disconnectme / disconnect-tracking-protection Goto Github PK

Hello,

Inspired by this discussion: https://news.ycombinator.com/item?id=18890356 - looks like FireFox blocks ajax requests to fetch reddit posts (demo https://jsbin.com/fuyijan/2/edit?js,console)

Is there a way to enable https://www.reddit.com/r/ and keep everything else as is?

(Originally posted in Mozilla issue tracker)

1. Summary

It would be nice, if AddToAny service will be removed from Firefox blacklist. At the time social buttons of service block in Firefox (beginning at Firefox 63) by default.

If I need to make another actions, that AddToAny buttons works for Firefox users with Always value of Trackers key, please, tell me.

2. Example

• Simple AddToAnyButtons on Codepen

<!-- AddToAny BEGIN -->
<div class="a2a_kit a2a_kit_size_32 a2a_floating_style a2a_vertical_style" style="left:0px; top:150px;">
<a class="a2a_dd" href="https://www.addtoany.com/share"></a>
<a class="a2a_button_mastodon"></a>
<a class="a2a_button_diaspora"></a>
</div>
<script async src="https://static.addtoany.com/menu/page.js"></script>
<!-- AddToAny END -->

3. Expected behavior

If Only in private windows value of Trackers key:

Buttons are shown:

4. Non-expected behavior

Else Always value of Trackers key:

No buttons:

5. Argumentation

5.1. Do Not Track

Privacy Policy from official site:

Do Not Track (DNT):

    + When a supported browser's DNT header is enabled, we prevent tracking across sites where AddToAny is used.
    + For example, we disable Like & Tweet buttons to prevent Facebook & Twitter tracking when DNT is enabled.
    + See our full Do Not Track Compliance Policy.

Full Do Not Track Compliance Policy in AddToAny site.

5.2. EFF

As user, I use Privacy Badger of Electronic Frontier Foundation (EFF) for tracking preventing → Privacy Badger allow AddToAny:

Firefox support EFF blacklists.

5.3. Disabling tracking

See on my Codepen pen:

a2a_config = a2a_config or {}
a2a_config.no_3p = true
a2a_config.track_links = false

This code prevents any tracking:

• AddToAny JavaScript API
• AddToAny: removing the “spy” from the share-ware

Thanks.

This happens on the iOS Safari content blocker. Example: https://www.google.com/amp/abcnews.go.com/amp/Technology/wireStory/apple-slowing-iphones-cuts-battery-price-50-52034050

https://webbkoll.dataskydd.net/sv/ uses your database to classify third party requests.
So far the following seem to be missing:

• a.komoona.com
• a248.e.akamai.net
• ad.71i.de
• ad.ad-srv.net
• ad.sxp.smartclip.net
• ad29.ad-srv.net
• ads.stickyadstv.com
• ads.yahoo.com
• adserver.71i.de
• advertiser.wbtrk.net
• aka.spotxcdn.com
• apex.go.sonobi.com
• api-img.billiger.de
• assets-cdn.com
• banners.webmasterplan.com
• bree.com
• c.t4ft.de
• cdn.emetriq.de
• cdn.iqcontentplatform.de
• cdn.komoona.com
• cdn.m-pathy.com
• cdn.onthe.io
• cdn.tradelab.fr
• cdn1.lockerdome.com
• cdn2.lockerdome.com
• cdnjs.cloudflare.com
• cloudfront-labs.amazonaws.com
• cm.adgrx.com
• code.jquery.com
• common.i12.de
• cs.adingo.jp
• cs.gssprt.jp
• cs.komoona.com
• cse.google.com
• d.alcvid.com
• data08.adlooxtracking.com
• data43.adlooxtracking.com
• delivery.swid.switchads.com
• dmp.theadex.com
• dyn.emetriq.de
• event.movad.de
• glaring-torch-8314.firebaseapp.com
• gzhls.at
• hb.vntsm.com
• html-links.com
• images-na.ssl-images-amazon.com
• images.apester.com
• impressions.revenue-tracker.com
• its.tradelab.fr
• j.adlooxtracking.com
• js.himediads.com
• load.s3.amazonaws.com
• lockerdome.com
• match.basebanner.com
• native.sharethrough.com
• p.cpx.to
• p.lp4.io
• partner.vxcp.de
• pde.lp4.io
• pix.impdesk.com
• pixeltrack.eyeviewads.com
• pr-bh.ybp.yahoo.com
• responder.wt-safetag.com
• revenue.com
• s.cpx.to
• s.kau.li
• s.komoona.com
• s.ytimg.com
• s3-eu-central-1.amazonaws.com
• s79.mxcdn.net
• s79.research.de.com
• sc.iasds01.com
• scontent.lrcdn.net
• ssl.p.jwpcdn.com
• stat.komoona.com
• sv.monkeybroker.net
• sync.1rx.io
• sync.go.sonobi.com
• sync.intentiq.com
• sync.rhythmxchange.com
• t.alcvid.com
• t.zqtk.net
• t4ft.de
• track.eyeviewads.com
• tt.onthe.io
• uip.semasio.net
• uobsoe.com
• wss.lockerdome.com
• www.google.com
• www.googletagmanager.com
• x.bidswitch.net

