Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Block Fingerprinting with Firefox

blog.mozilla.org

Post reply on HN
Print view View original

371–380 of 411 posts

Re: Block Fingerprinting with Firefox

#371

Post by vbezhenar »

Twirrim wrote: post #42
xvector wrote: post #15

Can someone paste their results (or at least bits of fingerprinting entropy) from https://panopticlick.eff.org with the latest Firefox? With the fancy new anti-fingerprinting Safari on macOS Mojave I get just over 14.5 bits of entropy with the most entropic source being my canvas fingerprint (1 in 600). With Safari on iOS I get 11.71 bits of entropy, with the most entropic value being my screen size and color depth.

Interestingly enough, uBlock Origin actually stops that site from working, seems to break the fingerprinting step. If i disable uBlock, I get 16.63 bits of identifying information. Likewise the canvas fingerprint is the biggest, in my case 1 in 101154.

This website works even with uBlock Origin with disabled JavaScript option. 9,81 bits for me.

Re: Block Fingerprinting with Firefox

#372

Post by vbezhenar »

xvector wrote: post #15

Can someone paste their results (or at least bits of fingerprinting entropy) from https://panopticlick.eff.org with the latest Firefox? With the fancy new anti-fingerprinting Safari on macOS Mojave I get just over 14.5 bits of entropy with the most entropic source being my canvas fingerprint (1 in 600). With Safari on iOS I get 11.71 bits of entropy, with the most entropic value being my screen size and color depth.

Firefox with uBlock Origin and JavaScript disabled: 9.81 bits, one in 900.21 browsers. Google Chrome with uBlock Origin: at least 17.68 bits, unique among the 209,744. iPhone 8, Safari, some adblocker: the same (unique). Probably I should update OS, I'm using pretty old version.

Re: Block Fingerprinting with Firefox

#373

Post by bluGill »

skybrian wrote: post #364
bluGill wrote: post #345

Earlier quoted context omitted.

Why do you assume they aren't automating it. The obvious thing if I'm a spammer is to hire humans to solve the problem, collect their output and feed it into my ML training. I now have the same dataset that google is using, for my ML. Actually I'm not sure I need to go to full ML: after a few rounds I can probably just use image compare (not ML) and just feed humans images that I haven't seen before. Of course round…

This is why Google will have to keep changing how the captchas work. Maybe using adversarial examples?

Which is why spammers will have humans in the backroom for the foreseeable future. If google tries something different they go to humans to figure it out, it google keeps doing it they automate it.

The game is more expensive for google because google needs expensive people to create the scheme, they can hire cheap people to figure it out. (if cheap people can't figure it out google has failed) They only need expensive people only if/when they decide to automate the scheme.

Re: Block Fingerprinting with Firefox

#374

Post by kakkksaknmdm »

emtel wrote: post #367
kakkksaknmdm wrote: post #321

I worked in the ad industry. Every web-browser including brave, tor,safari is uniquely identifiable even on same hardware. All the public computer researchers and browser vendors are years behind the techniques to fingerprint devices (probably 5+). Canvas, WebGl etc are techniques of the past. There are much more advanced ones, than can identify devices with completely uniquely (on both desktop and mobile) Also we kn…

In order to believe what you're claiming here, we have to believe that 1. There is magic css/js that can not only tell different browsers and devices apart, but can tell two phones from the same manufacturing run with the same software apart. 2. Despite the fact that this magic code would have to run in the client browser where its content, execution, and the data it sends back are all plainly visible to anyone who c…

Yes to all. Have a look if you want for a bit of evidence: This was one of the 10's of possible techniques that could identify devices uniquely among billions https://boingboing.net/2019/05/22/unique-device-fingerprints...

However the author of the paper could not get it to work on low end devices, whereas we could. And we discovered this around 2015.

Re: Block Fingerprinting with Firefox

#375

Post by kakkksaknmdm »

Laaas wrote: post #359
kakkksaknmdm wrote: post #321

I worked in the ad industry. Every web-browser including brave, tor,safari is uniquely identifiable even on same hardware. All the public computer researchers and browser vendors are years behind the techniques to fingerprint devices (probably 5+). Canvas, WebGl etc are techniques of the past. There are much more advanced ones, than can identify devices with completely uniquely (on both desktop and mobile) Also we kn…

Can you give any examples for the techniques used?

This is one that we knew of in 2015, and the public researchers just found out in 2019: https://boingboing.net/2019/05/22/unique-device-fingerprints...

