Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser Fingerprinting

sites.google.com

Post reply on HN
Print view View original

21–30 of 46 posts

Re: Browser Fingerprinting

#21

Post by marco1 »

marco1 wrote: post #19
dao- wrote: post #18

Earlier quoted context omitted.

> If you feel uncomfortable in that section, feel free to avoid touching it. I feel very comfortable touching hidden prefs in Firefox. That's not my point. My point is that random users stumbling upon your github page may not know what they're doing. > Sure, everything may break some sites. But this is about blocking third party cookies, which blocks not a single site I know (Do you know a popular one?) I quickly goo…

> I quickly googled this for you, found this Right, "1292 days ago". Now that we've just talked about information that is out-of-date. > Blocking 3rd party cookies breaks surprisingly few things Agreed. A comment from the post that you linked to. Disqus being one of the few exceptions that don't work (because it's embedded as a third-party on first-party sites), personally, I can live with that. Everybody has to deci…

Facebook login, Google login, etc. still work (at least with most implementations), since they redirect to the SSO site, which is what every reasonable site should do, instead of using an iframe/embed.

Good luck finding something that considerably improves your privacy while breaking 0.000% of modern sites.

Re: Browser Fingerprinting

#22

Post by mbym »

"users who extensively tweak their settings from the defaults may be actually making their browsers considerably easier to uniquely fingerprint" ...interesting comment in section, "User-dependent behaviors and preferences"

Re: Browser Fingerprinting

#23

Post by dao- »

marco1 wrote: post #21
marco1 wrote: post #19

Earlier quoted context omitted.

> I quickly googled this for you, found this Right, "1292 days ago". Now that we've just talked about information that is out-of-date. > Blocking 3rd party cookies breaks surprisingly few things Agreed. A comment from the post that you linked to. Disqus being one of the few exceptions that don't work (because it's embedded as a third-party on first-party sites), personally, I can live with that. Everybody has to deci…

Facebook login, Google login, etc. still work (at least with most implementations), since they redirect to the SSO site, which is what every reasonable site should do, instead of using an iframe/embed. Good luck finding something that considerably improves your privacy while breaking 0.000% of modern sites.

I'm not blaming you for the fact that disabling third-party cookies may break some sites. The problem is that you provided a long list of preferences privacy-sensitive users allegedly should set, without explaining what these prefs do let alone warning about the possible negative impact.

Re: Browser Fingerprinting

#24

Post by the8472 »

Mozilla and Tor devs are currently working on upstreaming some Tor Browser patches[0] that reduce fingerprinting surface. E.g. cookie isolation based the domain shown in the URL bar[1] and making canvas readback opt-in[2]

[0] https://wiki.mozilla.org/Security/Tor_Uplift/Tracking [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1299996 [2] https://bugzilla.mozilla.org/show_bug.cgi?id=967895

Re: Browser Fingerprinting

#25

Post by dao- »

marco1 wrote: post #16
dao- wrote: post #14

Earlier quoted context omitted.

Hidden prefs are hidden for a reason and can be a foot-gun. The warning when opening about:config is no exaggeration, and copying-and-pasting a bunch of hidden prefs from an untrusted source is not a good idea. For instance: > user_pref("network.cookie.cookieBehavior", 1); If I remember correctly, this may break some sites. > user_pref("dom.battery.enabled", false); Questionable value for privacy / fingerprinting. If…

> The warning when opening about:config is no exaggeration If you feel uncomfortable in that section, feel free to avoid touching it. But if you know what you do, there are zero problems. Want to change your user agent? Do it there. No problems. The warning is for your average non-technical user, justifiably. Well, perhaps you need to read up on those a little bit again. > If I remember correctly, this may break some…

  > Pointless since 20100101 is already the default used in the user agent string
  
  Yes, since late 2015 only
Actually it was 2010 (hence 20100101) for Firefox branded builds:

https://bugzilla.mozilla.org/show_bug.cgi?id=591537

And 2013 for all builds (I happen to have fixed this bug):

https://bugzilla.mozilla.org/show_bug.cgi?id=728773

Re: Browser Fingerprinting

#26

Post by splatcollision »

splatcollision wrote: post #13

In one of the sections: > for example, TCP/IP traffic will often reveal high-resolution system uptime data through TCP timestamps. Is this something that's on by default? Dependent on OS? Not deeply familiar with the details of the TCP stack, but have never hard of something like this being exposed via TCP requests!

Did some research - it's off by default in recent macOS versions. Configurable via the "sysctl net.inet.icmp.timestamp" flag.

http://superuser.com/questions/680200/os-x-how-to-make-it-re...

Re: Browser Fingerprinting

#27

Post by Maydowf »

I really dislike fingerprinting.. I hope someday we find a significant reason (presumably a profitable one) to stop all this creepy shit. How do we make it advantageous for companies (groups/etc) to NOT want to do this? long term I mean.

Re: Browser Fingerprinting

#29

Post by whamlastxmas »

amelius wrote: post #5

Is there a way to easily change (some) browser plugins every five minutes, so fingerprinting becomes useless?

Plugins are a very small aspect of fingerprinting and there's really nothing you can do to stop it other than build a browser specifically designed to stop it.

Re: Browser Fingerprinting

#30

Post by hrjet »

chatmasta wrote: post #17
dandelion_lover wrote: post #15

Earlier quoted context omitted.

It's quite surprising that my disposable virtual machine's firefox in Qubes OS is unique among all tested so far...

Why is that surprising? That's going to be a unique fingerprint in most datasets. The average user is not using Qubes, Firefox or Linux. Qubes isn't designed to blend into all other users; it's designed to make you unlinkable to your other Qubes instances. A better experiment would be to run the test in two of your Qubes instances. Hopefully they will both be unique.

Isn't Qubes OS just a hypervisor? The hosted OSes shouldn't leak that they are running under Qubes.
Post reply on HN