Block social sharing buttons as trackers by default

[tildelowengrimm]

Long-term, we should replace social sharing buttons with inert placeholders which only communicate with the sites when you interact with them (#534). But until we implement that, we should err on the side of safety by blocking them outright.

Edit bbondy: I bumped this to P3 because I'm landing this in 0.63.x which allows users to turn off social buttons and embedded tweets: https://github.com/brave/brave-core/pull/1818

[Redback812]

How about covering all social sharing from all or most social media sites, facebook is one problem however the numerous other sites like instagram, twitter, snapchat, linkden, google and etc. Give us the ability to cherry pick who we wish to allow or not from brave shield.

[tildelowengrimm]

@Redback812 That's the sort of thing that's in the long-term work of #534, not this short-term solution.

[fmarier]

I created a test page with all of the social widgets I could find.

Looking at the widgets that aren't blocked on my test page, we might be able to blacklist the following URL fragments:

• www.facebook.com/plugins/like.php
• www.facebook.com/plugins/share_button.php

to disable Like/Share buttons that use the iframe API.

Note that in practice that means we would have to remove the www.facebook.com exception on desktop and Android and replace them with more specific rules like:

• www.facebook.com/plugins/video.php
• www.facebook.com/plugins/comment_embed.php
• www.facebook.com/plugins/post.php
• www.facebook.com/plugins/page.php

When it comes to Twitter and the Facebook JS API, they all rely on the same JS resources (https://platform.twitter.com/widgets.js and https://connect.facebook.net/en_US/sdk.js respectively) and so we can't block the buttons without also blocking embedded content like videos or timelines.

[fmarier]

@tomlowenthal Do you think this is still worth doing, given it's not going to block all of the buttons?

[fmarier]

@bbondy suggests waiting until Steps 2/3 of #3475 are done since this new plan is being actively worked on.

[diracdeltas]

@tomlowenthal do you think this can be closed in favor of Steps 2 and 3 in https://github.com/brave/brave-browser/issues/3475? (which are partially done)

[bbondy]

Added an edit to comment 0:

Edit bbondy: I bumped this to P3 because I'm landing this in 0.63.x which allows users to turn off social buttons and embedded tweets: brave/brave-core#1818

[ryanbr]

Probably too problematic. A better option, specifically targeting facebook. Include an optional list for all facebook.com third-party elements.

https://github.com/ryanbr/fanboy-adblock/blob/master/fanboy-antifacebook.txt

In a similar vain to the recent Firefox facebook container feature, which could be easily done in a list.

[pes10k]

closing in ~favor of https://github.com/brave/brave-browser/issues/3241~ https://github.com/brave/brave-browser/issues/817