https://account.samsung.com/accounts/v1/fed8b9b9a1c97b2b1860c9ee6964c852/signInGate?locale=en_US&svcParam=eyJzdmNFbmNLWSI6IllpckliV1pyeTVMRFVuL3gwWFZML21mUlpDRjlUSnQ5UnlodWdlQ05OSFI3aE4rd3ZaTHFrZnNUZUdmNnpIcXNKTk5WQWhWYnd4SmR5Tk9kMGh3ZDluU1lLMk1LcXYzcTQyczRWMUN4UXZmVTYxMjI5WVF0ZGpVdVI1T2xLV1VwL2pVakRqYzBubHFhZlRUSDMydGFtYzhRaGRtWDJJck00MWw0WmlhamU1az0iLCJzdmNFbmNQYXJhbSI6IjVmaVZQdENVUWthMEw5bFZKb0l0MHFscHB3VlZ4UjdBN0RhcHIwZ1A1V0N5OVlWK3lnMy8wbEpzdk1TUk13TGpqa2xZaFpZeXd3SHRUaE5wWk13RDNSZHptS2pQTEZXbS9NN2E5RmloaTBLQWUvRTMrZHJaeldab2hrL282TWZmMFRuT3B6aU0vQkYrQnVhRGFsT0IvaXNBMzRFYXVlNVFHRFBvelZhOGczOUFlYThzZnZic05FcUVqY2VkaDdQb1Q4Y0h3WW83VFpOLzJvemVZWGE3YlZuZWUvMzJBMWU4K0VUeXZLMjZDQUMxNlpTSEVHYkd6TVlWRnQ4cndlcXZQSkd5VzdkeTd0bHFtUHJpek9zTyt0S21RSGREbEs4MGFuUWg5UGF1WTNqOGcrVjhYMDM0S0pyeW5waXpSVVVGanM3aERaMldmb1Z3dzFGejFvMlhlK3JwQU5SVXlMblRFTUljMUNPS2g0M2NPU0NVYkF0RlNtRVhKMUdkcS9mMiIsImNoa0RvTnVtIjoiMTQ4MjgzNzYxNzU5OSIsInN2Y0VuY0lWIjoiMmZlZjA0NzQ5OGU2MDkwNjQxZjQ5ZDUwYjEyNzRjNzUifQ%3D%3D

Please block app.yieldify.com, used by Yieldify.

I see the Google tracking NID cookie being sent to https://adservice.google.ca/adsid/integrator.js?domain=tpc.googlesyndication.com, see:

The response headers for this URL includes the following which I found interesting:

Alt-Svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"

I think there's a tracker slipping through from www.youtube-nocookie.com. Example: https://www.youtube.com/watch?v=V6mQYfrbuDQ.

See https://bugzilla.mozilla.org/show_bug.cgi?id=1432650 ...

yandex.ru appears in the "Advertising" section, which means all of its subdomains (like api-maps.yandex.ru) are blocked. But api-maps.yandex.ru is categorized as "Content".

Can we adjust the yandex entries in "Advertising" to use the fully-qualified domain names of the advertising Yandex domains, so that other non-advertising Yandex domains will be allowed?

twimg.com was moved to Content in 85b100f but back to Disconnect in 96254fa. This breaks profile images when embedding Twitter feeds. Could it be moved back to Content?

