Some people say it doesn't work for them in Firefox or Chrome. Surprisingly it works for me even in Tor browser (even in safest mode). Although it seems that its method to distinguish between Tor browser and Firefox fails and still assumes I'm using Firefox.
Browser Fingerprinting Without JavaScript
81–90 of 124 posts
Re: Browser Fingerprinting Without JavaScript
#82Earlier quoted context omitted.
I could live with that and I think many users would agree.
Live with a 2 font maximum and popups every time a site chose to load another font? It would break every icon on the web. You'd either only load the icons or only load the text fonts. If you want to avoid fingerprinting, and actually think this method remotely works, by all means block those requests. If you actually care about privacy a better place to start would be the fact that chrome logs you in on the browser l…
I hate fancy designed sites that take forever to load, or need to be refreshed to work. If you’re really calling everyone an idiot who doesn’t like your bloated site design, re-examine why is it genius to have bloated sites like yours?
Re: Browser Fingerprinting Without JavaScript
#83Earlier quoted context omitted.
So how crippled does regular web browsing become using Tor safest mode? I'm tempted to give it a whirl for a week. Root my phone, flash something secure, leave VPN always on, and limit web browsing to Tor to get a feel for how bad or good it is. The self inflicted contortions developers go through to justify the need to spy drive me crazy. Modern devices and bandwidth are more than sufficient to handle a vast majorit…
I think the biggest problem of surfing the web via Tor end nodes will be the Cloudflare captcha. As much as I like Cloudflare, their captcha makes the open web pretty much unusable through Tor. At least last time I tried.
not just tor, but also the increasingly common cgnat or regular nat with a lot of users (soho, institutions, dorms, libraries ...)
Re: Browser Fingerprinting Without JavaScript
#84Earlier quoted context omitted.
Here's a link to a more complete explanation from the primary developer of GrapheneOS: https://teddit.net/r/GrapheneOS/comments/du23la/rooted_or_ro... Basically, you don't log in to your Linux box (or Windows, Mac, etc) as root for day to day use and same thing goes for your phone.
Rooting your phone means you obtain root access to the device, bypassing carrier restrictions. It does not mean you run it as root user day to day. That would indeed be insecure. Rooting is not incompatible with security. Trusting carrier distributed software on a locked down device is far less secure than using a custom install of something like Calyx or GrapheneOS. In my view, trusting Google, Apple, Verizon, t-mob…
well put.
thou for non-technical users, rooting a phone is a bit like going back to windows xp.
Re: Browser Fingerprinting Without JavaScript
#85Earlier quoted context omitted.
Who is behind the web browsers that most people use. Companies whose businesses rely on subjugating user privacy have few if any incentives to make these types of changes. These complex browsers do not exist for their users, they exists for the advertising company or other company that collects user data.
Sure. This isn't coming to Chrome or Safari ever. There are other browsers though.
According to https://gs.statcounter.com/browser-market-share, Chromium-based/Safari browsers have 93% market share, so I wouldn't really count on other browsers that much.
Re: Browser Fingerprinting Without JavaScript
#86I used to think that privacy was a technical problem, then I thought it was a legal problem, now I think it is a reaction problem. We are not disgusted enough. I do wonder if that will change.
No, it's a legal problem. There are countries where groping women is not a big deal for example. Even in the most "ideal" EU countries, casual racism is an afterthought. Reaction is a problem because there is no adverse consequence to the perpetrator. I don't need a browser extension, I need CEOs in prison. Then reactions will catch up.
How did you bring up groping and racism into CSS fingerprinting topic?
Re: Browser Fingerprinting Without JavaScript
#87Earlier quoted context omitted.
That's just insane. Sites and apps I build these days usually include FontAwesome and/or another icon library, frequently along with a custom dingbat font for the company's unique logos and iconography (we bundle all relevant vector art as a font). Then you have primary and secondary brand fonts, along with sometimes readability fonts. Not to mention iframed forms coming off credit card gateways. I have no idea how a…
I could live with that and I think many users would agree.
They might agree in principle, but they’d be pretty pissed off when nothing works when the open their web browser. The golden rule in web standards development is “don’t break the web”, ie you can’t just recklessly change web platform features, you have to do it thoughtfully and carefully to avoid breaking existing websites. It’s not a perfect rule, there are exceptions where the breakage is tiny and the benefit is huge, but what you’re proposing is huge destruction and would not make it past the first stage of consideration.
Re: Browser Fingerprinting Without JavaScript
#88Being a fervent Tor Browser user, i just tried with it and of course the fingerprinting failed. Several copies of it give me the same fingerprints: e56952dba176a47af3c051b626b64ff3 (Safer mode) 632e305f8a939e5ba6afd24eced586f0 (Safest mode) That's because the Tor Browser, contrary to urban legend, is not just a browser that routes trafic through the tor network, but a firefox reworked (most of which is being upstream…
I tried this with Tor Browser on two different computers and got two different fingerprints, even in safest mode.
Re: Browser Fingerprinting Without JavaScript
#89Browsers should limit every webpage to displaying a maximum of two fonts, and should silently ignore any font face rules after the first two. Maybe three if you're feeling generous. With variable fonts available in every browser it wouldn't impact typography much. It would stop this sort of privacy attack, and it'd have the additional benefit of making the web look a lot nicer.
That's just insane. Sites and apps I build these days usually include FontAwesome and/or another icon library, frequently along with a custom dingbat font for the company's unique logos and iconography (we bundle all relevant vector art as a font). Then you have primary and secondary brand fonts, along with sometimes readability fonts. Not to mention iframed forms coming off credit card gateways. I have no idea how a…
What’s the benefit of including vector art as font rather than SVG?
How do you do multiple colors in fonts?
Re: Browser Fingerprinting Without JavaScript
#90> your fingerprint stays the same even if your browser is in incognito mode. OK, I tried the demo with Firefox Focus, and it worked. But it doesn't tell you how unique your fingerprint is. If multiple users have the same fingerprint, then its effectiveness will be limited.
Yeah. As I understand it, since all Apple mobile browsers use the WebKit engine, there’s nothing this demo can use to separate them. This demo doesn’t mention cookies. screen size, cache, etc, which could be used to further differentiate. This article is less of a tech demo and more of an introductory article to how some fingerprinting works.
[deleted]