We found a stable Firefox identifier linking all your private Tor identities
1–10 of 306 posts
Re: We found a stable Firefox identifier linking all your private Tor identities
#2I would imagine most users of Tor are using Tor Browser. I am reading there was a responsible disclosure to Mozilla but is it me or did that section leave out when the Tor Project planned to respond or release a fixed Tor Browser? Do they like keep very close or is there a large lag?
Re: We found a stable Firefox identifier linking all your private Tor identities
#3Very cool research and wonderfully written.
I was expecting an ad for their product somewhere towards the end, but it wasn't there!
I do wonder though: why would this company report this vulnerability to Mozilla if their product is fingeprinting?
Isn't it better for the business (albeit unethical) to keep the vulnerability private, to differentiate from the competitors? For example, I don't see many threat actors burning their zero days through responsible disclosure!
Re: We found a stable Firefox identifier linking all your private Tor identities
#4It seems Qubes OS and Qubes-Whonix are not affected.
Re: We found a stable Firefox identifier linking all your private Tor identities
#5Does Tor Browser still allow JavaScript by default? Because if you block execution of JavaScript, you won't be affected from what I understand.
Re: We found a stable Firefox identifier linking all your private Tor identities
#6Does Tor Browser still allow JavaScript by default? Because if you block execution of JavaScript, you won't be affected from what I understand.
Disabling JavaScript actually greatly increases your fingerprint as not many users turn it off, so that instantly puts you in a much smaller bucket that you need to be unique in. Yes, not having JS means it limits your options for gathering other details, but it also requires much less effort to be unique now without JS.
Tor Browser also doesn't spoof navigator.platform at all for some reason, so sites can still see when you use Linux, even if the User-Agent is spoofing Windows.
Re: We found a stable Firefox identifier linking all your private Tor identities
#7It seems Qubes OS and Qubes-Whonix are not affected.
Source?
Re: We found a stable Firefox identifier linking all your private Tor identities
#8Very cool research and wonderfully written. I was expecting an ad for their product somewhere towards the end, but it wasn't there! I do wonder though: why would this company report this vulnerability to Mozilla if their product is fingeprinting? Isn't it better for the business (albeit unethical) to keep the vulnerability private, to differentiate from the competitors? For example, I don't see many threat actors bur…
They probably are not relying on it and disclosure means others can't either.
Re: We found a stable Firefox identifier linking all your private Tor identities
#9I would imagine most users of Tor are using Tor Browser. I am reading there was a responsible disclosure to Mozilla but is it me or did that section leave out when the Tor Project planned to respond or release a fixed Tor Browser? Do they like keep very close or is there a large lag?
Tor Browser is always quick to rebase on the latest Firefox ESR. They released an update the next day:
Re: We found a stable Firefox identifier linking all your private Tor identities
#10From the sounds of this it sounds like it doesn't persist past browser restart? I think that would significantly reduce the usefulness to attackers.