So many privacy nuts use Chrome and don't realize this:
> What about Google Chrome?
> I tried all of the above in Firefox. So I naturally tried to access the same page in Google Chrome to see if I’d still be blocked. Thankfully, I wasn’t.
> But of course I wasn’t because Chrome doesn’t have the same privacy- and security-enhancing designs that Firefox does. Chrome will happily collect as much private information about me and my browsing history and share them with select parties, as needed. It also doesn’t resist fingerprinting or let me modify settings to the same degree that Firefox does because Chrome relies on those fingerprinting technologies to ensure that I am targeted by ads it deems necessary for me to see.
> Being blocked on Firefox and not blocked on Chrome also tells me that Cloudflare is blocking me based on the fingerprint (or lackthereof) of my browser. Everything about my connection is identical between the two requests, aside from the browser being used. It’s the same security certificates, same corporate VPN, same machine, even the same timeframe when I try to access the site.
If you care about anything these days, don't use Chrome.
I’m no Google fanboy but I wasn’t satisfied with this:
> Chrome will happily collect as much private information about me and my browsing history and share them with select parties, as needed
What information does Chrome provide in this scenario that Firefox doesn’t? It feels like backward logic: it worked in Chrome therefore it must be because Chrome gave extra info. In reality it could be a whole bunch of things, something as mundane as Firefox being a rarer user agent so subject to more filtering.
It strikes me that all of this is an inexact science. I've run into rate limit messages with sites before now that go away when I switch browsers, no matter what the browser is. I assume it's because, with the limited information given, the DDOS protection software assumes that same IP + different UA = different computer.
I have no clue but I wasn’t persuaded that this specific scenario works with Chrome because it was giving away more information. At a bare minimum at least try a third browser!
I don't mean to support or refuse the author's main points or analysis, but you might like to know that the Chrome team is currently working towards shipping the Topics API. I have strong opinions about it but I will try not to editorialize.
My high-level understanding is that they're going to run an ML model over your browsing history (locally on your device) to build a list of "topics" that you care about. Sites you browse can use the Topics API to pull a set of these interests from the browser to show you "relevant" ads. Mozilla has taken a negative position against this standard.
https://privacysandbox.com/proposals/topics/
https://github.com/mozilla/standards-positions/issues/622
How is that relevant to the topic?
You asked:
>> Chrome will happily collect as much private information about me and my browsing history and share them with select parties, as needed
> What information does Chrome provide in this scenario that Firefox doesn’t?
Key words: "in this scenario"
Is Cloudflare using an as yet unshipped API as part of DDOS protection?
No, the idea is they're abusing existing APIs for fingerprinting purposes that Firefox privacy settings disallow --canvas font rendering difference detection, detecting your GPU model, and things of that nature.
But this new API demonstrates that Google is not on the consumers side when it comes to limiting tracking/data gathering ability, as the new API is explicitly for fingerprinting.
> No, the idea is they're abusing existing APIs for fingerprinting purposes that Firefox privacy settings disallow
But that’s exactly what I’m saying: the author asserts as fact the reason Chrome worked was because it gives up more personal information but there’s no interrogation of whether that’s actually true and if true, how it’s achieved.
I’m no defender of Google I just believe we should be making arguments we’re able to actually back up.
Fingerprinting is one of the techniques used to track you across the web.
If the site is serving Google, Meta, or ads from other networks, your unique browser fingerprint is one of the tools that makes it possible to target and retarget you.
I think we’re all aware of that. Where’s the specific evidence that Chrome passed the Cloudflare DDOS protection because it gave up more private information than Firefox did?
especially since the author had to change the privacy.resistFingerprinting in Firefox to true to get it to work (meaning that it was able to bypass Cloudflare's loop by being MORE secure). But that appeared to break other non-Cloudflare sites.
I think the fingerprinting is a red herring. Yes, Chrome is less secure. But Chrome worked.
It's quite possible someone at the author's workplace updated their Cloudflare WAF settings and made things more strict, causing more checks. I'd even offer that a Firefox extension might be contributing.
But the argument that Chrome worked because it offered Cloudflare personal information is pretty out there ;)
I thought it was the opposite: that instead of fingerprinting users, web services would instead just ask the browser which topics the user is interested in and display the relevant ADs. It's an explicit design goal to reduce the dependence on fingerprinting users, otherwise why would they do it. Topics are supposed to be the locally sourced privacy preserving alternative to invasive tracking.