Dada

I'm seeing trackers from youtubei.youtube.com. For example, you might see it here: https://www.youtube.com/watch?v=V6mQYfrbuDQ
I think that domain needs to be added to the json.

do-not-tracker.org
eviltracker.net
trackersimulator.org

These try to load code to actually test fingerprinting. By simply blocking the domains your just saying "Yay, we block those 3 harmless test domains" but the actual tracking techniques that they present would then remain undetected on every other domain on the web.

nbcnews.com is currently listed under Microsoft: https://github.com/disconnectme/disconnect-tracking-protection/blob/master/services.json#L7156

From https://en.wikipedia.org/wiki/NBCNews.com:

"On July 14, 2012, NBC officially announced that Microsoft had sold back its half share of msnbc.com for $300 million"

I'm happy to create a PR for this if you approve of removing it from the list of Microsoft properties.

Please block dwin1.com.

AKA Digital Window. Used by affiliate marketing company Awin.

bucksense.com tracks users and serves ads

Hello! Does Disconnect exclude sites that support https://www.eff.org/dnt-policy? This PR suggests that this may be the case: #4

Context: I am a former author of Privacy Badger Firefox and now a maintainer of Brave browser, which uses this list for tracking protection. If you are whitelisting sites that post EFF's DNT policy, Brave should be enabling DNT on those sites (we do not by default). I would suggest that this be documented somewhere for downstream users of this repo.

There is a form on this domain that becomes non-interactive when this domain is blocked.
Found on Firefox iOS and Focus iOS:
https://bugzilla.mozilla.org/show_bug.cgi?id=1499201

iOS-specific usage of this list is an ancillary use case of course, so I am filing mostly for future reference; I don't imagine there is a way to change this entry in the list without affecting non-iOS platforms.

http://sport.tvp.pl/mundial2018/37292850/mundial-2018-egipt-urugwaj-transmisja-mecz-live

MajkiIT/polish-ads-filter#8058 (comment)

FYI, akamaihd.net listed as a Facebook domain, and even though lots of Facebook traffic resolves there, it is an Akamai domain that is used by other clients as well.

Example: https://www.google.com/amp/fansided.com/2016/06/30/who-has-won-the-most-tour-de-france-titles/amp/

See also:
http://fansided.com/2016/06/30/who-has-won-the-most-tour-de-france-titles/

http://intent://play.app.goo.gl/?link=https://play.google.com/store/apps/details?id%3Dcom.azure.authenticator%26ddl%3D1%26pcampaignid%3Dweb_ddl_1#Intent;package=com.google.android.gms;scheme=https;S.browser_fallback_url=https://play.google.com/store/apps/details%3Fid%3Dcom.azure.authenticator&ddl%3D1&pcampaignid%3Dweb_ddl_1;end;

In your Blocking List, you also block Google Tag Manager.
Since Google Tag Manager is not collecting any data, you should remove it from your list.

If someone opts out of tracking, you disable Google Analytics or other Trackers already. But Google Tag Manager can also be used for essential features without any tracking of users.

All Shareaholic CDN assets (images, fonts, CSS, JS) are loaded from apps.shareaholic.com which causes site functionality and site admin interfaces which are part of WordPress and Drupal Admin areas to break.

For example - WordPress:
http://jay.meattle.com/wp-admin/admin.php?page=shareaholic-settings

Blocking all resources loaded from shareaholic.com feels extreme as it breaks functionality across 200,000+ WordPress and Drupal site admin screens.

Possible solution:
Re-classifying shareaholic.com as Content seems more appropriate and it would at least stop breaking Admin interfaces in some cases. If someone has the "strict" list turned on in Firefox, then they at least have been given the heads up that site functionality can break.

Turn (now part of Amobee) is an ad tech company which has has used very user-hostile tracking techniques in the past. They're currently classified as "Content", and thus won't be blocked in Firefox Tracking Protection.

Belongs to Symphony Technological Group via Connexity, not Experian.

styria-digital.com serves ads and tracks users, please block it

All videos on CNET are being misidentified as trackers and will not play.

Privacy Pro on iPhone bypasses the VPN when connecting to disconnect.me.

