1vuio0pswjnm7

"Blending in" is not the goal. Every internet user can be tracked. It's the nature of the computer network

The goal is to stop sending so many unnecessary details to so-called "tech" companies, intermediaries (middlemen) that have occupied the internet and engage in surveillance to support advertising services

The excessive details sent by the so-called "modern" browser, that they control (go figure), make it easier to market, sell and deliver advertising services

I don't use a browser to make HTTP requests

Advertising requires a popular browser

Every internet user can be tracked. IP address alone is usually enough

But IP address alone is not enough for today's online advertising. It needs a graphical browser, images, CSS, Javascript and so on. The complexity of these programs is a nightmare. Intricate behavioural surveillance of ad targets becomes possible

Tor is not generally used as a means to avoid advertising-related tracking that is accomplished using "fingerprinting". It could work for that but it's overkill

Using a "Tor Browser" (modified Firefox^1) that can show ads doesn't make much sense if the goal is to avoid ads

1. Mozilla, the source of Firefox, is "all-in" on internet advertising

What is the point of fingerprinting. (A: There could be multiple purposes.) If the purpose is tracking for internet advertising, then _internet advertising_ is the problem, not fingerprinting

Without the ability to advertise through a complex, popular so-called "modern" browser, tracking via "fingerprinting" becomes less valuable, perhaps even pointless

As such, the goal is to send fewer details and provide less potential for advertising and behavioural surveillance

If in doing that, every www user sends the exact same, minimum amount of detail with every HTTP request and thereby appears to "blend in", then maybe that's a useful side effect

But "blending in" alone doesn't stop advertising and behavioural surveillance. Perhaps it makes it less targeted, but it does not stop it. There is a reason that Firefox needs to be modified for Tor: it's a liability. The so-called "modern" browser has immense surface area and plethora of "features", e.g., a Javascript interpreter, that can be used for surveillance, fingerprinting and tracking, whether for advertising or anything else

I don't use it. The goal is not simply to "blend in". The goal is to deny the surface area, the "features", the excessive details sent, that can be used for online advertising and the fingerprinting and tracking that is _motivated by_ and associated with this advertising

As they say, "Don't feed the beast"

Lots of www users are getting fingerprinted no doubt

But it's not difficult to avoid giving away unnecessary details used to create fingerprints, it's just that few people care to do it

I don't use a browser to make HTTP requests, so I have almost full control over fingerprints. There's no Javascript, cookies, CSS or images. No graphics. I use different combinations of headers, usually only Host and Connection because that's all that's needed. I use different UA values if a UA header is required, I use various TLS libraries, I can manipulate the client hello

Of course anyone can collect a fingerprint but not all fingerprints indicate a worthy ad target

"OHTTP" sounds like the dumbest idea I have heard in a while. It does nothing to reduce the amounts of detail that users send that can be used to create fingerprints

Yes, one can remove certificates from a "trust store" in a folder (in practice, usually a "bundle" maintained by a browser vendor, or something derived therefrom)

But how does the www user remove a certificate that's compiled into a popular browser

The popular browsers, maintained by companies invested in internet surveillance advertising, is so large and complex that in practice few will edit and compile it themselves. Not only is certificate removal impractical but user-signed certificates outside the browser will usually trigger multiple warnings, even requiring users to type shibboleths to be detected by keyloggers

This "Web PKI" system presumes no www user can _ever_ trust themselves to make trust decisions. It's presumed that this is _never_ an option for _any_ user, in any situation

"... and the whole system doesn't even work because certificates are issued over plaintext connections, and trusted certificate aurthorities[sic] use very secure keys like "4""

And the CA certificate is "self-signed"

Meanwhile under this "Web PKI" the www user is by default discouraged and/or blocked from using self-signed certificates she herself creates

Someone else decides who she must trust. It's not optional

For example, for a number of years someone else told her she must trust eMudhra

"“That’s complete BS,” said Jeff Leiden, executive chairman of Vertex Pharmaceuticals, recalling a recent conversation with a tech leader who claimed AI would cure 90% of human disease in the next seven years."

The amount of US taxpayer dollars this company has wasted is astounding

"Is any of this sensitive? We'll leave that to you, since "sensitive" means different things to different people (though I think you have plenty to choose from here)."

What would a jury say