Whether Mozilla/Apple/others agree is a different story. The blowback has mostly been around how topics aren't perfect and the design still leaves room for abuse and therefor effectively devolves to traditional tracking: https://mozilla.github.io/ppa-docs/topics.pdf.
For me the issue is a browser shouldn’t be making the information on the topics of sites I visit available to anyone who asks
Browsers don’t do that today and the result is that AD networks fingerprint and track you to try and serve you more relevant content.
The argument from supporters is that this is a step away from the “fingerprint and track” status quo MO. The argument from detractors is that it doesn't quite achieve that goal.
All you need to address your concern is for access to the API to be user-configurable.
Anyone who believes that ad networks won't continue to do fingerprinting in addition to whatever privacy leaks Chrome adds is a fool.
Not if browsers actually limit access to that data needed to do so.
The API to be off by default i.e. it’s opt in and not opt out
And it should be behind a permissions prompt
That's a distinction without a difference. In both cases, user privacy is compromised. If anything, the proposal to make "user agents" snoop on the user is even more infuriating. That sounds more like trojan horse than "user agent."
When I started having this problem logging into a certain credit card co.'s website beginning with about Firefox 105.0.2 on Fedora 38, I was told by their apparently outsourced customer service that I had to use Chrome, which I don't have installed there and couldn't try. Yeah, they wanted me to use LogMeIn so they could fix the problem, too. Right.
Firefox on Android was still working, though, loathe as I am to put passwords of any significance on my phone. Doesn't directly address your question, which I'd like to know the answer to as well.
Brings me back. My company "upgraded" the time entry system at the beginning of this century.. Issue, our whole dev team was on unix (hpux, Solaris) and used firefox, which didn't work anymore (IE only). They solution to have 3 separate terminals we would "cytrix" into an NT machine to do our time machine on Internet Explorer...
Sigh
PayPal's "secure browser" effectively becomes broken by Firefox's first part isolation. that took some time to figure out.
In terms of being blocked by CloudFront (not cloudflare),I actually got a website to fix their policies by just emailing their tech support and showing that simple user-agent changes bypasses their policy anyhow.
[flagged]
> Completely reasonable and expected response from customer support
Absolutely not, it is not reasonable or expected that a credit card company launch a website that doesn't work with Firefox.
> Back in the day, my university would load balance based on the browser being used.
What on earth?
So cancel your credit card with them? They have a reason field on the cancellation form.
If my own bank/credit card blocked Firefox I would cancel with them. I'm pointing out that this isn't really normal or justifiable.
To your specific point about just moving elsewhere, complaining in public about bad industry practices is part of Capitalism and part of how consumers regulate the free market. "Take your business elsewhere instead of complaining" has never really been how this has worked; businesses don't get to opt out of being shamed just because they have a cancellation form, and they shouldn't have any expectation that users will or should be quiet about their bad business practices. The free market is not a replacement for criticism within social spaces; the free market works alongside that criticism and is reinforced by that criticism.
Public complaining is an essential part of how consumers within a free market coordinate with each other and educate each other about abusive corporate behavior, and it serves as an additional mechanism alongside boycotts and cancellations to help punish bad actors in the market.
> I'm pointing out that this isn't really normal or justifiable.
Oh well, what can you do? Vote with your wallet. Tell everyone on HN and Reddit. I agree. But at a certain point it wastes too much of my energy, so I'll basically just cancel cand tell them I can not use their service because reasons, very disappointed, bye.
Why would they load balance based on user agent? I can’t think of a scenario where that was a reasonable solution.
Maybe back when standarts where on shaky ground and different versions of the same content was made? I too cant see the performance advantage of it. Deprioritizing less mainstream browsers to mess with the nerds?
Ahhh yes I remember those days... if you wanted to use advanced IE-only features, send to one codebase, if you wanted broader compatability, send to another. Similar to how mobile websites used to work. Thanks for the ideas! Any other hypotheses?
A third browser... like what? Chrome and Firefox are all that exist now, unless you have access to a Mac with Safari.
My "third" browser is GNOME Web, however, I uninstalled it thanks to performance issues. I installed Chrome from Flathub, but with limited permissions, which I only use for cross-browser testing. My main browser is Firefox.
There are a handful of Webkit based browsers out there, though none that popular except for Safari.
But yes, 3 is all we're left with outside of a few bespoke projects...
Honestly the SerenityOS browser (+ its Linux port, Ladybird) is probably the funniest. I wonder if that passes CloudFlare...
