Live data from Hacker News

Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

zdnet.com

51–60 of 216 posts

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#51

What's the canvas fingerprinting one do? From what I (very poorly) understand, Tor returns a constant number for fingerprint requests. Can this be done for other requests?

It prompts the user to decline a site from accessing data from the Canvas API. This data can uniquely identify the user's computer. The Firefox feature is identical to the one from the Tor Browser.

Screenshot: https://thehackernews.com/2017/10/canvas-browser-fingerprint...

https://www.torproject.org/projects/torbrowser/design/ (see the "HTML5 Canvas Image Extraction" section)

https://gitweb.torproject.org/tor-browser.git/commit/?h=tor-...

https://developer.mozilla.org/en-US/docs/Web/API/Canvas_API

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#52
post #19

Earlier quoted context omitted.

reCAPTCHA is a Google thing so it gets blocked in my browser already anyway (by uMatrix). If I need to load it to see a website, I close the tab immediately and go somewhere else.

You need reCAPTCHA to log into HN (or at least I do when I'm working from some parts of the middle east)

Sounds like you might have been going through some sort of proxy...

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#53
post #43

Earlier quoted context omitted.

I would actually really like an answer to this question, I’ve often thought about it!

Huh, I thought the original was a sarcastic question. In that case, let me explain: I keep a browser window open at all times. It is never full screen, because if it were full screen I wouldn't be able to see multiple windows at the same time. I keep my browsing window as close to 1024x768 as possible. In 2019, a lot of websites can't handle a browser window using a mere 75% of the laptop screen, so they either rende…

The privacy.resistFingerprinting option will always launch your browser at exactly 1000x1000 size. It's probably preferable to your script.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#54
post #49

Earlier quoted context omitted.

Yes. I'm in adtech. 60% of browsers are mobile/tablet which are already fixed. The rest are almost always fullscreen. Maybe 2% have non-standard sizes.

When you two say fullscreen, surely you mean maximized? I imagine a sizeable fraction of users don't even know how to fullscreen a window.

yes

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#55
post #47

Earlier quoted context omitted.

What CSS file did the browser fetch? The one for screens less than 500px wide? Or the one for screens that are 504px wide? There are a million ways to exfiltrate UI parameters through JS and CSS. It’s hard to both prevent that and still allow JS and responsive pages.

just grab them all... not a huge deal, they are so small.

Okay. Those different css files all specify different images on the server, depending on the media query. Are we downloading all those images as well?

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#56
post #32

Earlier quoted context omitted.

apps? do we consider websites apps now? but either way if you have the JS, CSS and HTML, you should know where to put elements. Are nyc (news yc com) people part of the problem?

What CSS file did the browser fetch? The one for screens less than 500px wide? Or the one for screens that are 504px wide? There are a million ways to exfiltrate UI parameters through JS and CSS. It’s hard to both prevent that and still allow JS and responsive pages.

right... developers suck, overall ( I could not reply to the comment below because nyc would not let me)

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#57
post #13

I recommend the privacy.resistFingerpriting about:config mentioned. It's been available for a while and does other things too, like changing your user agent.

Is there any reason this isn't on by default? I don't know exactly how it works, but to my understanding anti fingerprinting tech generally works better when everyone uses it (otherwise you stick out as the "anti fingerprinting" browser)

In addition to what other posters have said I noticed it hides timezone so messaging apps had timestamps which looked wrong because it thought I was somewhere else. Haven't used it in a while though so this may have been changed.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#58
post #20

Earlier quoted context omitted.

Havent they thought about not broadcasting the window size... wtf. We are doomed apparently.

Apps need it to determine where to place elements. If it wasn't you would still be able to reverse engineer it by sticking elements outside the viewport and seeing if they're hidden or not. Turns out anonymity is super freaking hard. :-/

Some would take enhanced privacy over properly-functioning sites. I wonder how broken sites would appear if the browser simply lied about such things.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#59

Every time there's something about online privacy with browsers, it's mostly Firefox or Safari. I wondered if Chrome had resisting fingerprinting on its radar (guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online), and I found this [1] confirming my guess (emphasis mine): > Since we don't believe it's feasible to provide some mode of Chrome that can truly prev…

There is a way to stop fingerprinting. That way is serving pages via distributed network (over a WoT or torrent-like thing).

All these other ways do is give people the illusion that they're safe from being tracked, when the reality is that they're tracked just the same, but by fewer people so the data is more valuable. This means that the money is centralizing around the actors with the most inexplicable methods of tracking; which are almost always the worst actors.

I hate it too, even though I'm not blameless. It's impossible to compete without a level playing field, and that playing field needs to be technically enforced, because otherwise we get region shopping and advertising / analytics models that push people to create intractable mechanisms so they can paper over how tracking fed into it.

For example, imagine a world where I'm bidding to show an ad to a visitor of nytimes.com. Now, I may not track the user, but if anyone is, they can incorporate what they know and sell that traffic back to me on a CPA model. All I see is the incoming traffic. I don't track anyone (wink, wink) but there is no difference.

In the long run this will either be solved one way or another, and all these online surveillance capitalism companies will crash and burn. Either we get a web with technical guarantees or we get a balkanized internet where every state makes their own weird laws about what is allowed or not.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#60

Earlier quoted context omitted.

Apps need it to determine where to place elements. If it wasn't you would still be able to reverse engineer it by sticking elements outside the viewport and seeing if they're hidden or not. Turns out anonymity is super freaking hard. :-/

> Apps need it to determine where to place elements. This determination can't be done client-side? In other words, if I resize the window, it's going to send the new size to determine where to place the elements in the "new" area?

Yes, but how do you keep the client from then sending that data to the server?
Post reply on HN