Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Websites can now fingerprint a device when multiple browser instances are used

arstechnica.co.uk

Post reply on HN
Print view View original

141–150 of 154 posts

Re: Websites can now fingerprint a device when multiple browser instances are used

#141

Post by Silhouette »

zeveb wrote: post #105
Silhouette wrote: post #82

Earlier quoted context omitted.

Do you realise that every item on your list wasn't just possible but flourished without JavaScript No, I don't realise that at all. Imagine how tedious it would be even to use a relatively simple discussion forum like HN if you had to wait for a full page reload every time you hit a voting button or expanded/contracted a thread. That's about as simple an interaction as you can get, but there are countless other simpl…

> Imagine how tedious it would be even to use a relatively simple discussion forum like HN if you had to wait for a full page reload every time you hit a voting button or expanded/contracted a thread. You don't need a full page reload to implement voting; that's what the 204 No Content response is for: your browser sends the vote & doesn't refresh the page.

That's a fair answer in the specific case of voting, but it doesn't help in the other situations I mentioned.

Re: Websites can now fingerprint a device when multiple browser instances are used

#142

Post by Silhouette »

eeZah7Ux wrote: post #92
Silhouette wrote: post #82

Earlier quoted context omitted.

Do you realise that every item on your list wasn't just possible but flourished without JavaScript No, I don't realise that at all. Imagine how tedious it would be even to use a relatively simple discussion forum like HN if you had to wait for a full page reload every time you hit a voting button or expanded/contracted a thread. That's about as simple an interaction as you can get, but there are countless other simpl…

> Imagine how tedious it would be even to use a relatively simple discussion forum like HN if you had to wait for a full page reload every time you hit a voting button or expanded/contracted a thread. If javascript did not exist HTML/CSS/SVG would have evolved simple features like submitting a POST when an element is clicked without reloading a page. Iframes were already enabling something similar and CSS supports an…

If javascript did not exist HTML/CSS/SVG would have evolved...

Perhaps it would. Perhaps if JavaScript did not exist then we would have developed better tools for building what we now call web apps instead. Perhaps if JavaScript did not exist, those apps would be using something separate to the Web, and the Web would have remained a mostly non-interactive, read-only medium. I'm quite sure that with the wisdom of hindsight that we enjoy today we could have designed much, much better ways to do what web apps are doing.

But the thing is, JavaScript does exist, and it's being used to provide sites/apps that many people find useful, arguably much more useful by now than the original purpose of the Web. Meanwhile, those hypothetical alternatives do not exist, and so obviously they aren't providing any of that desirable functionality to users.

This being the case, I think reverting to the Web being a very limited medium that doesn't offer those benefits is no longer plausible. It would set the development of useful and/or enjoyable technologies used by billions of people back 10-15 years, and there's no guarantee that whatever would actually evolve to replace it would be any better.

I'm been developing for the Web professionally for many years, and a programmer for many years more. I'd be the first to agree that what we have today has problems, some of them serious, and that we should try to do something about them. But no-one's going to stop the train or turn back time, so any realistic solutions have to start from where we actually are and provide better practical alternatives, not start from where some of us might have preferred to be and provide wishful thinking.

Re: Websites can now fingerprint a device when multiple browser instances are used

#143

Post by Silhouette »

omginternets wrote: post #66
Silhouette wrote: post #54

Earlier quoted context omitted.

JS is different---your browser automatically downloads and executes untrusted, unsigned, arbitrary, ephemeral code that can do whatever it feels like. It really doesn't. There are severe limits on what JS downloaded from some random site can do via a browser on your local device. A few tricks to detect some environment-based signals and invade privacy might be undesirable, but that intrusion is nothing compared to th…

>It really doesn't. There are severe limits on what JS downloaded from some random site can do via a browser on your local device. That's missing the point. With respect to tracking a user, most of those restrictions don't matter. Your browser does download/execute untrusted, unsigned, arbitrary, ephemeral code that can do any kind of tracking it wants.

And compared to the kinds of technologies used for copy protection and telemetry in native applications, what JS can do within a browser is still very limited.

Yes, the browser executes JS code from untrusted sources, but only if you visit a page that loads scripts from those sources, and always (barring security bugs) within a sandbox that limits their capabilities.

I fail to see how this can possibly be any worse than installing software in other ways such as running a native executable you downloaded from somewhere, or following a "curl | sh" installation process as advocated by plenty of popular OSS tools, or allowing native software that you already installed to install arbitrary automatic updates that it fetches from remote sources.

The argument netsharc made was essentially that turning off JS would disable a lot of useful functionality for a lot of people, and that providing that functionality would still involve similar risks if it were done some other way. The reply from mikegerwitz argued that JS is different, but I still don't see how. The relevant comparison isn't against just turning JS off, it's against turning JS off and implementing the same functionality some other way, and compared to the sandboxed environment of JS, the most likely alternatives with today's technology would be even worse in terms of security and privacy.

