Help EFF test Privacy Badger, our new browser extension for privacy

Re:Help EFF test Privacy Badger, our new browser extension f... by gorhill on Friday May 02, 2014 @10:34AM (#7685899)

As part of my project, I like to benchmark regularly privacy enhancing extensions ("blockers") for Chromium-based browsers. So I took the opportunity to run one of my key benchmark this morning. [1]

The results are meant for a github page, but I decided to present them here, and I reformatted specifically to be HN friendly (hopefully).

In short, any of the following blockers help a lot against no blocker at all. Some are less likely to break web pages, while some other are more likely, and every users have their own requirements when it comes to striking balance between privacy and convenience. This is for information purpose only, not to make a statement that one is better than the other. With the proper information, people can make an informed choice according to their own prerogatives.

I ordered the list by the amount of distinct domains which are "touched". I figure the more distinct domains are touched, the more metadata is leaked to different parties. The format of the results is n / N, where n is the number of distinct 3rd-party domains, and N is the total number of distinct domains.

"3rd-party" is from a DB-less machine point of view, i.e. if a domain name differs from the one of the URL of the page, it is deemed 3rd-party. Despite this caveat, I think this still allows to compare blockers between themselves for the same benchmark ran inside the same narrow time frame.

Benefit to the users: It's nice to see privacy becoming more and more a top issue and more and more choice to address this particular problem.

So here:

No blocker

  Domains:            420 / 421
  Hosts:              641 / 720
  Scripts:            518 / 641
  Outbound cookies:   263 / 341
  Net requests:     2,079 / 2,849

Privacy Badger 2014.5.1 (BETA)

  Domains:            192 / 193
  Hosts:              299 / 381
  Scripts:            334 / 455
  Outbound cookies:    52 / 115
  Net requests:     1,340 / 2,176

Disconnect 5.17

  Domains:             93 / 94
  Hosts:              171 / 248
  Scripts:            262 / 385
  Outbound cookies:    19 / 83
  Net requests:     1,124 / 1,936

HTTPSB 0.9 Allow-All/Block-Exceptionally

  Domains:             54 / 55
  Hosts:              101 / 153
  Scripts:            169 / 265
  Outbound cookies:     2 / 43
  Net requests:       930 / 1,648

Adblock Plus 1.7.4

  Domains:             54 / 55
  Hosts:               97 / 149
  Scripts:            177 / 272
  Outbound cookies:     1 / 33
  Net requests:       913 / 1,612

Ghostery 5.2.1

  Domains:             52 / 53
  Hosts:               99 / 160
  Scripts:            173 / 286
  Outbound cookies:     8 / 47
  Net requests:       966 / 1,722

HTTPSB 0.9 Block-All/Allow-Exceptionally

  Domains:             21 / 22
  Hosts:               49 / 75
  Scripts:              0 / 0
  Outbound cookies:     0 / 0
  Net requests:       680 / 1,199

[1] https://github.com/gorhill/httpswitchboard/wiki/Comparative-...

[ Parent | on HN ]

Re:Help EFF test Privacy Badger, our new browser extension f... by unhush on Friday May 02, 2014 @01:54PM (#7687103)

Note that Privacy Badger uses a browser history-dependent algorithm for blocking - when you first install it, it doesn't block anything because it assumes that third-party trackers are innocent until proven guilty. When it sees you being tracked on 3+ first-party domains by a third party, it either blocks or cookieblocks the third party. I wrote up a basic description of the algorithm here: https://github.com/EFForg/privacybadgerfirefox/blob/master/R...

So if you're testing Privacy Badger on a profile with no browsing history, it is bound to do worse than other extensions. You have to "prime" it with some browsing data before it's really effective.

[ Parent | on HN ]

Re:Help EFF test Privacy Badger, our new browser extension f... by gorhill on Friday May 02, 2014 @03:03PM (#7687487)

I see, so this means results for Privacy Badger reflect a worst-case scenario. I've added links to the proper section in the Privacy Badger's README file.

[ Parent | on HN ]

Re:Help EFF test Privacy Badger, our new browser extension f... by nabla9 on Friday May 02, 2014 @07:24PM (#7688752)

So people who use incognito mode don't benefit much?

[ Parent | on HN ]

Re:Help EFF test Privacy Badger, our new browser extension f... by unhush on Monday May 05, 2014 @03:34PM (#7700641)

Unfortunately not, if you use Incognito by default (other than being able to see who's tracking you and toggle the settings manually). We could add a feature to optionally save data in Privacy Badger between incognito sessions (or use data from the non-incognito sessions to determine which sites to block in incognito sessions).

In Firefox, PBadger Alpha doesn't have permission to operate in Incognito mode yet, so it will just be off.

[ Parent | on HN ]

Re:Help EFF test Privacy Badger, our new browser extension f... by unhush on Monday May 05, 2014 @03:43PM (#7700697)

Tracking bug for this (in Firefox): https://github.com/EFForg/privacybadgerfirefox/issues/11

[ Parent | on HN ]

Re:Help EFF test Privacy Badger, our new browser extension f... by mgreg on Friday May 02, 2014 @01:13PM (#7686904)

I've always looked for some harder data on how to tell the difference (effectively) from these different tools. Really appreciate the data you're providing here.

My challenge is that I looked at this data and the web page on Github and I may not be the sharpest tool in the shed but I'm not certain how to interpret the data and understand the real world implications. On the GitHub page it states that "The most important figure in my opinion with regard to privacy is the 3rd-party Domain count" which is a good hint but if I look at Disconnect 5.17 for example I see 93/94 which is "3rd-party count / total count". What, exactly does that mean? Does that mean for the 15 web sites visited that 93 http requests were from 3rd parties and only 1 from a first party? And that with the specified tool it is blocking those 93 requests?

Thanks for any additional explanation.

[ Parent | on HN ]

Re:Help EFF test Privacy Badger, our new browser extension f... by gorhill on Friday May 02, 2014 @03:08PM (#7687512)

It's the number of distinct "3rd-party" domain names reached on average for the 15 visited web pages. So in the case of Disconnect, for the 15 URL visited, on average 93 "3rd-party" domains were touched. The web page domain in the URL address bar is deemed 1st-party. "Domain" is extracted as per Mozilla's Public Suffix List.

[ Parent | on HN ]

Re:Help EFF test Privacy Badger, our new browser extension f... by hackuser on Friday May 02, 2014 @02:14PM (#7687210)

Great, thank you so much. Did you consider including Request Policy? It's not apples-to-apples and might be tricky to test (it breaks more sites without per-website configuration).

[ Parent | on HN ]

Re:Help EFF test Privacy Badger, our new browser extension f... by gorhill on Friday May 09, 2014 @10:12AM (#7720926)

RequestPolicy is not available for Chromium. In any case, HTTP Switchboard can be configured to mimic how RequestPolicy function[1], but really these benchmarks are time-consuming and I have to limit the amount of extensions I benchmark.

[1] https://github.com/gorhill/httpswitchboard/wiki/HTTP-Switchb...

[ Parent | on HN ]