Updated 4.1 Extensions (markdown)

4.1-Extensions.md

@@ -60,5 +60,33 @@ These extensions will not mask or alter any data sent or received, but may be us
    * ❗️ **CSP**: "NoScript uses some trickery to ensure its CSP headers are injected" <sup>[gorhill](https://bugzilla.mozilla.org/show_bug.cgi?id=1462989#c20)</sup>
 * Ghostery, Disconnect
   * They add nothing uBlock Origin doesn't already cover
-* Chameleon, Privacy Possum or any other extension that raises entropy
-  * We support *lowering* entropy. This is best left to *privacy.resistFingerprinting*
+
+### :small_orange_diamond: ⚠️ Anti-Fingerprinting Extensions... F&%K NO!
+
+* **DON'T BOTHER** to **USE** extension features to **CHANGE** any RFP protections
+   * Exception: where you can whitelist a site for functionality and you know the risks
+
+This is not about the merits of randomizing vs lowering entropy: this is about using the best options available. We support RFP (`privacy.resistFingerprinting`) as far superior (in the metrics it so far covers)
+
+   * It is trivial to detect RFP and when you change a RFP metric, you lose your "herd immunity"
+      * i.e.: you just **added** more entropy, very likely unique, compared to the already tiny group of RFP users
+      * Ask yourself why Tor Project recommends you do not change Tor Browser settings and you do not install extensions
+   * RFP is robust and vetted by experts (Mozilla, Tor Project, researchers)
+   * RFP is an enforced set where all users **should be** [1] the same: i.e. uniform, in the same "buckets", or exhibiting the same behavior
+      * [1] Don't fiddle with prefs unless you know what they do
+   * Extensions aren't robust: either lacking APIs, or are poorly designed, or miss all methods, or it's snake oil (impossible)
+      * e.g.: spoof OS? You can't (RFP can do what it likes as it's an enforced set of users)
+      * e.g.: spoof user agent, timezone, locale, or language? navigator properties leak via workers and can leak via other methods such as window.open and iframes
+      * e.g.: spoof screen? css leaks and matchmedia can leak
+      * e.g.: spoof language/locale? Practically impossible, and if (that's a massive "if") it were perfect, then it's no different to setting that as your preferred website language in options
+   *  Extensions can often be detected
+      * e.g. script injection and function names
+      * e.g. if not uniquely, then by their behavior and characteristic patterns
+      * note: RFP doesn't care if it can be detected, because all users are the "same"
+
+If you don't use RFP, then **you're on your own**. And don't rely on entropy figures from test sites. The datasets are not real world, very small, and tainted by both the type of visitors, and by their constant tweaking and re-visits which further poison the results and artificially inflate rare results: e.g. on Panopticlick
+   * e.g.: why are 1 in 6.25 (16%) results returning a white canvas (which is statistically only an RFP solution), and 1 in 6.16 (16%) returning a Firefox user agent, and yet Firefox (and Tor Browser) only comprise approx 4% worldwide
+   * e.g.: why are 1 in 1.85 (54%) results returning no plugins, when chrome (at 67% market share) and others by default reveal plugin data
+   * remember: very, very, very few users use anti-fingerprinting measures
+
+It takes large real world studies to get the number of results per metric, and it takes a controlled one (one result per browser) to get the distribution in order to get relliable entropy figures. Don't believe the BS.