Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Block Fingerprinting with Firefox

blog.mozilla.org

Post reply on HN
Print view View original

381–390 of 411 posts

Re: Block Fingerprinting with Firefox

#381

Post by clubm8 »

philpem wrote: post #287
rum3 wrote: post #283

Earlier quoted context omitted.

Cloudflare must be mentioned when talking about recaptcha and cancer. They are the ones locking people out from whole websites and forcing you to fill out these recaptchas. They are also the ones who have almost destroyed browsing the internet using TOR due to these recaptchas.

While I agree with you -- I'd also like to point out that >90% of malicious traffic to the websites I administer comes through the Tor network. It shouldn't be the case, and I don't want to block people who have a legitimate reason to use Tor. Unfortunately there isn't a "block Tor traffic from assholes" option, so all I can really do to reduce the malicious traffic is block exit nodes.

Is the issue Tor traffic, or that you know what traffic is Tor?

There are many types of "abuse" (not just trolling) - mass downloading/scanning. (Ex: several types of port scanning can't be done via Tor since it doesn't support UDP)

Re: Block Fingerprinting with Firefox

#382

Post by trehalose »

klez wrote: post #323
anonymfus wrote: post #289

Earlier quoted context omitted.

Well considering that Google already specifically blocks Chromium based Edge from its current YouTube version may be Recaptcha will not work in it soon too.

Google is not blocking edge, or at least we have no proof of that. In this instance I think it's safe to assume an oversight based on naive user agent whitelisting. And before I get accused of shilling, I hate chrome and despise Google with a passion.

As I responded to a comment just below this one, somebody over on reddit tested different user agents: https://www.reddit.com/r/google/comments/btysl9/google_have_....

It seems pretty clear from the fact that nonsense user agents like "TotallyNotMicrosoft" and "IE6" worked, that there is a blacklist, not a whitelist.

Re: Block Fingerprinting with Firefox

#383

Post by godelski »

Wowfunhappy wrote: post #342
godelski wrote: post #234

Earlier quoted context omitted.

tldr: drawings aren't pixel perfect. Longer: this is actually a viable way to do many types of fingerprinting, not just canvas. I'll give an example. In a graphics class I took our professor gave us output images to compare to. Two people with the same model computer, same specs, would frequently have a pixel or two different from one another. Change the specs and you're easily a dozen off. Worse than that, the pixel…

Random, probably uninformed thought: I wonder if the solution could be LESS determinism rather than more. If you could make it so the same hardware rendered pixels in a slightly different (random) way each time, it would no longer be possible to determine if you were looking at the same machine.

That's an interesting idea. It might be a good way to circumnavigate this problem. But there are some drawbacks. Maybe there's a lot of things we could get away with actually needing FP16 accuracy (like iterative methods can sometimes do this, especially in ML) but call FP32 but there's plenty of times where FP32 matters. So I guess it is highly dependent upon those issues and where you can get away with them. But further, how do you enforce that? I think it is interesting though.

Re: Block Fingerprinting with Firefox

#384

Post by Wowfunhappy »

akerro wrote: post #252
skybrian wrote: post #183

Earlier quoted context omitted.

Ok, that makes sense. Not ideal, but captchas need to be written somehow.

Modern captchas are designed to be anti-human and use as for free training of their AI algorithms. We're slaves for free while Google benefits from this, both technologically and financially. Next captcha from google will be even more aggressive, you're not logged to Google = you're a bot, you can't access that content.

I agree that this is terrible, but what is your alternative? I can't come up with one.

Re: Block Fingerprinting with Firefox

#385

Post by lstamour »

klez wrote: post #322
dhimes wrote: post #314

Earlier quoted context omitted.

As developers we should take a blood oath that we will always optimize for Firefox.

I see that your heart is in the right place, but I think as web developers we should take a blood oath that we will always optimize for standard compliance, instead. And for a standard that is not a moving target, while we're at it.

But when do we move on? When most browsers implement something the same way, or when all do? What about polyfills? What do you do when you need a new API to better support a user's device with a new form factor, interaction model, wide colour gamut, resolution, background threads, etc.? Tell them to not upgrade? Stop the world? It seems impractical to suggest "target a standard: job done, go home..."

Re: Block Fingerprinting with Firefox

#386

Post by AnaniasAnanas »

philpem wrote: post #290
atoav wrote: post #260

Earlier quoted context omitted.