365dm.com is a domain used for serving images across Sky content sites. It is in no way affiliated to 365media.com as you can see from the WHOIS data below:
https://www.whois.com/whois/365dm.com
https://www.whois.com/whois/365media.com

A pull request has been opened to remove 365dm from the list:
#40

Please consider whitelistsing requests to Google domains that contain the &npa=1 URL parameter.

These requests are for non-personalized/non-tracking ads (usually contextual page-relevant ads) that don’t serve ads based on the user’s past browsing behavior, and don’t store information about the page/ad that requested the ad.

“Although these ads don’t use cookies for ad personalization, they do use cookies to allow for frequency capping, aggregated ad reporting, and to combat fraud and abuse.”

(These are the same exceptions as found in the GDPR.)

More information:
https://support.google.com/adsense/answer/7670312

Disconnect.me should whitelist these to encourage publishers to adopt non-tracking ads.

Example: https://www.google.com/amp/s/www.wired.com/2016/02/googles-amp-speeding-web-changing-works/amp/

disconnectme/disconnect#337

A disconnect.me user reported that submit form on www.virtkick.io doesn't work for him. I tried disconnect.me and I reproduced the problem. Why are you blocking legitimate JSONP requests to MailChimp?

Resource interpreted as Script but transferred with MIME type text/html: "about:blank".
mailchimp ajax submit error: parsererror 

I can confirm this is an issue, MailChimp email signups are blocked under Advertising, causing signups to fail silently on many sites.

http://tvpstream.vod.tvp.pl/?channel_id=745680

MajkiIT/polish-ads-filter#7104 (comment)

See https://bugzilla.mozilla.org/show_bug.cgi?id=1432839

Has control of my settings

https://www.lulek.tv/gry/darmowe/kreatywna-kraina-234

No possibile play Flash game with Firefox tracking protection.

MajkiIT/polish-ads-filter#8077

I see trackers slipping through from s.youtube.com. Example: https://www.youtube.com/watch?v=fd-VFBOOL5c

I think there's a tracker slipping through from clients1.google.com. Example: https://www.youtube.com/watch?v=iLoM3lGGJxk.

Heatmap tracking via static.hotjar.com is not blocked on normal or strict.

For reference: www.hotjar.com

Getting The resource at “https://cognito-idp.us-east-1.amazonaws.com/” was blocked because tracking protection is enabled. using "Disconnect.me strict protection" on FF Nightly.

Please consider whitelisting AWS Cognito. Without this it's impossible to login to any site that uses AWS Cognito for authentication.

This was observed with focus ad blocker, but may impact other disconnect based blockers.

See ampproject/amphtml#6163 for our investigation.

To reproduce:

• Activate ad blocker
• Search https://www.google.com for "obama" or "trump"
• Find results marked as "AMP"
• Try to load them
• Loading Spinner is never removed.

In general, AMP does not do any tracking itself (documents and most resources are served from a cookieless domain). It can instrument traditional tracking services, so things should just work if you block those.

Intrusive profiling company, Lead Forensics, uses the following tracking domains (non-exhaustive list):

secure.leadforensics.com
lead-123.com
mon-com-01.com
infra-gtc.com
lansrv040.com

Appears to follow the form:

//www\.example\.com/js/[0-9]+\.js and noscript as //www\.example\.com/[0-9]+\.png

This issue is causing a breakage bug in Firefox right now, please see https://bugzilla.mozilla.org/show_bug.cgi?id=1518872.

The reason is that Firefox classifies live.com as a third-party tracker on sharepoint.com without realizing that both of these domains belong to the same entity (Microsoft). Having sharepoint.com classified on the Content category in addition to the other Micorosft domains there would allow Firefox to work around this bug by correctly recognizing the entity relationship between these two domains.

I would appreciate the help in adding this domain to the list. Thanks!

The following study has listed two offenders that are using 3rd party scripts to collect user behavioral tracking data from password managers.

https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-user-identities-web-trackers-exploit-browser-login-managers/

These are the vendors called out in the piece:

audienceinsights.net

behavioralengine.com

Not sure whether it belongs under advertising or social, but the domain is owned by twitter.

Domain observed on NYTimes, for example.