Re: Making package.el talk over Tor

[Stefan Kangas <stefankangas@gmail.com>]

Richard Stallman <rms@gnu.org> writes:

>   > 185.220.101.26 - - [14/Dec/2023:13:04:00 +0100] "GET /test HTTP/1.1" 301 169 "https://amodernist.com/" "URL/Emacs Emacs/30.0.50 (PureGTK; x86_64-pc-linux-gnu)"
>
>   > As you can see the User-Agent indicates that I am using Emacs, what
>   > version and even my architecture.  Compare that to the user agent that
>   > you'd regularly encounter from an average browser:
>
> We should (1) let users specify what User-Agent to send, and (2) maybe
> choose a different default.
>
> Icecat, by default, identifies itself as some widely used proprietary
> browser running on Windows.

Should we bump the default to 'paranoid'?  Do what icecat does?

Does the remote ever need to know if we're using X11 or PureGTK?
I think they don't, and we should never add that information, in any
configuration.

>   > Other than the user-agent, there are certainly other bits of behaviour
>   > that a malicious actor can use to track a user, such as the order in
>   > which HTTP headers are transmitted, the size of chunks by which the
>   > client sends and receives data and of course what requests aren't being
>   > sent (e.g. due to a lack of Javascript in EWW).
>
> We could work on making Emacs-based browsing more similar to the most
> common browsers, in such aspects of visible behavior.

If you are very concerned about your privacy, it's probably better to
browse the web using the Tor web browser and eschew Emacs altogether.

How about telling users about this in the EWW manual?