Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Virtual Machine Detection in the Browser (2019)

bannedit.github.io

Post reply on HN
Print view View original

91–98 of 98 posts

Re: Virtual Machine Detection in the Browser (2019)

#91

Post by gruez »

jmnicolas wrote: post #84
gruez wrote: post #78

Earlier quoted context omitted.

That wouldn't really help. The containers/VMs might be separated from each other, but they're running on the same hardware/software stack, so they'll behave the same should you decide to fingerprint it.

I meant for convenience since launching VM is part of the OS. Wouldn't every Qubes VM (whatever the underlying physical machine) return the same fingerprint? Something like VM Fedora version XXX running on Xen hypervisor.

Depends how they do 3d rendering. If it's passed through to the host gpu, then it's fingerprintable. If it's using some sort of software renderer that might be fine, but the performance is going to be garbage.

Re: Virtual Machine Detection in the Browser (2019)

#92

Post by Darkphibre »

colordrops wrote: post #51
Darkphibre wrote: post #28

Earlier quoted context omitted.

Ooof, yeah. I was trying to make a new, purely anonymized identity. Went through an anonymized bitcoin VPN with TOR on top. Registered an email through Protonmail. Pretty much no social media platform will accept Protonmail as an address without also having a phone number. Got banned from Discord within 3 hours, literally all I'd done was send three friend requests and join one discord. My IP was rotating and I then…

How did you get Bitcoin anonymously? It seems very difficult at least for US citizens.

Great question! I've heard that in-person cash exchange is your best bet, if you're wanting to be completely off the grid. There are services out there that can help with the exchange (early in Bitcoin, there was an escrow service in which you deposited cash into a savings account through an ATM, and an anonymous wallet would be credited with the appropriate Bitcoin). Not sure where that stands now.

Oh! But to your question: Mullvad VPN seems to be highly regarded, and has an option to configure a recurring payment that they (claim to) decouple from your identity. Their service even supports defining multi-hop routes.

And to be clear: My goal is to obfuscate my identity from malicious individuals (think: politician that wants to be kinky, but has to resort to online interactions during COVID lockdown, and wants to avoid both simple tracert IP identification as well as a potential password breach & leak of social media platform X). Hiding my identity from governments is not my goal, so trusting Mullvad was an acceptable risk assessment. I'd add additional layers if I wanted to be more anonymous.

My next step, when I get around to it, is to try to track down a cheap anonymous virtual host to SSL into... then at least I'll have a static IP. But I'd still be up a creek if they ever wanted to do two factor for some reason.

Re: Virtual Machine Detection in the Browser (2019)

#93

Post by Darkphibre »

oh_sigh wrote: post #57
Darkphibre wrote: post #28

Earlier quoted context omitted.

Ooof, yeah. I was trying to make a new, purely anonymized identity. Went through an anonymized bitcoin VPN with TOR on top. Registered an email through Protonmail. Pretty much no social media platform will accept Protonmail as an address without also having a phone number. Got banned from Discord within 3 hours, literally all I'd done was send three friend requests and join one discord. My IP was rotating and I then…

Did you drive 6 hours to a different city and wear a costume to buy the burner?

Hmm, no. I'm primarily interested in obfuscating easy-to-acquire identification. I'm not interested in avoiding law enforcement.

But, if you are a citizen in a country that would employ law enforcement against you due to your minority status, I might encourage that protocol.

Re: Virtual Machine Detection in the Browser (2019)

#94

Post by Darkphibre »

pksebben wrote: post #66
Darkphibre wrote: post #36

Earlier quoted context omitted.

It's just unfortunate that companies are employing precog future-crime concepts to what (should) be standard privacy approaches. And, to be clear, I'm not acting like someone I'm not. I'm forthcoming that I have an identity, and I'm even willing to prove that I'm a self-consistent individual. I'm acting like someone that has purchased a month-to-month phone, and have signed up for a free email account, and values the…

For my money, I can't help but think of people who have legitimate reasons for wanting privacy and how my relative lack thereof deprives them of it. For every one of us that has a well defined presence, it becomes that much easier to spot people who hide, and like you say, there are perfectly legitimate reasons to do so. I would venture out even and say that categorically, there are unjust laws that people should be…

Thank you so much. I was worried recounting my experience would be perceived much like the first person responded. It feels good to know there are those out there that get it.

May your holidays be safe and rejuvenating.

Re: Virtual Machine Detection in the Browser (2019)

#95

Post by chii »

pixl97 wrote: post #62
judge2020 wrote: post #23

Earlier quoted context omitted.

OP is just suggesting you vote with your 'wallet' by not using those sites - they're not saying you should stop complaining.

Bad actors generally win monitary contests. The entire vote with your wallet is a mostly disproven idea.

it merely points out the hypocrisy of those who complain, but continue to use said sites.

Re: Virtual Machine Detection in the Browser (2019)

#96

Post by 0xbkt »

colordrops wrote: post #51
Darkphibre wrote: post #28

Earlier quoted context omitted.

Ooof, yeah. I was trying to make a new, purely anonymized identity. Went through an anonymized bitcoin VPN with TOR on top. Registered an email through Protonmail. Pretty much no social media platform will accept Protonmail as an address without also having a phone number. Got banned from Discord within 3 hours, literally all I'd done was send three friend requests and join one discord. My IP was rotating and I then…

How did you get Bitcoin anonymously? It seems very difficult at least for US citizens.

You can buy Monero instead, and funnel it through xmr.to to pay in Bitcoins. Another alternative might be fixedfloat.com. Tested both, but you had better not exchange big amounts.

Re: Virtual Machine Detection in the Browser (2019)

#97

Post by zzo38computer »

twelvechairs wrote: post #56
userbinator wrote: post #2

quickly realized that some of the fingerprinting information could be useful for VM detection because vendor names were exposed. In this particular instance the string "VMWare" was contained within the WebGL information. After some more testing I also discovered that VirtualBox reported the same kind of information. I believe there are patches that can close those holes, but I've always found the fact that such infor…

> JS needs to be off by default and whitelisted only for the (very few) sites that one truly trusts. Or the information provided by JS regarding the local machine should be reduced

The user should have full control over everything. For example, if the user want to configure it so that all JavaScript time reporting reports that everything takes zero time, then that is what it should do in that case. If the user wants all timeouts to expire immediately (so that JavaScript-based animations will take zero time), that can also be done, then.

You should have enough ropes to hang yourself, and also a few more just in case.

Re: Virtual Machine Detection in the Browser (2019)

#98

Post by pksebben »

Wowfunhappy wrote: post #82
pksebben wrote: post #64

Earlier quoted context omitted.

I think the sane argument here is for sensible defaults. Leaving all those switches turned on is just opening the door for adtech. The set of information that's made available out of the box should be small, and if you need to access information about my graphics card, you can ask for it.

I think this only works if the average consumer can assess what is being asked for, though. “Do you want to let this website know what hardware you have?” is not a simple question. “What is hardware?” “Should I let a game know my hardware? Should I let a news website know my hardware?”

If one does not understand what they are being asked to consent to, they are incapable of giving informed consent.
Post reply on HN