Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser Fingerprinting Without JavaScript

fingerprintjs.com

Post reply on HN
Print view View original

51–60 of 124 posts

Re: Browser Fingerprinting Without JavaScript

#51

Post by djbusby »

zarzavat wrote: post #43
DenseComet wrote: post #40

Earlier quoted context omitted.

More permissions are not the right answer. Too many and users get conditioned to blindly clicking accept.

Users do not always click yes reflexively. I filled in a form recently that asked "Do you consent for us to send you marketing emails" (default unchecked), and I laughed because I could not imagine why they expended engineering effort to ask that question and store the answer when almost nobody will check it. It depends how the question is framed and presented. If the permission prompt is modal and the user believes…

> Do you consent for us to send you marketing emails" (default unchecked)

I read that as Management (PHB) wanted that but some how the implementing engineer got them to do it the respectful way.

Re: Browser Fingerprinting Without JavaScript

#52

Post by noduerme »

onion2k wrote: post #11

Browsers should limit every webpage to displaying a maximum of two fonts, and should silently ignore any font face rules after the first two. Maybe three if you're feeling generous. With variable fonts available in every browser it wouldn't impact typography much. It would stop this sort of privacy attack, and it'd have the additional benefit of making the web look a lot nicer.

That's just insane. Sites and apps I build these days usually include FontAwesome and/or another icon library, frequently along with a custom dingbat font for the company's unique logos and iconography (we bundle all relevant vector art as a font). Then you have primary and secondary brand fonts, along with sometimes readability fonts. Not to mention iframed forms coming off credit card gateways. I have no idea how a proposal like this could be implemented, but it definitely would destroy most modern layouts.

Re: Browser Fingerprinting Without JavaScript

#53

Post by noduerme »

getcrunk wrote: post #25
wbobeirne wrote: post #13

Earlier quoted context omitted.

This feels like it's targeted at a very narrow view of what a browser is for. How would a site like fonts.google.com work?

Easy. The limit should be for 2 fonts, unless you load them your self

You don't seem to realize that the fingerprinting has nothing to do with what fonts you load from a page. It's what fonts you have installed on your machine.

Re: Browser Fingerprinting Without JavaScript

#54

Post by 0xdeadb00f »

robbedpeter wrote: post #49
anonypla wrote: post #29

Earlier quoted context omitted.

The "Safest" mode gives me different fingerprints each time. The "Standard" and "Safer" modes give the same fingerprint tho.

So how crippled does regular web browsing become using Tor safest mode? I'm tempted to give it a whirl for a week. Root my phone, flash something secure, leave VPN always on, and limit web browsing to Tor to get a feel for how bad or good it is. The self inflicted contortions developers go through to justify the need to spy drive me crazy. Modern devices and bandwidth are more than sufficient to handle a vast majorit…

Rooting your phone and it being secure are two completely different things my friend.

Re: Browser Fingerprinting Without JavaScript

#55

Post by 0xdeadb00f »

southerntofu wrote: post #21

Being a fervent Tor Browser user, i just tried with it and of course the fingerprinting failed. Several copies of it give me the same fingerprints: e56952dba176a47af3c051b626b64ff3 (Safer mode) 632e305f8a939e5ba6afd24eced586f0 (Safest mode) That's because the Tor Browser, contrary to urban legend, is not just a browser that routes trafic through the tor network, but a firefox reworked (most of which is being upstream…

Did you see the spefific CSS hack they use to tell if you're using the Tor Browser as opposed to normal Firefox?

Re: Browser Fingerprinting Without JavaScript

#56

Post by robbedpeter »

0xdeadb00f wrote: post #54
robbedpeter wrote: post #49

Earlier quoted context omitted.

So how crippled does regular web browsing become using Tor safest mode? I'm tempted to give it a whirl for a week. Root my phone, flash something secure, leave VPN always on, and limit web browsing to Tor to get a feel for how bad or good it is. The self inflicted contortions developers go through to justify the need to spy drive me crazy. Modern devices and bandwidth are more than sufficient to handle a vast majorit…

Rooting your phone and it being secure are two completely different things my friend.

I can't tell if you're trying to say unrooted phones with stock carrier roms are somehow understood to be secure, or if rooting is mutually incompatible with security, or something else. Want to expound?

Re: Browser Fingerprinting Without JavaScript

#57

Post by onion2k »

wbobeirne wrote: post #13
onion2k wrote: post #11

Browsers should limit every webpage to displaying a maximum of two fonts, and should silently ignore any font face rules after the first two. Maybe three if you're feeling generous. With variable fonts available in every browser it wouldn't impact typography much. It would stop this sort of privacy attack, and it'd have the additional benefit of making the web look a lot nicer.

This feels like it's targeted at a very narrow view of what a browser is for. How would a site like fonts.google.com work?

Giving up resources like Google Fonts in order to increase privacy for the entire web seems like a fair trade off to me. Besides, it'd still work fine, but you'd only be able to view two or three fonts at a time.

Re: Browser Fingerprinting Without JavaScript

#58

Post by cute_boi »

0xdeadb00f wrote: post #55
southerntofu wrote: post #21

Being a fervent Tor Browser user, i just tried with it and of course the fingerprinting failed. Several copies of it give me the same fingerprints: e56952dba176a47af3c051b626b64ff3 (Safer mode) 632e305f8a939e5ba6afd24eced586f0 (Safest mode) That's because the Tor Browser, contrary to urban legend, is not just a browser that routes trafic through the tor network, but a firefox reworked (most of which is being upstream…

Did you see the spefific CSS hack they use to tell if you're using the Tor Browser as opposed to normal Firefox?

I guess they can easily identify tor vs normal firefox(Especially with tls fingerprinting probably used by cloudflare). But the goal of fingerprinting is mostly to distinguish user. There can be sane use like collecting fingerprint to stop bot attacks from registering. But as we know selfish society today they are mostly used to collect data and show ads. And egregious browser like chrome has no incentive to solve this problem.

Re: Browser Fingerprinting Without JavaScript

#59

Post by cute_boi »

DenseComet wrote: post #40
zarzavat wrote: post #39

Earlier quoted context omitted.

It should ask permission after N fonts.

More permissions are not the right answer. Too many and users get conditioned to blindly clicking accept.

I think we can mitigate such problems like how we handled notification. We can just stop all fingerprinting and show maximum of two font in such scenario.

Re: Browser Fingerprinting Without JavaScript

#60

Post by onion2k »

noduerme wrote: post #53
getcrunk wrote: post #25

Earlier quoted context omitted.

Easy. The limit should be for 2 fonts, unless you load them your self

You don't seem to realize that the fingerprinting has nothing to do with what fonts you load from a page. It's what fonts you have installed on your machine.

The font-face attack in the article requires loading the font from a remote location. A JS font numeration attack works with local fonts. That would need a different mitigation in the browser, but browsers could, for example, have an array limited to three elements that JS gets when it asks for a font list, or just return the system default fonts, or just say no. A permission to get the full list would be necessary for things like browser-based editors and design software, but it'd still be worth it in my opinion. It would be a huge win for privacy.

The fact is very few websites use more than three fonts at a time on any particular page, and most sites than do could rework their design so they don't (swapping icon fonts for an SVG font map, for example), or they could implement a canvas or WebGL alternative.

Post reply on HN