? Thanks See : - http://tuxdiary.com/2015/04/10/firefox-tracking-protection/ - https://blog.mozilla.org/privacy/2014/11/10/introducing-polaris-privacy-initiative-to-accelerate-user-focused-privacy-online/
That looks like the same thing, just a different list. The EasyPrivacy list is an Adblock Plus list, so adding support should be super easy. I'm not sure about the relative quality of the lists, though.
Note that adblock include tracking protection but the opposite is not true. We could imagine 2 different functionalities, depending whether the user wants (non tracking) ads or not Tracking protection could be ON by default
That's not true: you can't have effective tracking protection unless you also block ads. The ad companies are tracking you. Our ad blocking sometimes does not work reliably (we need to track down why), but it's been at least two years since I've noticed it breaking any pages, so I think it's safe to enable by default.
*** Bug 750759 has been marked as a duplicate of this bug. ***
*** Bug 755188 has been marked as a duplicate of this bug. ***
I suggest to use the Privacy Badger (https://www.eff.org/privacybadger) model for tracking protection and build on their work. They have a model that learns and auto detect trackers. I like to block trackers, but not ads (unless they are tracking me). I have no problems with seeing ads, but I don't like to be tracked. Ok, I hate intrusive ads, but it seems that they all try to track the user also... so privacy badger works like a bad ad blocker also.... :)
FYI: I looked at Privacy Badger, but it broke the first sites I tried it on. We're gonna have to use a human-curated list (e.g. Disconnect or EasyPrivacy) rather than a heuristic-based approach, because we want this to be enabled by default, so we have to minimize the number of sites we break.
Well, the broken pages are fewer and fewer. I think they added a human-curate whitelist, so it is now a hybrid of heuristic and a whitelist if I understand it correctly. However, I guess some sites may always be broken if they require tracking to work, and that is the correct way I guess since the alternative is to allow tracking. To fix that it would be possible to have some option to open the broken site in a private sandbox tab without the privacy badger, where there are no facebook/google aso cookies.
(In reply to Mattias Eriksson from comment #11) > Well, the broken pages are fewer and fewer. We could certainly evaluate it again.... Still, realistically, something on the scope of PrivacyBadger would take months to implement, whereas something like EasyPrivacy would be an afternoon hack to get working as we already support Adblock Plus filters; probably we should start simple, so we can get *some* real tracking protection in place.
I think one thing I like about the Privacy Badger implementation would be how it handles social media share icons. The icons have tracking built in and one thing PB does is keep the icon there (with a little PB icon watermarking it) but blocks the tracking, that way if you choose, you can click it. I'm not entirely sure if EasyPrivacy blocks these tracking features? I know Fanboy's Enhanced Tracking List blocks this behavior, but it also removes the icon which could be an inconvenience for some users.
Implemented using EasyPrivacy. For now it's enabled by default; let's see if websites break.
How are things like social media sharing icons handled with this implementation?
They're not. For that we need to subscribe to Fanboy's social blocking list, but I hesitate to hide that under "try to block web trackers" since most users expect social features to actually work. But maybe that's the right thing to do; maybe trying to block web trackers is useless if you're not willing to block social media buttons too. Feel free to file another bug and we can figure it out there.
(In reply to Michael Catanzaro from comment #16) > Feel free to file another bug and we can figure it out there. (Options for this cycle would be adding yet another preference, or more likely just having the existing preference control social blocking too and adding a warning to the preferences dialog. Next cycle we want to add a real adblock configuration dialog, which will simplify this.)