Servo seems to be more viable than Ladybird
I remember back when you could run the Servo app on macOS, it was a doge inside a cog and you could actually browse the internet, there was an address bar and back/forward buttons. But now they've actually removed that sort of stuff and given up on making a standalone browser in Rust, in favor of augmenting Firefox instead. See Firefox Quantum.
Mozilla actually fired the Servo developers to focus solely on Firefox (they still employ Rust developers, just not on Servo). But after some years, other companies picked up development on Servo.
Servo doesn't have a browser but I'd wager that writing a full featured browser for Servo would be much more useful than another Blink browser
I think Servo has already served to bootstrap a bunch of Rust-ecosystem things, and that's why they yeeted it. Though webrender and some other offshoots from Servo are still useful for a lot of projects.
Chromium isn't Chome. Microsoft Edge is popular. And Opera is still used: my teen daughter seems to have bonded with it on her own.
Edge is now Chromium and Opera is also Chromium, but touché that I said "Chrome" in my original comment.
its time to pull out lynx again.
Check out Vivaldi...?
You mean "Chromium with extra steps"? I know it's a fork, but the actual engine is still mostly Chromium.
I've had sporadic issues with Firefox not working on work-related sites one day when the previous day it worked just fine.
I have ublock, privacy badger, decentraleyes, canvas blocker, facebook disconnect, and duckduckgo privacy essentials installed.
I would go through and disable each extension in order to see if it was the cause of the issue, and so far, every single time it has been duckduckgo privacy essentials that is breaking websites for me.
I think I should remove it at this point, but who knows? Maybe it's protecting me from something that I don't see.
With Firefox you can toggle some settings that will make much harder to generate useful fingerprints. That's already a massive privacy difference.
Why would chrome give that information away? That's Google's most valuable resource.
Maybe they're directly delivering your information for a price. From you to them, directly, via Chrome.
https://privacytests.org/ shows some good data what each browser lets through/exposes for websites.
Caveat: (default settings)
I harden my Firefox installations, and therefore this website comparison isn't useful.
It does have Librewolf and Mullvad listed, which are hardened Firefox forks. But its still not your exact scenario, my bad :)
@afavour: The topic isn't as simple as having a HTTP header with a unique identifier. Browser Fingerprinting is a complex process, that uses unintentional implementation details, like how things are rendered with different graphics drivers or details you can get from APIs that are intended for other purposes (like WebRTC).
The site that morjom posted gives you a simple overview and Firefox is known for the privacy preserving features it comes with. However, you are right, that it is an inexact science as long as we don't know the logic of the Cloudflare implementation.
Chrome will indeed divulge more information than other browsers but only on the condition that you have opted-in for such collection.
“The Chrome User Experience Report (CrUX) provides user experience metrics for how real-world Chrome users experience popular destinations on the web. This data is automatically collected by Chrome from users who have opted in, . . .”
Taken from https://web.dev/crux-and-rum-differences/
It's not a real time API, though. It's an aggregated dataset available via BigQuery. I don't think Cloudflare could use it as part of DDOS protection except in very vague ways.
You're conflating a downside of using Chrome and the reason they think Cloudflare blocked them.
> So I naturally tried to access the same page in Google Chrome to see if I’d still be blocked. Thankfully, I wasn’t.
> But of course I wasn’t because Chrome doesn’t have the same privacy- and security-enhancing designs
Maybe I’m missing something but it seems the conflation was by the article author, not me?
seems like the author mentioned that in FireFox disabling "privacy.resistFingerprinting" worked. So looks like Chrome by default is allowing the server to collect Fingerprinting. If cloud flare is using that, then it is a big red flag.
The opposite. enabling the flag fixed the issue although it broke other sites.
Of course they are. Thats the whole point of the 'Integrity Check'. Besides, almost every website you visit collects your fingerprint nowadays.
No. And there’s still the central issue of the author really hand-waving the specifics of their accusations about Chrome. It really seems to come down to “Google bad”.
To be clear, I don’t even use Chrome, in part because “Google bad”. This just isn’t intellectually honest.
The heuristics used to attempt to differentiate between a so-called "bot" and a "human" are, IMHO, inadequate as long as there are "humans" that are allegedly mistaken for "bots" and blocked. "Use Chrome" is not a solution. A person using Firefox or some other non-Google software is still a "human". But not according to these brilliant "site protection" schemes. What level of false positives is acceptable.
Using JS to "verify that this is not a bot" is a way to force users to enable JS and expose themselves to more advertising.
