Hi, one of the authors here. We discuss this in the last section of the post. uBlock Origin uses lists to determine which requests to block. We tested the two largest, EasyList and EasyPrivacy, and both fail to block scripts from FullStory, Smartlook, and UserReplay.

I suggest uBO's medium mode, this blocks 3rd-party scripts by default.

[1] https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium...

thank you for suggestion in this unexpected place. i wish i knew of this uBO feature before!

I checked the hosts file I normally use (MVPS) and they don't seem to be in there either, unless they serve the scripts from a non-obvious domain.

Also fun fact, TurboTax uses SmartLook.

That doesn't seem very problematic to me. You are anyway trusting TurboTax with a bunch of sensitive information.

Yes, but you may not realize that SmartLook is also getting all that information.

How about NoScript, RequestPolicy, and Privoxy?

Were the blocking capabilities of any of these tested by your team?

Assuming it's used correctly ,noscript/requestpolicy should block these as they are 3rd party <script src>s

RequestPolicy appears to have been killed by FF57.

uMatrix stops everything 3rd party from loading by default, but makes it easy to whitelist as you go. It makes browsing extra work for most sites (it adds the step of having to eduguess what you need to enable for the site to function properly - very, very few do so when third parties are blocked) but I find it's worth it.

Try umatrix.