Viewing profile — tomrittervg

For a time RFP - by itself - could be enabled by web extensions. (It might still be possible, I don't recall if we removed it.) But it's a footgun because it became even easier for…

And to the point about Mozilla's protections lacking, I've corrected the record: https://ritter.vg/blog-webgl_renderer.html

The Bugzilla bug is at https://bugzilla.mozilla.org/show_bug.cgi?id=2036440 The breadth of responses here about people who can't reproduce this (or can) is one of the most frustrat…

> Also by default addons.mozilla.org is a privileged site so of course they include google tracking in it and they get the proper fingerprint no matter what you have configured AMO…

(n.b. I own these features in Firefox) There are three levels of protection: - ETP Standard (see [0] for the latest improvements we rolled out) - ETP Strict (we're working on thing…

Mozilla is working on it. (I know you said 'Academic', but we publish papers sometimes too.)

> Ultimately most fingerprinting technologies use features that are intended behavior Strong disagree. > IP address/cookies/useragent obviously are useful Cookies are an intended t…

In this context "a unique fingerprint" means that your fingerprint does not match any other user's. When you visit Site A and B you give a fingerprint X that is the same on A and B…

It's 'Suspected Fingerprinters' that controls the Fingerpritning Protection feature described in the blog post. But yes, naming and descriptions is hard and never seems to work. Bu…

This is true, but adding a sandboxing to browsers has been a huge part in driving up the difficulty/cost of browser exploits, and driving down the frequency of their use. And also …

The vulnerability did require JavaScript to trigger. I think it would be a labor of love and craftsmanship to exploit a content process today without using JavaScript.

This is precisely how I feel about Binary Transparency

Ah okay, I understand better. The (second) pseudocode you have is right (the second two 'hash()' should be 'hkdf()', and the first should be 'pbkdf()'.) The first is an alternate w…

There are more details above but the short version is that it is possible to build extensions for other browsers that work with Firefox Sync. But the only one linked seemed to be f…

From the RFC: "Its goal is to take some source of initial keying material and derive from it one or more cryptographically strong secret keys." In our case, the initial keying mate…

I happen to also work on Firefox/Tor Browser's anti-fingerprinting work, so yea - we're trying to make improvements there too =) Containers is a big Firefox feature (exposed throug…

I wasn't aware that any distribution (besides Tor Browser) was building Firefox (or anything really) reproducibly. There's debian's https://reproducible-builds.org/ effort, but I t…

It is many folks', and we appreciate the feedback. Hopefully things will get better soon: https://github.com/mozilla/multi-account-containers/issues/3...

There's a few children of this comment, noting this, but to tie things together from someone from Mozilla: - You can self-host your own sync server. It's not something we spend a l…

Thanks! I filed https://bugzilla.mozilla.org/show_bug.cgi?id=1503872 When we have time we'll have to trace through what it's doing and what components of RFP are causing the failur…

Safari by default has a stricter storage access policy by default for all third-party domains, which requires you to visit the domain as a first party first. So it's probably that …

Thanks for diagnosing that for me, you're right blocking third party cookies does cause it to fail. Both tests are equally valid. I just gave one because trying to be exhaustive ab…

I won't copy paste my reply from above, but rather link it: https://news.ycombinator.com/item?id=17949613

Go to https://ritter.vg/misc/ff/fpi.html On first load it should say "There was nothing in local storage." Now go to https://rittervg.com/misc/ff/fpi.html On first load it should s…

> An option could be to provide a webRTC-based node, but I am not sure how feasible that would be, after reading some comments here. I'll point you at FlashProxy ( https://crypto.s…