Re: Websites can now fingerprint a device when multiple browser instances are used

#144

Post by xkxx »

mirimir wrote: post #34
xkxx wrote: post #17

Earlier quoted context omitted.

Hmm, a good idea would be to make it possible to use Tor Browser without Tor, for those who don't need strong anonymity, but still want to resist browser fingerprinting.

That's not very hard.[0] > If you intend to test for leaks using other third-party sites, I recommend using Tor browser, because it's been hardened to block WebGL fingerprinting, and otherwise to report the same fingerprints for all users. But you obviously don't want to use Tor while testing your VPN. First, download Tor browser for your OS. Do that with your VPN connected, so your ISP doesn't see. After extracting,…

Nice. I didn't know it was that easy. Using Tor Browser + VPN is definitely a good idea. Especially, if you don't want to be constantly solving captchas because of those hosts who don't trust Tor exit nodes. Some hosts even ban all Tor exit nodes altogether, duh.

Re: Websites can now fingerprint a device when multiple browser instances are used

#145

Post by mikegerwitz »

Silhouette wrote: post #143
omginternets wrote: post #66

Earlier quoted context omitted.

>It really doesn't. There are severe limits on what JS downloaded from some random site can do via a browser on your local device. That's missing the point. With respect to tracking a user, most of those restrictions don't matter. Your browser does download/execute untrusted, unsigned, arbitrary, ephemeral code that can do any kind of tracking it wants.

And compared to the kinds of technologies used for copy protection and telemetry in native applications, what JS can do within a browser is still very limited. Yes, the browser executes JS code from untrusted sources, but only if you visit a page that loads scripts from those sources, and always (barring security bugs) within a sandbox that limits their capabilities. I fail to see how this can possibly be any worse t…

> compared to the kinds of technologies used for copy protection and telemetry in native applications

Compared to the damage a logging truck can do to my car, a snow plow is very limited. I still don't want to be hit by a snow plow.

The threats to privacy posed by JS are severe and constantly evolving. Being able to profile based on hardware is effectively breaking the sandbox.

> (barring security bugs)

Which are far from uncommon. But you can't predicate a security discussion with the phrase "barring security bugs".

> I fail to see how this can possibly be any worse than installing software in other ways such as running a native executable you downloaded from somewhere, or following a "curl | sh" installation process as advocated by plenty of popular OSS tools, or allowing native software that you already installed to install arbitrary automatic updates that it fetches from remote sources.

Each of these requires explicit user authorization at some point (barring malicious operating systems). In the case of automatic updates, the initial install required user consent.

That isn't the case on the Web when you click on some random link I send you and automatically download and execute a program.

Re: Websites can now fingerprint a device when multiple browser instances are used

#146

Post by Silhouette »

mikegerwitz wrote: post #145
Silhouette wrote: post #143

Earlier quoted context omitted.

And compared to the kinds of technologies used for copy protection and telemetry in native applications, what JS can do within a browser is still very limited. Yes, the browser executes JS code from untrusted sources, but only if you visit a page that loads scripts from those sources, and always (barring security bugs) within a sandbox that limits their capabilities. I fail to see how this can possibly be any worse t…

> compared to the kinds of technologies used for copy protection and telemetry in native applications Compared to the damage a logging truck can do to my car, a snow plow is very limited. I still don't want to be hit by a snow plow. The threats to privacy posed by JS are severe and constantly evolving. Being able to profile based on hardware is effectively breaking the sandbox. > (barring security bugs) Which are far…

The threats to privacy posed by JS are severe and constantly evolving.

What exactly are the big threats you see here?

Yes, JS can be used to track whether the same computer is being used to visit different web sites. But there are other tracking techniques based on other web technologies that are also very accurate and require no cooperation from JS in the browser. The ultimate risk is the same in both cases: being tracked from one web site to another, and therefore potentially identified in real life if the other data held by those web sites in combination is sufficient to remove anonymity.

As I've said elsewhere in this discussion, I'd be the first to agree that this is undesirable, and that we should try to do something about it by limiting the access that is available by default and now being exploited for unintended purposes. I just don't see that the general risk is unique to JS or that JS is qualitatively worse in the danger than other web or general software technologies.

Each of these requires explicit user authorization at some point (barring malicious operating systems). In the case of automatic updates, the initial install required user consent.

Again, how is this any different to giving a user a link to a web site, which they then choose to follow? If you want to use some interactive functionality, how does it make the slightest bit of difference whether you're trusting JS code that runs directly or indirectly from a web site you voluntarily visit, scripts that run directly or indirectly via a script you curl|sh, or whatever is in some executable that you download and run? There is an inherent element of trust in all of these cases, and unscrupulous actors have betrayed that trust with nasty results in all of these cases. Again, I'm not saying the situation with JS is good, I'm just saying it's not significantly different to the situation with other current technologies that might be used to provide similar functionality in alternative ways.

