Privacy badger thinks matrix.org is snooping

[Biep]

I discovered why I had problems creating new accounts in Firefox: Privacy Badger is blocking matrix.org. There is a whitelist - it might be a good idea to get matrix.org on it (by declaring you won't abuse the information you collect).
https://acceptableads.com/en/get-whitelisted/
https://www.eff.org/dnt-policy

[lampholder]

Hi @Biep - can you advise where in the process Privacy Badger blocked registration, and how you experienced that as part of the sign up process?

Also thanks for sharing those links - I've submitted a whitelist application to acceptableads. I'll try and look into the eff dnt business when I get a chance :)

[Biep]

Just setting "matrix.org" to the yellow middle setting was enough. I believe that means: accept cookies, but delete them afterwards.
Now Privacy Badger blocks a site if it discovers it on three different domains. I suppose those are matrix.org, riot.im, and another that I cannot guess.

[lampholder]

Ugh, well, this is fun.

If it observes a single third-party host tracking you on three separate sites, Privacy Badger will automatically disallow content from that third-party tracker.

I guess that this means that if you connect to the same homeserver from multiple riot instances, Privacy Badger will start 'helping' by flagging that homeserver as a third party tracker and interfering with its business.

Without researching this in more detail, it looks like Privacy Badger's MO might be fundamentally incompatible with browser-based 'client' software; Riot is only useful when it's connecting to a 'third party' service - i.e. the homeserver (and it's not uncommon to connect to the same homeserver from multiple different domains).

The scalar instance might be even more of a worry, seeing as (at the moment) almost every riot instance is going to connect to the same scalar instance even if each client is linked with a different homeserver :(

[lampholder]

There might be some utility in trying to get matrix.org onto their 'yellowlist' (criteria), or to making the formal declaration of Do Not Track.

Being on the yellowlist would solve the issue for matrix.org (for now at least), but it wouldn't address the issue for homeservers/web-based-riots more generally.

Making the do not track statement might work, I'd have to better understand what applies (I imagine not much, because people are only really connecting to a homeserver via the riot client in order to be tracked, if tracked == having an ongoing stateful chat session).

[lampholder]

All of this said, I tried to get matrix.lant.uk blocked by connecting via >3 clients on different domains - PrivacyBadger had flagged it as a potential tracker, but was defaulting to green.

[Biep]

I understand Matrix.org has been whitelisted already - maybe so have other servers? Or the Privacy Badger team has looked into it and whitelisted all servers, or made them be recognised automatically? Just guessing some possibilities..

…

---- Op Mon, 29 Apr 2019 17:36:58 +0200 Tom Lant <notifications@github.com> schreef ---- All of this said, I tried to get matrix.lant.uk blocked by connecting via >3 clients on different domains - PrivacyBadger had flagged it as a potential tracker, but was defaulting to green. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[babolivier]

fwiw it might be relevant to also whitelist/yellowlist vector.im as I just got stuck by PB suddently deciding it was a tracker that should be blocked entirely (which prevents the whole of Riot to fail to load).

[t3chguy]

EFForg/privacybadger#2480