Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor at the Heart: Firefox

blog.torproject.org

Post reply on HN
Print view View original

61–70 of 77 posts

Re: Tor at the Heart: Firefox

#61

Post by nsgi »

MR4D wrote: post #41
noja wrote: post #19

Earlier quoted context omitted.

Someone else can answer better than me, but https://panopticlick.eff.org claims the canvas fingerprint provides 17 bits of identifying information (click detailed results after testing)

On mine, the System Fonts give 17 bits of info (1 in roughly 200,000 computers). User-Agent is next with only 8 bits. Based on that alone, it seems that just replying back with either a blank font list or the minimal standard font list (e.g. only Times & Arial) would solve most of this problem. I'd love to see the Firefox team fix that first.

This would also have the additional positive effect of reducing differences in rendering across browsers. At the moment there's a risk of the browser a webpage is viewed in not having the right fonts.

There's no reason for browsers to make a large number of fonts available if websites aren't able to use them because not all browsers make them available.

However, there may be an issue with internationalisation.

Re: Tor at the Heart: Firefox

#62

Post by twic »

w8rbt wrote: post #25
niftich wrote: post #20

Earlier quoted context omitted.

The 2012 UCSD paper [1] claims they observed 5.73 bits of entropy in their admittedly non-representative population. As with everything, it depends on the user's threat model. In a court setting, it'd depend on how individual pieces of evidence stack up against a user to make them look bad, and whether there is enough reasonable doubt. [1] https://cseweb.ucsd.edu/~hovav/papers/ms12.html

That's less than picking one character randomly from a keyboard. Seems pretty small to me. >>> import math >>> print math.log(95) / math.log(2) 6.56

ObGolf:

>>> print math.log(95, 2) 6.56985560833

Re: Tor at the Heart: Firefox

#63

Post by orf »

tlrobinson wrote: post #44

Why doesn't Tor browser just automagically run a read-only lightweight Linux VM who's only program is Firefox, and only network connection is proxied through Tor? Seems like that would solve almost every fingerprinting and sandbox escape vulnerability.

Seems OK until you want to upload a file somewhere.

Re: Tor at the Heart: Firefox

#64

Post by tlrobinson »

orf wrote: post #63
tlrobinson wrote: post #44

Why doesn't Tor browser just automagically run a read-only lightweight Linux VM who's only program is Firefox, and only network connection is proxied through Tor? Seems like that would solve almost every fingerprinting and sandbox escape vulnerability.

Seems OK until you want to upload a file somewhere.

That doesn't seem like a particularly hard problem to solve.

Re: Tor at the Heart: Firefox

#65

Post by chimeracoder »

moondev wrote: post #46
tlrobinson wrote: post #44

Why doesn't Tor browser just automagically run a read-only lightweight Linux VM who's only program is Firefox, and only network connection is proxied through Tor? Seems like that would solve almost every fingerprinting and sandbox escape vulnerability.

https://github.com/paulczar/docker-torbrowser

That shares your X11 session, which is a security nightmare. If you're running an untrusted application, you should absolutely not give it access to your X11 session.

(There are other reasons you might want to have a Tor browser running inside a container, but if the main goal is to nullify fingerprinting and sandbox exploits, you're better off just using an actual VM).

Re: Tor at the Heart: Firefox

#67

Post by BuuQu9hu »

tlrobinson wrote: post #44

Why doesn't Tor browser just automagically run a read-only lightweight Linux VM who's only program is Firefox, and only network connection is proxied through Tor? Seems like that would solve almost every fingerprinting and sandbox escape vulnerability.

See Qubes, Whonix, Tails, Subgraph etc.

Re: Tor at the Heart: Firefox

#68

Post by BuuQu9hu »

gsnedders wrote: post #60
MR4D wrote: post #41

Earlier quoted context omitted.

On mine, the System Fonts give 17 bits of info (1 in roughly 200,000 computers). User-Agent is next with only 8 bits. Based on that alone, it seems that just replying back with either a blank font list or the minimal standard font list (e.g. only Times & Arial) would solve most of this problem. I'd love to see the Firefox team fix that first.

A blank font list where? There's no way to get a direct list of fonts: you just try rendering text with a given font and look at the metrics of it versus the fallback. Font lists are done using side-channels (and you also therefore have to have a list of fonts to sniff in the first place). The only way to stop font-based side-channels is to limit the web to a fixed set of fonts: and that will horribly break the web i…

Disable looking at the metrics of text rendering results?

Re: Tor at the Heart: Firefox

#69

Post by BuuQu9hu »

c0nducktr wrote: post #37
bifurcation wrote: post #28

Earlier quoted context omitted.

It's a mix. Some patches are just getting rebased and landed. For others, the Firefox and Tor Browser teams are working together to re-implement the feature in a way that makes more sense in the broader Firefox architecture. For example, for First Party Isolation, we took the "origin attributes" feature that we built to support containers (user-specified tracking limitations) and reused it for isolation. In the conta…

Regarding your last sentence, does that mean that in the future I could open a link in a 'tor browser' container? That's awesome if so.

And will the default for 'Private Browsing' be a Tor container?

Re: Tor at the Heart: Firefox

#70

Post by noja »

chimeracoder wrote: post #65
moondev wrote: post #46

Earlier quoted context omitted.

https://github.com/paulczar/docker-torbrowser

That shares your X11 session, which is a security nightmare. If you're running an untrusted application, you should absolutely not give it access to your X11 session. (There are other reasons you might want to have a Tor browser running inside a container, but if the main goal is to nullify fingerprinting and sandbox exploits, you're better off just using an actual VM).

Wayland is less of a security nightmare, how would it work with Wayland?
Post reply on HN