Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor at the Heart: Firefox

blog.torproject.org

Post reply on HN
Print view View original

41–50 of 77 posts

Re: Tor at the Heart: Firefox

#41

Post by MR4D »

noja wrote: post #19
SamBam wrote: post #17

Earlier quoted context omitted.

How accurate is canvas fingerprinting? And could it be used in the courts (which would seem a pertinent question for many Tor users)?

Someone else can answer better than me, but https://panopticlick.eff.org claims the canvas fingerprint provides 17 bits of identifying information (click detailed results after testing)

On mine, the System Fonts give 17 bits of info (1 in roughly 200,000 computers). User-Agent is next with only 8 bits.

Based on that alone, it seems that just replying back with either a blank font list or the minimal standard font list (e.g. only Times & Arial) would solve most of this problem.

I'd love to see the Firefox team fix that first.

Re: Tor at the Heart: Firefox

#42

Post by rahrahrah »

cobbzilla wrote: post #39
swiley wrote: post #33

Why use firefox at all? why not something based on libcurl that absolutely does not talk back to the server after reciving the document unless the user clicks on a link or submits a form?

that's the Richard Stallman approach: https://stallman.org/stallman-computing.html he has a script that he can poke to download the content and email it to himself. then he reads it with emacs or maybe lynx with no networking enabled.

I just read that page. Felt like I fell into the twilight zone.

Re: Tor at the Heart: Firefox

#43

Post by Drdrdrq »

sintaxi wrote: post #18
gsnedders wrote: post #16

Earlier quoted context omitted.

You don't even need canvas to do font-sniffing. It gets better with canvas, but it's largely good-enough without.

why don't browsers just ship with its own fonts?

They used to, loooong time ago... At least I think so? I seem to remember Netscape on Linux bundling the fonts, not sure what they did with Arial/Helvetica on Windows 3.1.

However good fonts are a massive undertaking and only make sense for OS vendors, at least the fonts which include many languages.

Re: Tor at the Heart: Firefox

#44

Post by tlrobinson »

Why doesn't Tor browser just automagically run a read-only lightweight Linux VM who's only program is Firefox, and only network connection is proxied through Tor? Seems like that would solve almost every fingerprinting and sandbox escape vulnerability.

Re: Tor at the Heart: Firefox

#45

Post by swsieber »

MR4D wrote: post #41
noja wrote: post #19

Earlier quoted context omitted.

Someone else can answer better than me, but https://panopticlick.eff.org claims the canvas fingerprint provides 17 bits of identifying information (click detailed results after testing)

On mine, the System Fonts give 17 bits of info (1 in roughly 200,000 computers). User-Agent is next with only 8 bits. Based on that alone, it seems that just replying back with either a blank font list or the minimal standard font list (e.g. only Times & Arial) would solve most of this problem. I'd love to see the Firefox team fix that first.

I think they are working on the fonts problem.

Re: Tor at the Heart: Firefox

#46

Post by moondev »

tlrobinson wrote: post #44

Why doesn't Tor browser just automagically run a read-only lightweight Linux VM who's only program is Firefox, and only network connection is proxied through Tor? Seems like that would solve almost every fingerprinting and sandbox escape vulnerability.

https://github.com/paulczar/docker-torbrowser

Re: Tor at the Heart: Firefox

#47

Post by kibwen »

MR4D wrote: post #41
noja wrote: post #19

Earlier quoted context omitted.

Someone else can answer better than me, but https://panopticlick.eff.org claims the canvas fingerprint provides 17 bits of identifying information (click detailed results after testing)

On mine, the System Fonts give 17 bits of info (1 in roughly 200,000 computers). User-Agent is next with only 8 bits. Based on that alone, it seems that just replying back with either a blank font list or the minimal standard font list (e.g. only Times & Arial) would solve most of this problem. I'd love to see the Firefox team fix that first.

Unless every browser in the world adopts the same list, replying with a fixed list of fonts would make users of a given browser immediately recognizable (especially for low-marketshare browsers like Tor). Seems like you'd want a system where the response to a list-of-fonts query would be semi-random and likely to overlap with the lists that are naturally produced by other browsers.

Re: Tor at the Heart: Firefox

#48

Post by kibwen »

sintaxi wrote: post #18
gsnedders wrote: post #16

Earlier quoted context omitted.

You don't even need canvas to do font-sniffing. It gets better with canvas, but it's largely good-enough without.

why don't browsers just ship with its own fonts?

Few (none?) of the ancient "web-safe fonts" are permissively licensed. And nice-looking fonts that look good on all OSes and that have a large set of glyph coverage are quite expensive to make (though I'm sure Google/Microsoft/Apple could afford it).

Re: Tor at the Heart: Firefox

#49

Post by cupantae »

cupantae wrote: post #30

I'm getting HTTPS errors on two platforms (and two internet connections) for this website. It seems fairly ironic, but I guess it's just me. Am I doing something wrong? IIDRN says it's up: http://www.isitdownrightnow.com/torproject.org.html

Yeah, it's just me. Didn't work on wifi at work or 4G, but does at home. Maybe they're lagging behind a CA update....

Re: Tor at the Heart: Firefox

#50

Post by btown »

bzbarsky wrote: post #24
mburns wrote: post #5

Earlier quoted context omitted.

https://wiki.mozilla.org/Release_Management/Uplift_rules

That's not the same thing. "uplift" for that page means "backport from development trunk to a more-stable branch".

Theoretically Tor Browser's fork is just another development branch of Firefox, just like Mozilla's primary development branch, and they are "uplifting/backporting" individual patches into stable the same way Mozilla might backport crucial dev-branch improvements/bugfixes into stable.
Post reply on HN