Blocking bots in the first place should not be acceptable since bots only act on behalf of humans. What should be blocked is abusive behavior that actually impacts the site - a single one off GET to what should be a static page should never be blocked, yet that's what CF does.
Furthermore, all bots worth their salt as far as threats go enable js and do everything they can to appear like a normal browser.
That's fine as processing the javascript increases the coast at-least.
I'd love to know if puppeteer passed that test (probably). I have had exactly this problem many, many times and it is incredibly frustrating.
There are github projects that are forks of things like selenium and puppeteer that are specifically designed to avoid detection for things like scraping google search results, etc.
puppeteer passes the test if you run it from a machine that already has a good cloudflare reputation score. Try it from an AWS instance and it definitely fails 100% of the time.
(I've tried it, that's how I know)
Easy to say don't use Chrome, harder to say don't use Cloudfare.
And if we're taking things to task for monopolizing a market and being a threat to the future of the open internet, I'd say Cloudfare is and will always be a bigger threat.
The moment the Cloudfare dictatorship becomes less benevolent, everyone is gonna feel it.
> The moment the Cloudflare dictatorship becomes less benevolent…[]
In my eyes they have already done that. ICYMI I highly suggest checking out their response and subsequent blog post around the Kiwifarms incident.
That whole debacle was enough to prove to me they learned nothing and are going to continue down this path. I migrated web services and closed my account with them shortly after that whole thing.
Cloudflare routinely ignores abuse reports for its network and takes no responsibility for the utter garbage being carried across their network. It’s almost comical how they so desperately cling to the claim that they are “just a dumb pipe” on one side of the house and on the other a “serious security vendor” who is “protecting the web” while blocking out users simply for the “crime” of trying to preserve their privacy.
If they wanted to convince me they had the web’s best interest at heart they wouldn’t host half the sites they do. They would actually respond to abuse reports and take abusive websites offline rather than wait for it to hurt their bottom line and reputation before taking action but they don’t.
Wait, Cloudflare stopped being benevolent by NOT abusing their power enough? You have two different opinions one is that Cloudflare should respect privacy and one is that is should moderate the internet, these are fundamentally at odds.
Website owners can just stop using cloudflare though…
Yes, but how can end users opt out of using Cloudfare?
By end users, you mean people browsing the internet? I think you're conflating Cloudflare DNS with site owners leveraging Cloudflare CDN and WAF/Security.
> If you care about anything these days, don't use Chrome.
Or Cloudflare.
funny enough... I called out Cloudflare for the pariah it is, and got downvoted and flagged
I have done the same to the same result. We must be the lunatics, as everyone keep defending their decision to put everything, even their personal blog, behind a single company, because "they might get DDOSed".
The absolute state of software engineers and systems administrators in here, man. Talk about overengineering and premature optimisation, let alone being totally oblivious that their laziness is what creates a monopoly.
People immediately assume if you dislike CF you’re defending one site in particular and once they do that no further discussion is possible.
I'm out of the loop I guess. Which site would that be?
Probably Kiwi Farms or whatever it has evolved into these days.
Funnily enough, KF has its own buttflare-style bot protection script that doesn't really like firefox. Or whatever provider they are using now does.
and someone's come and done it again
I seriously never get people that love CF (or any company for that matter). Praising 1.1.1.1, giving it free advertising. CF is basically handing over your website in return for some less work on your part. I get the advantages of it (like less engineer credits wasted, less server maintaining work and probably cost, faster) but actively giving it free PR just doesnt fit right with me. Pay your bucks and sit. They are a Big Tech company, they dont need your prayers.
>CF is basically handing over your website in return for some less work on your part.
The older you get, the more valuable being able to just dump your shit on other people becomes.
Quite the opposite for me. The older I get (42 now) the less patience I have for people who sacrifice freedom for convenience. You're ruining it for my children when you do this.
I’m a similar age. My view of tech was shaped by sites like slashdot and the thought processes which went into that culture, but put control of my equipment as the important part. It was an eye opener when I entered the workforce and found tech people who genuinely loved the Microsoft eco culture, which makes sense given how much stuff was built for IE only.
I wonder how world views were shaped with those entering the industry post GFC and with google and aws on the ascendency.
No i totally get it, i can see myself doing the same compromise. I cant see myself recommending such practice, however.
I don't praise 1.1.1.1 because it's just a DNS server. My firewall's set to redirect all DNS queries there. It works fine. Could've used 8.8.8.8 instead, but I trust CloudFlare slightly more.