Now we're waaay past this easy stuff to fake stuff. This now considered to be basic.

Look into distill networks, but their public product is very far behind what we did. Not sure if they have better tech to be used in future.

Re: Block Fingerprinting with Firefox

#376

Post by kakkksaknmdm »

flatb wrote: post #325
kakkksaknmdm wrote: post #321

I worked in the ad industry. Every web-browser including brave, tor,safari is uniquely identifiable even on same hardware. All the public computer researchers and browser vendors are years behind the techniques to fingerprint devices (probably 5+). Canvas, WebGl etc are techniques of the past. There are much more advanced ones, than can identify devices with completely uniquely (on both desktop and mobile) Also we kn…

Not to be picky, because to be honest I completely believe that what you say is plausible, but that's a lot of outrageous claims with very little in the way of examples or evidence.

This is what we knew of in 2015: https://boingboing.net/2019/05/22/unique-device-fingerprints... you can figure out where the industry is now yourself.

Re: Block Fingerprinting with Firefox

#377

Post by kakkksaknmdm »

TeMPOraL wrote: post #339
kakkksaknmdm wrote: post #321

I worked in the ad industry. Every web-browser including brave, tor,safari is uniquely identifiable even on same hardware. All the public computer researchers and browser vendors are years behind the techniques to fingerprint devices (probably 5+). Canvas, WebGl etc are techniques of the past. There are much more advanced ones, than can identify devices with completely uniquely (on both desktop and mobile) Also we kn…

As a service to the public, could you please share the state-of-the-art techniques used currently by the industry?

This was used publicly in around 2016, stopped using around 2017 when research showed even better ways that cannot be spoofed: https://boingboing.net/2019/05/22/unique-device-fingerprints...

Ours was more advanced then this. As far as I've read the paper cited on the source above, they are like 30% of ours tech POC back in 2015.

Re: Block Fingerprinting with Firefox

#378

Post by kakkksaknmdm »

vbezhenar wrote: post #369
kakkksaknmdm wrote: post #321

I worked in the ad industry. Every web-browser including brave, tor,safari is uniquely identifiable even on same hardware. All the public computer researchers and browser vendors are years behind the techniques to fingerprint devices (probably 5+). Canvas, WebGl etc are techniques of the past. There are much more advanced ones, than can identify devices with completely uniquely (on both desktop and mobile) Also we kn…

Just today I decided to switch to FF and try noscript experience. Works good enough so far. Funny that crippled experience is even better in some weird ways. I used to scroll reddit forums, now I can read just few first posts and that is good. I used to expand a lot of comments, now I can't expand them, but it saves time. Sure, self-control would be better, but that is good too :) It's good to know that without JavaS…

Wait for the new CSS version over which our team had a watch. Wont require JS after it comes out. ;D

Also we know many exploits to bypass noscript if we wanted to (yes I know there are bounties for this, but we were paid much higher then any public bounty for this stuff)

Re: Block Fingerprinting with Firefox

#379

Post by CRConrad »

Wowfunhappy wrote: post #342
godelski wrote: post #234

Earlier quoted context omitted.

tldr: drawings aren't pixel perfect. Longer: this is actually a viable way to do many types of fingerprinting, not just canvas. I'll give an example. In a graphics class I took our professor gave us output images to compare to. Two people with the same model computer, same specs, would frequently have a pixel or two different from one another. Change the specs and you're easily a dozen off. Worse than that, the pixel…

Random, probably uninformed thought: I wonder if the solution could be LESS determinism rather than more. If you could make it so the same hardware rendered pixels in a slightly different (random) way each time, it would no longer be possible to determine if you were looking at the same machine.

So just go with the uniform return value someone wrote Apple is going for with Safari: Return a pitch-black rectangle every time.

Re: Block Fingerprinting with Firefox

#380

Post by trehalose »

m_sahaf wrote: post #334
anonymfus wrote: post #289

Earlier quoted context omitted.

Well considering that Google already specifically blocks Chromium based Edge from its current YouTube version may be Recaptcha will not work in it soon too.

Not true.... https://twitter.com/ericlaw/status/1123993553070448651?s=20

Somebody over on reddit tested different user agents: https://www.reddit.com/r/google/comments/btysl9/google_have_....

It seems pretty clear from the fact that nonsense user agents like "TotallyNotMicrosoft" and "IE6" worked, that there is a blacklist, not a whitelist.

Post reply on HN