• 1 Post
  • 348 Comments
Joined 11 months ago
cake
Cake day: August 4th, 2023

help-circle
  • TootSweet@lemmy.worldtoPrivacy@lemmy.mlNo script help.
    link
    fedilink
    English
    arrow-up
    8
    ·
    edit-2
    24 hours ago

    A lot of user fingerprinting techniques rely on JS. Plus, by shutting off JS, you reduce the attack surface of your browser. If, let’s say, there was a zero-day vulnerability in Firefox that required JS to exploit, you’d be shutting off that whole means of attack if you blocked all/most JS out there on the internet. Mining cryptocurrencies on your computer via your browser can only be accomplished with the help of Javascript. A lot of forever cookie techniques require Javascript.

    uBlock origin is for kindof a different use case. It’s for if you’re on one website that you don’t necessarily suspect of evil dealings that might include buttons (like social media sharing buttons, for instance) or other scripts (like ad displaying scripts or analytics scripts) from third parties that might include evil tracking stuff. If I started a blog on https://theawesomeestblog.com/ and included script from Facebook that puts a share button on my page, and if you then visited my blog, Facebook would know because your browser would make requests from your IP with cookies they’d placed on your brower previously and JS included with the button could very well be used to do additional fingerprinting.

    NoScript is for (among other things) when you don’t even necessarily trust the website you’re purposefully visiting. Like, I don’t know if cnn.com mines Bitcoin via JS on users’ browsers (and, honestly, it seems a little unlikely to me, I think), but if I disallow JS on cnn.com, then when I click a link in Lemmy to a cnn.com article (and maybe I don’t even really know I’m going to cnn.com when I click the link – it might use a link shortener or something – or maybe it’s not cnn.com, but some reasonably-trustworthy-sounding news-y-sounding domain that I haven’t heard of before), I know it’s not mining Bitcoin on my machine.

    Oh, and as others have said, NoScript is Open Source. Says so right near the top of the home page.




  • I honestly fully believe that proprietary software is bullshit and all software ought to be Free Software. I’m not saying I don’t use proprietary software, but I don’t trust it. If I run proprietary software, I go out of my way to try to run it in prison. I don’t let my Nintendo Switch connect to the internet except when I have a very specific reason and then I disconnect it immediately after I’m done. When I bought a robot vacuum cleaner, I bought specifically the model that I knew I could hack to not phone home. I bought a phone on which I could run LineageOS without the Google apps. (And, yes, I’m running a proprietary EFI BIOS on my main desktop machine and such. But I do take a lot of steps to limit how much influence proprietary software has on me and my devices.)


  • I think having a way to delete accounts is legally required by some jurisdictions. And sometimes if a site does business in such a jurisdiction and are required to have a way to do that, they’ll still offer that option those outside the jurisdictions in question. (It’s easier to just allow everyone who asks than to have rules keeping track of who can and can’t legally demand it.)

    But if this is an image board hosted in Japan intended for a Japanese audience, and if Japan has no such legal requirements (or if such requirements don’t apply here for some reason), then, your experience with websites that operate in/for countries where they speak your language(s) notwithstanding, it’s highly plausible this site just doesn’t have any way to delete accounts.


  • Your concern is that a breach of the site’s data may leak some information about you that you wouldn’t want to leak, yes?

    If so, and if you can still use similar methods to navigate the site in question, use those methods to edit your account/profile details to scrub the account of anything that you wouldn’t want to leak. Change it to use a fake name. Change the email address to somthrowaway email address. Change the password to something unrelated to any passwords you could possibly use on any other sites so that if the hash is leaked and brute forced, no one can use that to gain access to any of your other accounts. Delete individual posts or pieces of content that you’ve uploaded.

    Actually, I can read (barely) enough Japanese to figure out that the registration process seems to only want your email address and password. (Though I haven’t gone through the whole signup process.) You mentioned uploading a file, yeah? I’m guessing the amount of stuff you’d have to do to overwrite/delete every bit of data they have on you is pretty limited.

    And, yes, I suppose there’s the potential caveat that that might not affect backups and such, but I’d wager a lot of the other account deletion requests you’ve done don’t affect things like backups either.