I had simple questions you can answer with text on my site for years, and I had no spam problem whatsoever. I am not convinced that training google’s image recognition algorithms is the only way to solve the captcha problem

I have one which picks a bunch of random single-digit numbers and a math operator, then asks you to type the result. I spent days trying it out with screen readers and tweaking it to work with as many as possible.

I had a lot of spam when I tried that. Questions of knowledge were more successful.

Re: Block Fingerprinting with Firefox

#387

Post by pushcx »

kakkksaknmdm wrote: post #341
user32556 wrote: post #335

Earlier quoted context omitted.

Are you talking about CSS-based fingerprinting? https://browserleaks.com/css#explanation

No, not this is some amateur work. State of the art techniques css fingerprinting can uniquely identify 1 device from billions. Also this is nothing but getting dimension of screen and other browser attributes which are useless now. The current state of the art cannot be mitigated unless you put a 95% penalty on performance on the CSS engine AFAIK.

The old link you keep pasting does not support this or your other hyperbolic assertions. Stop dangling claims of secret superpowers or support them.

Re: Block Fingerprinting with Firefox

#388

Post by kgwxd »

stockkid wrote: post #281
kgwxd wrote: post #198

Earlier quoted context omitted.

I haven't had an issue, but I avoid "major websites" like the plague, as they are the modern equivalent (though measles is making a comeback). If a site breaks with good privacy settings, it's a decent indicator you're better off not visiting. If a breaking site shows up on my radar too much, I add the domain to an add-on I made to hide links to it on any page. My HN/reddit/search results/etc views usually have a few…

> I add the domain to an add-on I made to hide links to it on any page. That sounds interesting. Have you published it or made source available? I'd love to try.

I published it [1], but only because I had to in order to use it without adding and approving it every time I started Firefox :/ I originally thought I had made the source available but eventually realized the code repo on Mozilla was only available to me (not sure what the point of that is). You just inspired me to get it up on github [2].

It's a pain to configure but the example JSON in the "Preferences" section of the add-on should be enough to get started. Just paste it into the textarea, save, then visit HN or Reddit, you'll probably see a few blank lines where links should be.

Right now, the top post on HN is a WSJ link. I don't want to see their links because I don't ever want to click them just to hit a paywall I already know I'll never accept. So my HN page looks like this [3].

The tool uses regular expressions on text and element attribute values. Anything that matches gets a given CSS style applied. I think it would be great if uBlock Origin could do this but it doesn't allow the level of granularity needed to accomplish the end result.

[1] https://addons.mozilla.org/en-US/firefox/addon/ssure/

[2] https://github.com/7w0/ssure

[3] https://i.imgur.com/pEV50xr.jpg

Re: Block Fingerprinting with Firefox

#389

Post by SahAssar »

kakkksaknmdm wrote: post #378
vbezhenar wrote: post #369

Earlier quoted context omitted.

Just today I decided to switch to FF and try noscript experience. Works good enough so far. Funny that crippled experience is even better in some weird ways. I used to scroll reddit forums, now I can read just few first posts and that is good. I used to expand a lot of comments, now I can't expand them, but it saves time. Sure, self-control would be better, but that is good too :) It's good to know that without JavaS…

Wait for the new CSS version over which our team had a watch. Wont require JS after it comes out. ;D Also we know many exploits to bypass noscript if we wanted to (yes I know there are bounties for this, but we were paid much higher then any public bounty for this stuff)

As far as I understand the only way that it can work without without js is either by using @supports or similar feature/media queries (which would be the same for all users on the same hardware and browser) or by requiring user interaction (like a :hover state or clicking a link).

Re: Block Fingerprinting with Firefox

#390

Post by hombre_fatal »

Anarch157a wrote: post #366
CaptainZapp wrote: post #267

Earlier quoted context omitted.

Next captcha from google will be even more aggressive, you're not logged to Google = you're a bot, you can't access that content. You may be right. But you know what: If I encounter captchas nowadays and unless I really need to get to that site it's "Fuck you very much!" time. I'm just not that interested in most of the web to make it woth my while and provide free work for Google.

I cancelled my subscription and deleted Spotify because of that. I can do with streaming of local radio and my own music. I really hope the EU hits them hard with a GDPR investigation, the amount of identifiable data they collect with reCaptcha is unacceptable.

Some strong statements in these comments on a website with registration and login protected by Google's ReCaptcha. :)
Post reply on HN