There’s aeverql other providers none of whom are as large as cloudflare - including quad-9 and opendns, and of course your own ISP
Yeah, I could've used any one of them, before 1.1.1.1 I usually used Google.
> So many privacy nuts use Chrome
Really? That's news to me.
Well, Chromium is quite popular with the security conscious on Linux. At least it was when I was using ArchLinux, they had some good custom build script versions.
Some particular build of Chromium and Chrome are vastly different systems. A lot of this is philosophical; The Mozilla way is to support standards and tut-tut at websites for doing overtly malicious things like looking at user-agent or asking for widevine, the Chromium way is to treat the web as a hostile actor and offensively subvert anti-user behaviors.
Any modern browser that doesn't actively fingerprint as either most-common Chrome on a laptop, most-common Android browser, or most-common iPhone is written by such hopelessly naïve nerds that they shouldn't be trusted with user-facing software with real security considerations.
Security conscious and privacy conscious aren't the same thing, although there's overlap. I can be concerned about the security of my system without caring about whether I'm being targeted for ads.
This is untrue, but frequently misunderstood: Privacy and security are two facets of the same problem. If you don't have security, your privacy is at risk. If you don't have privacy, your security is at risk.
Case in point: Many of those targeted ads contain malware. :)
Do you have any evidence of your claim.
Evidence of what? That malvertising exists?
This loop happened all the time for me in Kiwi Browser on mobile. I have a couple of fingerprint-reducing extensions installed there. I also use other extensions like Dark Reader to make website backgrounds pitch black to reduce OLED display drain and improve readability in darker environments. It appears to be better lately, happening more often while I am travelling and changing IPs, less when I am at home. Still it wastes time when it does the loop, it forces me to use unmodified Chrome, wasting more battery power and harming eyes at dark with those white backgrounds. Unfortunately more and more websites are proxying through CF, thinking they are 'protecting' their website. But CF acts like the chinese Great Firewall, deciding who can and cannot to access the site.
I don't quite understand the "ads it deems necessary for me to see" comment. You will always get ads on sites that serve ads. The thing the tracking might do, is change which particular ads you get. The right solution to that, is to use an ad blocker, and to pay for sites that have an ad-free alternative.
Also, fingerprinting isn't always "bad" -- any business who takes credit cards online, wants to try to exclude people who will commit fraud (because they might have done it before.) Preventing fingerprinting, means you prevent certain anti-fraud, which means that you see higher prices and more friction doing commerce online, which also affects your experience. The connection is just much less direct.
> Also, fingerprinting isn't always "bad" -- any business who takes credit cards online, wants to try to exclude people who will commit fraud (because they might have done it before.) Preventing fingerprinting, means you prevent certain anti-fraud, which means that you see higher prices and more friction doing commerce online, which also affects your experience. The connection is just much less direct.
By the same argument you could say it should be fine for a physical store to refuse service to anyone who they get a bad feeling about or don't want to serve. But if you permit that then you're immediately opening the door to racism etc., which we consider socially unacceptable. It should be the same for websites too - I bet all these browser fingerprinting techniques just happen to mean better service for people who can afford the latest iphone.
Tracking is establishing your identity. Try using a private mode Firefox via a VPN. Half of the web is completely unusable. You get put in unsolvable catchpa hell as punishment for being anonymous.
Try walking into a real place with a mask on and you might also get treated less pleasantly.
Walking into real places with a mask on has been normal for the past three years.
OK, but not with a balaclava.
Will a fake nose, moustache and glasses do?
(My point? Characterising anonymity with an item of clothing associated with paramilitaries has associations that don't need to be there.)
I think that a randomly generated completely real looking expert disguise is probably best. And a pain in the ass.
Have you visited many stores since 2020? There was an event around that time.
I still today wear a mask in every store I enter and I can completely honestly say that I have never gotten a weird look from staff over it; it's never been a problem.
> I still today wear a mask in every store I enter
But why.
Halfway through Covid a witch cursed me so that anyone who looks at my face in public immediately goes into horrible convulsions and dies. It was a confusing week until I found out what was happening, and the bodies were very hard to dispose of discretely.
----
More seriously (and more relevantly), in the context of the current conversation about privacy and user autonomy, the correct answer to "why do you need to be able to do X" should usually be, "that's none of your business."
