This breaks some sites.
None I use.
I've read it is a problem for last.fm users because of some social chat thing they use I forget the name of.
Anyway.
I do this too, kind of.
I use either refcontrol or smart referrer.
I let sites have referrer on their domain but no 3rd parties by default and can add an exception if I want.
You can test this at http://ip-check.info regardless if you're using Tor or not.
I haven't found the time to do it my self yet but will if someone doesn't beat me to porting Window Name Eraser to firefox from chrome.
window.name is great for the site your visiting to use on their site. They have absolutely no business using it crossdomain, period.
Not even if they own the other domain. There are legitimate ways to do that but they are too lazy, dumb, or opposed to using encryption.
I will allow a fucking cookie if I want to login or allow them to store or gather anything!
No supercookies, no flash cookies, no evercookies.
I use cookie monster, cookie culler, cookie self-destruct, and Cookie Controller that applies my regular cookie rules/disposition to DOM storage cookies as well.
Browsers, all of them, should behave and act the way they do after I make them go all green on ip-check.info.
In addition to that they have no fucking business knowing what the monitor resolution is.
They ONLY need the canvas/inner window of the browser to render their damn site right.
I will pull down videos and watch them offline without flash phoning home or to anyone else to give them anything to fingerprint my devices with.
They aren't entitled to this information and I'm against them having it.
If I were like Carrie or the Twilight Zone kid who sends people into the Corn field and does other "fun" stuff they would have very good reason to be worried. >=/
The site has been down for years but you can find it on The Internet Archive.
wtikay.com
whattheinternetknowsaboutyou.com
There are some other sites that use the same or slightly different tactics to throw everything against the wall and see what sticks.
They read your history right out or your cache using timing or logic to know if you've already visited the sites in question they want to query for. They also read the color values of the links to know if you've visited that link before.
This was a known issue that someone brought up 10+ years, no 15+ years ago before we had Firefox and they were working on the not production ready Gecko codebase and still just trying to pass early CSS acid tests. Gecko builds early on had this issue and it was raised and to this day no one has fixed it.
No, I'm not a coder/developer as yet and it is over my head and I don't have the time to research it to devise a solution and send a patch upstream. If I could I have serious doubts it would be mainlined. I have the impression that many in the mozilla organization are for improving security and privacy but that some of them are MORE than happy to sacrifice our privacy for money or simply don't take things as seriously as others.
I found a bug report in bugzilla using google that I can no longer turn up regarding silent basic authentication for tracking:
http://user:[email protected]/possiblymor...
This is proven and observable at http://ip-check.info.
In this bug report someone I believe who works with them submitted a test xpi authtest.xpi to negate/nullify/disable this exploit between sites and only allow it on the same visited domain.
The bug report can no longer be found and all current versions of firefox are still susceptible.