The text-only browser I am using does not support CSS. It does not send E-tag headers either. The local forward proxy removes all HTTP headers except Host and Connection, and Cookie where needed.
Which browser are you using?
No-JavaScript Fingerprinting
41–50 of 107 posts
Re: No-JavaScript Fingerprinting
#42[deleted]
Re: No-JavaScript Fingerprinting
#43The actual blogpost is here
https://fingerprintjs.com/blog/disabling-javascript-wont-sto...
basically they use CSS trickery together with server-side stuff.
It's pretty clever.
@font-face {
font-family: 'Helvetica';
src: local('Helvetica'),
url('/signal/(token)/fontHelvetica')
format('truetype');
}
@media (featureX: value1) {
.css_probe_42 {
background: url('/signal/(token)/featureX/value1');
}
}
Re: No-JavaScript Fingerprinting
#44The text-only browser I am using does not support CSS. It does not send E-tag headers either. The local forward proxy removes all HTTP headers except Host and Connection, and Cookie where needed.
Which browser are you using?
For text-only, I prefer Links. I use various versions compiled statically with personal patches.
Re: No-JavaScript Fingerprinting
#45The text-only browser I am using does not support CSS. It does not send E-tag headers either. The local forward proxy removes all HTTP headers except Host and Connection, and Cookie where needed.
On many websites, you will literally be the only person doing that. This is a unique fingerprint.
This might not matter to you, since it sounds like privacy isn’t your primary motivation here, but it is worth pointing out that custom patched browsers are going to be more fingerprinted, not less.
Re: No-JavaScript Fingerprinting
#46Earlier quoted context omitted.
I get different results for each domain on Firefox Android.
It works on Fennec, even in private mode. (Fennec is the F-Droid Firefox build.) Do you have any addons? It works with uBlock Origin on desktop, haven't tried mobile.
I'm on a desktop using FF with uBO, both with fairly locked-down configs, and it doesn't work for me. That is, both websites eventually lead to a broken page because of too many redirects, and the URLs in the URL bars of each tab do not contain the same ID.
Without digging too deep into what your websites are doing, I did notice that they're trying to set / read cookies, which is a) being blocked by uMatrix in general, and b) perhaps being blocked by me having configured FF to block third-party cookies in particular.
Re: No-JavaScript Fingerprinting
#47I thought it was going to use ETAG based fingerprinting/tracking, which I always thought was pretty clever. The etag header is supposed to be used to control caching, so it's typically a server-side generated hash of the requested resource's content. But, there's no requirement for it to be, so you can generate a unique one, and the client will send it back to you next time it asks for that uri. Sort of like a cookie…
You could just use any regular cookie then, in this case.
Re: No-JavaScript Fingerprinting
#48Note that among a sea of tracked browsers, the untrackable browser shines like a bright star.
Statistical analysis of these values over time (matched with client hints, ETags, If-Modified-Since, and IPs) will make most browsers uniquely identifiable.
If the malicious vendor is good, they even correlate the size and order of requests. Because that's unique as well and can identify TOR browsers pretty easily.
It's like saying "I can't be tracked, because I use Linux". Guess what, as long as nobody in your town uses Linux, you are the most trackable person.
I decided to go with the "behave as the statistical norm expects you to behave" and created my browser/scraper [1] and forked WebKit into a webview [2] that doesn't support anything that can be used for tracking; with the idea that those tracking features can be shimmed and faked.
I personally think this is the only way to be untrackable these days. Because let's be honest, nobody uses Firefox with ETP in my town anymore :(
WebKit was a good start of this because at least some of the features were implemented behind compiler flags...whereas all other browsers and engines can't be built without say, WebRTC support, or say, without Audio Worklets which are for themselves enough to be uniquely identified.
[1] https://github.com/tholian-network/stealth
[2] https://github.com/tholian-network/retrokit
(both WIP)
Re: No-JavaScript Fingerprinting
#49The actual blogpost is here https://fingerprintjs.com/blog/disabling-javascript-wont-sto... basically they use CSS trickery together with server-side stuff. It's pretty clever. @font-face { font-family: 'Helvetica'; src: local('Helvetica'), url('/signal/(token)/fontHelvetica') format('truetype'); } to detect font (which detects OS), and @media (featureX: value1) { .css_probe_42 { background: url('/signal/(token)/feat…
Thanks, I thought I saw the demo before on HN but I was not sure as I couldn't find the domain.
Previous discussion: https://news.ycombinator.com/item?id=29042791
Re: No-JavaScript Fingerprinting
#50The text-only browser I am using does not support CSS. It does not send E-tag headers either. The local forward proxy removes all HTTP headers except Host and Connection, and Cookie where needed.
On many websites, you will literally be the only person doing that. This is a unique fingerprint. This might not matter to you, since it sounds like privacy isn’t your primary motivation here, but it is worth pointing out that custom patched browsers are going to be more fingerprinted, not less.
Yes, I understand some HN readers have this thought. I have gotten similar replies before. However, consider that I only send two to three headers: Host, Connection and (optionally) Cookie. There is nothing unique about the text-only browser by virtue of the patches. The TCP connetion and TLS is handled by a proxy. Sometimes I send the TCP requests with netcat, tcpclient, socat, etc. Then I open the HTML file with the browser.
Perhaps the proxy has a fingerprint, but it is a very popular proxy in widespread use.
Maybe the OS, e.g., the networking stack, has a fingerprint.
Maybe the TCP clients have fingeprints.
But seriously, what is the point of thinking about these things. Who is going to go to such lengths to try to "identify" me. What is their purpose. Am I a spy trying to hide from computer forensics nerds. No. Am I trying to "blend in". No. I am trying to improve the web experience. That involves 1. sending the minimum data (avoid feeding the online advertising juggernaut) and 2. reducing advertising, ideally to zero. I have done a good job of both 1 and 2.
Who is going to try to advertise to a user who is using a text-only browser.
Also, assuming hypothetically, for argument's sake, we tried to get every user to "blend in" by using the exact same browser with the exact same settings on the exact same computer. Which would be easier: (a) users have to copy all the settings and idiosyncracies of a "modern" graphical browser including numerous HTTP headers or (b) users have to refrain from running CSS or Javascript and limit to sending only two to three headers (Host, Connection and, optionally, Cookie) and only send one request at a time. The more points of differentiation one has to worry about, the greater the chance one will overlook something. Needless to say, the "modern" browser presents a greater number of points of differentiation than the text-only browser.
The goal for me is to improve the web experience, including minimising (a) how much data I voluntarily share and (b) advertising. I have succeeded. The use of a text-only browser in lieu of a graphical one for recreational web use is part of the solution. I also benefit from other strategies that help with (b). Attempts to advertise to me online are few and far between. It is a fruitless endeavour.
It is not a goal of mine to try to "blend in" with other web users. It appears this is a goal of some HN commenters. Alas, other web users share heaps of data voluntarily and subject themselves to large amount of advertising. There is arguably a price to pay for trying to appear "same".