81–90 of 207 posts
Sandboxing with randomisation is what we need. Like a VM or a container to launch a browser. A canvas fingerprint needs to be different everytime it's calculated.
The sandboxing part exists: https://addons.mozilla.org/en-US/firefox/addon/multi-account... Not sure if it randomizes things like audio or canvas fingerprints, though.
I'm using these four Firefox addons in addition to uBlock Origin and Cookie AutoDelete: (Canvas|WebGL|AudioContext|Font) Fingerprint Defender They report and seem to block fingerprinting attempts. https://addons.mozilla.org/en-US/android/addon/canvas-finger... https://addons.mozilla.org/en-US/android/addon/webgl-fingerp... https://addons.mozilla.org/en-US/android/addon/audioctx-fing... https://addons.mozilla.org/en-U…
I may be wrong, but these add-ons seem shady to me. The website pointed to as the homepage is an add-ridden site that is supposedly a community for open-source development, but all the links to 'fork me on GitHub' don't go anywhere. I can't find the source at all. This topic comes up often but these have never been posted and the add-ons have relatively few users (4k, 1.5k, 2k and 0.7k). I don't know anything about b…
Earlier quoted context omitted.
But here's the thing - it does cost money and customers to properly authenticate people. 2FA will lead to less sign ups but it will give you a more secure user base - in a world where DAU is the number to live and die by then security is compromised in order to help float that DAU stat. For sign-ons collect a per account activation fee or subscription fee - if your goal is to only have real users then enforce that wi…
Like many things in life, the fight between good actors and bad actors online is a state of dynamic equilibrium. Everybody loses money to fraud, but as long as they invest enough money and resources they can keep those fraud losses to an acceptable level. Because criminals are infinitely creative, the problem will never be "solved." There will always be new moves and new countermoves. Total security is an illusion. E…
This is essentially equivalent to a tragedy of the commons mixed in with a race to the bottom - companies are currently penalized for practicing good security, they are voluntarily accepting lower profit margins in exchange for something nobody cares about, they're also losing access to some supplemental revenue through reselling customer data. If we add decent incentives and make it economical to follow a "good" path we can increase our baseline of security, hacks will always happen but we can minimize the costs of those hacks and their frequency with best practices.
Heck - my standard line with companies w.r.t. PII is that "Your proposal is essentially to collect everyone's alarm code into your safe, your safe has gone from something nobody is interested in to something that, if compromised, could lead to a bunch of people being burglarized." the issue is that over-collecting PII and then, shucks, losing it in that completely unavoidable security compromise, doesn't lead to appreciable punishment for the company - in the real world it sure does (if your locksmith copies your key an extra time then gets burglarized and the burglar uses that extra key to burgle your house the locksmith is absolutely liable and may be found to be a conspirator). It's anomalous that these two worlds are in contrast.
All that said, I absolutely agree that it's a balance and there aren't super simple answers here, but it's important to reject the thought that being as vulnerable as most businesses are is acceptable.
I'm using these four Firefox addons in addition to uBlock Origin and Cookie AutoDelete: (Canvas|WebGL|AudioContext|Font) Fingerprint Defender They report and seem to block fingerprinting attempts. https://addons.mozilla.org/en-US/android/addon/canvas-finger... https://addons.mozilla.org/en-US/android/addon/webgl-fingerp... https://addons.mozilla.org/en-US/android/addon/audioctx-fing... https://addons.mozilla.org/en-U…
I may be wrong, but these add-ons seem shady to me. The website pointed to as the homepage is an add-ridden site that is supposedly a community for open-source development, but all the links to 'fork me on GitHub' don't go anywhere. I can't find the source at all. This topic comes up often but these have never been posted and the add-ons have relatively few users (4k, 1.5k, 2k and 0.7k). I don't know anything about b…
If you're using Firefox, consider using the CanvasBlocker add-on to reduce the effectiveness of canvas fingerprinting. https://addons.mozilla.org/en-US/firefox/addon/canvasblocker https://github.com/kkapsner/CanvasBlocker
Just enable privacy.resistFingerprinting in about:config, no addons needed
https://wiki.mozilla.org/Security/Fingerprinting
For example, new Firefox windows will no longer open maximized, and users who prefer maximized browser windows would need to maximize them manually.
> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…
> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…
99% of websites we visit do not need canvas or sound. And the few websites that do can explain why you should click "Allow" when they prompt you for access. What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things? I suppose one reason is that you would immediately unleash opt-in spam on your users that don't know what these pop-ups…
You missed it, this doesn't require an Allow, because it's not actually accessing the microphone. It's using the audio APIs to generate a waveform, and depending on your computer/DSP, the waveform will be slightly different. It's not using any of your computers sensors
Earlier quoted context omitted.
I've tried using addons like uMatrix in the past and always gave up, but this just convinced me to deal with the (minor-ish) annoyance they add. Canvas fingerprinting is somewhat well-known and there are browser extensions to block it. But if TikTok is doing audio fingerprinting then you can bet FB, Google, and everyone else are doing it too. JS is too feature-rich to be safely used & allowed.
I haven't found a way to block canvas fingerprinting. For some reason, I haven't been able to default to block in firefox. Even with CanvasBlocker the "check your fingerprint" sites still show a unique fingerprint (but canvasblocker has a ton of really obscure options that I don't understand)
It always be unique, because it's randomly generated. But every visit will have a completely different unique value, which means that the fingerprint from the canvas is a useless value.
> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…
I've tried using addons like uMatrix in the past and always gave up, but this just convinced me to deal with the (minor-ish) annoyance they add. Canvas fingerprinting is somewhat well-known and there are browser extensions to block it. But if TikTok is doing audio fingerprinting then you can bet FB, Google, and everyone else are doing it too. JS is too feature-rich to be safely used & allowed.
if (navigator.mediaDevices) navigator.mediaDevices.enumerateDevices = undefined;