Re: Websites can now fingerprint a device when multiple browser instances are used

#147

Post by navs »

rsync wrote: post #121
rxlim wrote: post #109

I have been browsing the web without Javascript enabled since 2006. The worst is that once in a while you will click on a link to read some text, but arrive at a completely blank page. Many times this can be solved by disabling CSS for that page or using the Google cache, but it's still annoying. I my view requiring Javascript just to display text or pictures is completely brain-dead, web "designers" that think this…

I use ublock origin with chrome. Do I understand correctly that the simple tool to block javascript (noscript) is not available on chrome ? I'd like to disable javascript but the non-noscript recipes seem very complex ...

Chrome allows you to enable/disable javascript on a per domain basis. It's not an extension or very flexible but I've found it useful for most situations e.g whitelisting js for my bank website.

Re: Websites can now fingerprint a device when multiple browser instances are used

#148

Post by navs »

osoba wrote: post #8

Random idea: Couldn't browsers have two modes of browsing, one lightweight one where only the most basic of JS features are enabled by default (this is something that 99% of websites actually need) and the full version where everything is enabled. The lightweight one is the default state and the users can manually switch to full version. Or even better use logistic regression or a neural network to decide when a webs…

To me a typical web developer uses HTML, CSS and simple javascript limited to basic dom manipulation, maybe a sprinkle of ajax. All of which can degrade gracefully for the non-js browsing user (lite javascript maybe?)

Then again, seeing what's trending and the topics of many bootcamp courses, I see that is moving towards SPAs which are all just JS (non-lite javascript)

As a web developer I can see that introducing a painful troubleshooting process, lots of confused jira tickets (explaining caching is bad enough).

It would be nice to simply have websites that can function within the scope of light javascript functin without it at all. For those that have the complex JS, well they get a bren experience but a browser notice that informs them why. Chrome does part of this with a whitelist JS feature. Now if only it were as noticeable as the click to play flash feature is.

Re: Websites can now fingerprint a device when multiple browser instances are used

#149

Post by Sophira »

rsync wrote: post #124
sleepychu wrote: post #2

Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can. When we get to critical mass, the advertising networks will come back with a new deal. I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us?

"Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can." For the fourth or fifth time this year, in response to a thread about browser privacy, I am reminded that what I really want is the ability to jail/chroot a browser. Firing up a full-blown VM for a browser ("banking profile", "twitter profile", "sketchy online store profile") is way too heavyweight and resource i…

You actually can do something like this with Firefox. If you load Firefox with the "-ProfileManager" switch (and you don't have another Firefox window open; see below for how to get round this), it'll open a window where you can choose your user profile. You can create and delete profiles from there, and a new profile is exactly the same as a completely new browser installation. (This includes any settings you may have for automatic browser updates; if you've turned these off on your normal profile, the first thing you should do on the new profile is turn off the automatic browser updates again, as browser updates are global and not per-profile.)

If you like, you can uncheck the "Use the selected profile without asking at startup" checkbox to have the window show up every time you start Firefox (which is defined as loading Firefox when there's no Firefox window already open). Doing this has the additional side benefit that if an application tries to open Firefox and load a new URL when you don't have any Firefox windows open, you'll be alerted to it by the Choose User Profile box - very useful if your normal profile takes a long time to load!

If you want, you can add the "-no-remote" switch to tell a new Firefox process not to connect with any existing one, which will allow you to open a new profile in a different browser window while you've still got the original running in other windows. However, those windows will share the same taskbar grouping, so I'd recommend you apply a different theme to the new profile to allow you to distinguish the two.

(Note: You should not use "-no-remote" by default, as a browser profile can only be open by one process at a time and you won't be able to open new windows through your shortcut icon.)

Of course, none of this will defeat the multiple-browser fingerprinting techniques mentioned in the article, but it's still incredibly useful.

I'm not sure if there's an equivalent in Chrome, or at least one that goes as far as Firefox does.

Re: Websites can now fingerprint a device when multiple browser instances are used

#150

Post by [deleted] »

Sophira wrote: post #149
rsync wrote: post #124

Earlier quoted context omitted.

"Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can." For the fourth or fifth time this year, in response to a thread about browser privacy, I am reminded that what I really want is the ability to jail/chroot a browser. Firing up a full-blown VM for a browser ("banking profile", "twitter profile", "sketchy online store profile") is way too heavyweight and resource i…

You actually can do something like this with Firefox. If you load Firefox with the "-ProfileManager" switch (and you don't have another Firefox window open; see below for how to get round this), it'll open a window where you can choose your user profile. You can create and delete profiles from there, and a new profile is exactly the same as a completely new browser installation. (This includes any settings you may ha…

[deleted]
Post reply on HN