i hatte fingerprinting so bad and survalince marketing/predictive policing (not a criminal but live in usa) but EVERY SITE wants javascript even the privacy ones (proton and tuta)

also i torrent and download stuff will mullvad browser (and vpn) help not to be de-anonymized

I just use JShelter, It adjusts certain features by adding lies or faking the info they give out.

I've always thought having javascript totally disabled / on a whitelist basis makes you identifiable more.

I guess it all depends on your threat model.

It will depend on the site.

Some sites you can totally disable JS, and they work fine. Often better! It can avoid the annoyware in so many sites now.

Other sites require JS for basic functionality. But also have tons of tracking JS. On those you can disable the tracking JS and run only what is required.

Yet other sites are such a clusterfuck from many 100's of demains and it can be hard or impossible to unravel what is needed. Those I try to avoid the site if I can.

Someone always will say disabling JS is a fingerprint too. Which is true, but misleading, b/c you can reduce the bits of info more by disabling JS than the bits obtained by the site seeing you disabled JS.

thanks 👍

btw does it use a lot of ram?

I cannot fully understand the page but it appears to use under 10MB of memory.
I could be not reading it all correctly though.

about:memory in Firefox based browsers, Click measure and it'll list all the memory allocations of the browser.

thanks ram is so expensive today ( lol

I’ve always thought having javascript totally disabled / on a whitelist basis makes you identifiable more.

It's complicated. That can be true. But it is often not true.

For a total JS disable, that almost certainly makes you less identifiable. I.e, improves your privacy. It is true that JS-disable is a fingerprint. But it gives the -log2(%-who-do-that) bits of identifying info. If you prevent more bits than that from being obtained via JS, it is a net win. And JS has very powerful ways to fingerprint, and collect more bits than that log2(%) value. Thus, it is normally a privacy win to fully disable JS. Despite it putting you into a small cohort. That cohort is still bigger than the cohort the JS can bucket you into.

But your other case, disabling some JS, that might make you more ID-able. If you disable the same subset as most other ppl, it won't. But if the set you disable is specific to you, then that can provide enough signal to overwhelm the improvement. In that case it can hurt your privacy.

There is not a simple yes/no answer. Which everyone wants to have. "It's true!" "No it's not!" "Yes it it!" Really, it depends. We must consider the factors, to know the answer. Which will vary for each person and circumstance.

Yeah very complicated.

It can be the same with add-on configuration like uBlock much in the same way.

If you stick to the default config you're more likely to be the same as most users however it's also not extremely uncommon for people to have the same adjustments made be that lists or other settings.

The Mullvad browser is setup with this methodology, you can look the same as others if you stick to their default setup.

Like you say, Different factors can mess everything along with the users specific thread model.

I’ve always thought having javascript totally disabled / on a whitelist basis makes you identifiable more.

is advertising a threat model?

My “not a criminal” post seems to be raising a bunch of questions answered by my “not a criminal” post.

Yes, because nonconsensual tracking of people's personal data should be taken as a threat.

that part i understand and advertising is okay in theory, but in practice it relies on that data so i guess i'm hair splitting.

everyone is a criminal if the government doesnt like them

I went on the Mullvad website. Requires 0 JS. Instant love!

Disable JS in your browser. Or at least use LibreJS extension. And use uBlock origin.

I guess in a similar vein, if someone stalking you is part of your threat model, you would try to minimize how much information they're gaining on you even though they rely on that same information. Personally, I believe targeted advertising today is a form of stalking, therefore it makes sense to me why someone would have minimizing data collection for advertisers as part of their threat model.

TBF, JavaScript does allow for sites to be much more functional rather than requiring connecting to servers even for simple user interface updates, and it's simpler to develop than some other, newer, technologies, but it also is the most commonly abused for tracking purposes since it has so much access to local data. I wish there were a way to allow local JavaScript to run, but block it from sending data or if browser makers would develop a comparable technology for manipulating the local page data/DOM that doesn't have access to the internet. But that's unlikely to happen since companies like Google, Microsoft, Apple, etc., have heavy influence on browser standards and rely heavily on monetizing tracking data.

😭