I'd like to see the canvas fingerprinting dealt with in Firefox mainline, it's used everywhere.
How do you fix it without disabling canvas?
Tor at the Heart: Firefox
11–20 of 77 posts
Re: Tor at the Heart: Firefox
#12Why did they make up this term "uplift" instead of just saying "upstream"?
The article describes it as upstream patch that is disabled by default which allow Firefox to be less discriminative when it comes to accepting patches.
That sentence did not read to me as a definition, and the sentence still works for me using the normal "upstreamed".
Re: Tor at the Heart: Firefox
#13Why did they make up this term "uplift" instead of just saying "upstream"?
"uplift" in this context seemed to mean to me that they were not upstreaming the patches verbatim but neutering them for Firefox.
Re: Tor at the Heart: Firefox
#14I'd like to see the canvas fingerprinting dealt with in Firefox mainline, it's used everywhere.
How do you fix it without disabling canvas?
I don't think it can be solved without origin specific permissions - to allow using local fonts and whatnot used on the canvas, at the same time I don't think that would be an issue.
Re: Tor at the Heart: Firefox
#15I'd like to see the canvas fingerprinting dealt with in Firefox mainline, it's used everywhere.
How do you fix it without disabling canvas?
The tor version of Firefox patches it to be unique per website iirc. There is this Firefox add-on that does something similar: https://addons.mozilla.org/en-US/firefox/addon/canvasblocker...
Re: Tor at the Heart: Firefox
#16Earlier quoted context omitted.
How do you fix it without disabling canvas?
I don't think it can be solved without origin specific permissions - to allow using local fonts and whatnot used on the canvas, at the same time I don't think that would be an issue.
You don't even need canvas to do font-sniffing. It gets better with canvas, but it's largely good-enough without.
Re: Tor at the Heart: Firefox
#17I'd like to see the canvas fingerprinting dealt with in Firefox mainline, it's used everywhere.
How accurate is canvas fingerprinting? And could it be used in the courts (which would seem a pertinent question for many Tor users)?
Re: Tor at the Heart: Firefox
#18Earlier quoted context omitted.
I don't think it can be solved without origin specific permissions - to allow using local fonts and whatnot used on the canvas, at the same time I don't think that would be an issue.
You don't even need canvas to do font-sniffing. It gets better with canvas, but it's largely good-enough without.
why don't browsers just ship with its own fonts?
Re: Tor at the Heart: Firefox
#19I'd like to see the canvas fingerprinting dealt with in Firefox mainline, it's used everywhere.
How accurate is canvas fingerprinting? And could it be used in the courts (which would seem a pertinent question for many Tor users)?
Someone else can answer better than me, but https://panopticlick.eff.org claims the canvas fingerprint provides 17 bits of identifying information (click detailed results after testing)
Re: Tor at the Heart: Firefox
#20I'd like to see the canvas fingerprinting dealt with in Firefox mainline, it's used everywhere.
How accurate is canvas fingerprinting? And could it be used in the courts (which would seem a pertinent question for many Tor users)?
The 2012 UCSD paper [1] claims they observed 5.73 bits of entropy in their admittedly non-representative population.
As with everything, it depends on the user's threat model. In a court setting, it'd depend on how individual pieces of evidence stack up against a user to make them look bad, and whether there is enough reasonable doubt.