"Why do you need to run a VPN?" None of your business. "Why do you need to wear a mask?" None of your business. "Why do you have WebGL disabled?" None of your business. "Why does your browser not have this font installed?" None of your business.
A big part of autonomy and agency is that you don't need to ask permission or justify to anybody why you're doing the things you have agency to do. If you need to explain then it's not autonomy, it's permission. I don't feel I need anyone's permission to wear a mask indoors in a public space regardless of my reasoning (and in practice I'm never asked to explain, millage may vary but my experience is that nobody really cares). And similarly I shouldn't need Cloudflare's permission to run an obscure browser or to customize my computer setup.
Try a balaclava.
I am pretty sure I could wear a balaclava to Walmart. In fact early on in Covid during mask shortages I'm pretty sure I did wear basically the functional equivalent of a balaclava into a Walmart because I couldn't find N95s.
Admittedly France has tried this bullcrap with burkas before, but that's not exactly something anyone should be emulating, I think we'd pretty much all agree that "I'm sorry but for security reasons you can't buy groceries wearing a burka" is not an acceptable argument. Security doesn't grant free license to override other people's rights.
Bear in mind that the actual real-world examples of the argument "people shouldn't be able to wear masks in stores because of security risks" have for the most part mostly been examples of security being used as a justification to infringe on religious rights or to block marginalized/disabled people from taking reasonable safety measures to protect themselves from infectious disease.
If you're going to bring up an example of security overriding other concerns, at least bring up an example where security hasn't observably immediately become a slippery slope to infringing on people's rights and excluding them from society. Is "stores can ban you for wearing a mask" supposed to make me more comfortable with websites fingerprinting me? I mean, I know where that argument ends up in the real world, it never ends with balaclavas, we've had that argument in the real world and where it actually ends is with immunocompromised people not being able to buy groceries.
So I'm not sure any of this is really supporting your point. Anonymity should not be punished in physical or virtual spaces, and there are huge debates about de-anonymization, facial recognition, and tracking in both public and private physical spaces and for the most part we don't accept security as a justification for de-anonymization.
That's implausible. Using finger printing for fraud detection would only catch someone using different cards on the same machine. Once a card is deemed stolen it stops working so it's unnecessary for that scenario. That doesn't even go into fake fingerprinting some browsers/plugins.
The price is the highest the market will pay. Increasing that price means few customers lower revenue. Fraud is a cost to the business they must pay out of profits because if they tried to increase prices demand would drop.
>Using finger printing for fraud detection would only catch someone using different cards on the same machine.
In this context the goal of fingerprinting is to detect requests coming from an attacker. It does not care about the ability to distinguish between individual machines.
>Once a card is deemed stolen it stops working so it's unnecessary for that scenario.
The whole point of automating it is so you can cash out many stolen credit cards. If you only have one you might as well do it manually.
>Increasing that price means few customers lower revenue
Making more revenue doesn't matter if that extra revenue ends up getting eaten by chargebacks.
It can be an aspect of it. For example, if there are suddenly many unique fingerprints making purchases from the same residential IP, that might look suspicious.
Granted, I'm not aware of a lack of fingerprint being penalized. That said, there are products that allow custom rules, in which case anything is possible.
I work for a company in this space. Opinions are my own.
> business who takes credit cards online, wants to try to exclude people who will commit fraud
How bad is it nowadays? Can't you just enforce 3DS2?
>If you care about anything these days, don't use Chrome.
I care about a lot of real world stuff - human rights, wars, the environment, friends etc. I don't care if Chrome knows who I am and tries to show me ads which uBlock then blocks. There are more important things to worry about than privacy geekery.
Famous last words: "There are more important things to worry about than privacy".
If you've read history (and maybe you have, or not) privacy is a human right. When privacy goes away, then everything else goes away. Ask anyone over 60 in Germany or Romania (that was not WITH the army or the Police/Security services) and they will tell you how nice life is without privacy.
But hey, sure, 1) privacy doesn't matter, 2) you got nothing to hide, etc etc.
Ads are used to manipulate people into doing things they would not otherwise do, which very much affects "real world stuff". Mostly into wasting money on useless crap, but also worse. What ads uBlock can block is limited by Chrome. What "ads" disguised as content you are shown is affected by what information Google collects and lets other people collect. The internet isn't a nerd safe space anymore - what goes on here often affects real people.
I care about accessing the sites I use quickly and efficiently, with a minimum of auth and compatibility dance.
Since Chrome is so common that it's basically guaranteed to have been tested against the site I'm trying to access, I use Chrome.