Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Block Fingerprinting with Firefox

blog.mozilla.org

Post reply on HN
Print view View original

391–400 of 411 posts

Re: Block Fingerprinting with Firefox

#391

Post by BlueTemplar »

ngokevin wrote: post #32
OJFord wrote: post #2

> You probably wouldn’t appreciate someone tracking your moves in real life. There’s no reason to accept it online. Great to read something like this on mozilla.org.

Kind of funny though, the vast majority of Mozilla's money comes from the ads and tracking industry, just one step removed.

Well, we could change that. I've subscribed for a monthly donation to Mozilla after learning about that.

I've also been giving through Flattr as an alternative to ads for micro-funding on the Web - anyone knows why their plugin/extension/addon isn't listed on addons.mozilla.org anymore ? (You can still install it from their official website.) Might it be due to a conflict of interest between Google and Eyeo ?

Re: Block Fingerprinting with Firefox

#392

Post by kakkksaknmdm »

SahAssar wrote: post #389
kakkksaknmdm wrote: post #378

Earlier quoted context omitted.

Wait for the new CSS version over which our team had a watch. Wont require JS after it comes out. ;D Also we know many exploits to bypass noscript if we wanted to (yes I know there are bounties for this, but we were paid much higher then any public bounty for this stuff)

As far as I understand the only way that it can work without without js is either by using @supports or similar feature/media queries (which would be the same for all users on the same hardware and browser) or by requiring user interaction (like a :hover state or clicking a link).

>Latest methods dont even use JavaScript. Just CSS is enough to identify every device uniquely but you'd need JS to send the data back.

Re: Block Fingerprinting with Firefox

#393

Post by kakkksaknmdm »

pushcx wrote: post #387
kakkksaknmdm wrote: post #341

Earlier quoted context omitted.

No, not this is some amateur work. State of the art techniques css fingerprinting can uniquely identify 1 device from billions. Also this is nothing but getting dimension of screen and other browser attributes which are useless now. The current state of the art cannot be mitigated unless you put a 95% penalty on performance on the CSS engine AFAIK.

The old link you keep pasting does not support this or your other hyperbolic assertions. Stop dangling claims of secret superpowers or support them.

Have a read: https://www.ieee-security.org/TC/SP2019/papers/405.pdf

Re: Block Fingerprinting with Firefox

#394

Post by SahAssar »

kakkksaknmdm wrote: post #392
SahAssar wrote: post #389

Earlier quoted context omitted.

As far as I understand the only way that it can work without without js is either by using @supports or similar feature/media queries (which would be the same for all users on the same hardware and browser) or by requiring user interaction (like a :hover state or clicking a link).

>Latest methods dont even use JavaScript. Just CSS is enough to identify every device uniquely but you'd need JS to send the data back.

You said:

> Wait for the new CSS version over which our team had a watch. Wont require JS after it comes out. ;D

So how does that work considering what I said above?

Re: Block Fingerprinting with Firefox

#395

Post by kakkksaknmdm »

SahAssar wrote: post #394
kakkksaknmdm wrote: post #392

Earlier quoted context omitted.

>Latest methods dont even use JavaScript. Just CSS is enough to identify every device uniquely but you'd need JS to send the data back.

You said: > Wait for the new CSS version over which our team had a watch. Wont require JS after it comes out. ;D So how does that work considering what I said above?

Why would I want to give out that part completely? Upcoming spec change has two important thing required that will allow it to work without JS or user interaction with the page. Obviously I'm not going to give it away before the spec is implemented and once it gains enough usage on the web that going back is impossible.

Re: Block Fingerprinting with Firefox

#396

Post by SahAssar »

kakkksaknmdm wrote: post #395
SahAssar wrote: post #394

Earlier quoted context omitted.

You said: > Wait for the new CSS version over which our team had a watch. Wont require JS after it comes out. ;D So how does that work considering what I said above?

Why would I want to give out that part completely? Upcoming spec change has two important thing required that will allow it to work without JS or user interaction with the page. Obviously I'm not going to give it away before the spec is implemented and once it gains enough usage on the web that going back is impossible.

So basically you have no proof, no discernible connections to anything you are talking about (no real user/comment history) and are posting pretty outrageous claims about tracking.

Why would I believe you over all the public research available? If you really were working on this why would you be stupid enough to post about it here?

Re: Block Fingerprinting with Firefox

#397

Post by Drdrdrq »

ngokevin wrote: post #146
Drdrdrq wrote: post #48

Earlier quoted context omitted.

Yes, but that is just because they represent a risk for Google. Their incentives are quite different than Google's, and that is what matters.

Not as much as risk. More of not wanting to be seen as a monopoly. Giving up 1% of the browser market share and a few pennies is worth it to not be seen as the virtual dictator of the Web.

Also true.

Re: Block Fingerprinting with Firefox

#399

Post by dhimes »

lstamour wrote: post #385
klez wrote: post #322

Earlier quoted context omitted.

I see that your heart is in the right place, but I think as web developers we should take a blood oath that we will always optimize for standard compliance, instead. And for a standard that is not a moving target, while we're at it.

But when do we move on? When most browsers implement something the same way, or when all do? What about polyfills? What do you do when you need a new API to better support a user's device with a new form factor, interaction model, wide colour gamut, resolution, background threads, etc.? Tell them to not upgrade? Stop the world? It seems impractical to suggest "target a standard: job done, go home..."

If we target standards, then the standards are driving. The browser gets supported when it builds to the standards. Perhaps the issue will then be getting standards in place quickly around new capabilities?

Then maybe the standards process needs disruption. But if we don't build to standards then we are building roads that only certain cars can drive.

Re: Block Fingerprinting with Firefox

#400

Post by tinus_hn »

clairity wrote: post #134
ChrisSD wrote: post #112

Earlier quoted context omitted.

Well if HN users do want to try to lessen that percentage here's the donation page: https://donate.mozilla.org/

i wonder why mozilla hasn't tried a premium pricing model? the premium version of firefox could have a yearly subscription of, say, $24. it would have all privacy features turned on, the best privacy addons installed, and all analytics/telemetry turned off, by default. i would even pay a whole $3/month for that! =D

They don’t want that but you are free to do so yourself, it’s free software.
Post reply on HN