Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#1

Post by sohkamyung » Tue, Apr 09, 2019, 2:12 PM UTC

Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta
blog.mozilla.org

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#2

Post by bluedino » Tue, Apr 09, 2019, 3:12 PM UTC

Kind of a shame that I can't browse that site using a VPS on a tier-2 VPS provider (Vultr)

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#3

Post by mzo123231 » Tue, Apr 09, 2019, 3:12 PM UTC

I love all the new features that Firefox has been coming out with. They understand their users perspective.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#4

Post by syoc » Tue, Apr 09, 2019, 3:13 PM UTC

I really welcome Mozilla's effort in fighting the uphill battle against browser fingerprinting. I am however very interested in the terms of Mozilla's partnership with Disconnect. Are obsoleting their add-on for Firefox out of the good of their hearts?

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#5

Post by SECProto » Tue, Apr 09, 2019, 3:13 PM UTC

Great! I look forward to these protections being included by default in the future, as they allude to.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#6

Post by empath75 » Tue, Apr 09, 2019, 3:14 PM UTC

Seems like they're just using a blacklist? Those seem to be able to be gamed pretty trivially.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#7

Post by notyourwork » Tue, Apr 09, 2019, 3:16 PM UTC

bluedino wrote: post #2

Kind of a shame that I can't browse that site using a VPS on a tier-2 VPS provider (Vultr)

Can you elaborate on why you cannot browse that site? From your comment it is not clear to me what the problem is but it reads as if you are trying to blame mozilla.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#8

Post by gbrindisi » Tue, Apr 09, 2019, 3:18 PM UTC

I do appreciate the feature!

But how feasible would be to limit the amount of info retrievable from the JS layer instead than relying on a black list of domains serving fingerprinters?

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#9

Post by groovybits » Tue, Apr 09, 2019, 3:20 PM UTC

syoc wrote: post #4

I really welcome Mozilla's effort in fighting the uphill battle against browser fingerprinting. I am however very interested in the terms of Mozilla's partnership with Disconnect. Are obsoleting their add-on for Firefox out of the good of their hearts?

If I'm not mistaken, Firefox's currently built-in Tracking Protection also borrows from the base Disconnect blocking lists. So this would not be the first time they've used them.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#10

Post by rubbingalcohol » Tue, Apr 09, 2019, 3:22 PM UTC

empath75 wrote: post #6

Seems like they're just using a blacklist? Those seem to be able to be gamed pretty trivially.

Agreed. Setting up blacklists is just whack-a-mole. I'd be more interested in detection of actual fingerprinting techniques, such as system font enumeration using canvas, or WebGL GPU fingerprinting. It would be technically possible to detect the creation of WebGL or canvas contexts that aren't actually rendered in the layout and prevent data gathered from those contexts from being sent in any XHR payload. I'm sure that's a lot of work.

Maybe it would be better to find the worst offending JS APIs and demand a user consent step similar to webcam or notifications in order for the scripts to run at all.