Well that sucks. I guess in the long run we need a new engine and different approach. Someone should call the OpenBSD guys to come up with working ideas here.
We found a stable Firefox identifier linking all your private Tor identities
11–20 of 306 posts
Re: We found a stable Firefox identifier linking all your private Tor identities
#12From the sounds of this it sounds like it doesn't persist past browser restart? I think that would significantly reduce the usefulness to attackers.
Would it though? I guess state agencies already know all nodes or may know all nodes. When you have a ton of meta-information all cross-linked, they can probably identify people quite accurately; may not even need 100% accuracy at all times and could do with less. I was thinking about that when they used information from any surrounding area or even sniffing through walls (I think? I don't quite recall the article but wasn't there an article like that in the last 3-5 years? The idea is to amass as much information as possible, even if it may not primarily have to do with solely the target user alone; e. g. I would call it "identify via proxy information").
Re: We found a stable Firefox identifier linking all your private Tor identities
#13It seems Qubes OS and Qubes-Whonix are not affected.
How so? If you kept a disposable VM open and just created new identities in tor browser, how does Qubes mitigate the threat here?
Re: We found a stable Firefox identifier linking all your private Tor identities
#14It seems Qubes OS and Qubes-Whonix are not affected.
How so? If you kept a disposable VM open and just created new identities in tor browser, how does Qubes mitigate the threat here?
On Qubes, you do not create a new identity in the same VM. This would go against the Qubes approach to security/privacy. Using separate VMs for independent tasks is the whole point of using Qubes.
Re: We found a stable Firefox identifier linking all your private Tor identities
#15Very cool research and wonderfully written. I was expecting an ad for their product somewhere towards the end, but it wasn't there! I do wonder though: why would this company report this vulnerability to Mozilla if their product is fingeprinting? Isn't it better for the business (albeit unethical) to keep the vulnerability private, to differentiate from the competitors? For example, I don't see many threat actors bur…
We don't use vulnerabilities in our products.
Re: We found a stable Firefox identifier linking all your private Tor identities
#16Re: We found a stable Firefox identifier linking all your private Tor identities
#17[deleted]
Re: We found a stable Firefox identifier linking all your private Tor identities
#18Very cool research and wonderfully written. I was expecting an ad for their product somewhere towards the end, but it wasn't there! I do wonder though: why would this company report this vulnerability to Mozilla if their product is fingeprinting? Isn't it better for the business (albeit unethical) to keep the vulnerability private, to differentiate from the competitors? For example, I don't see many threat actors bur…
We don't use vulnerabilities in our products.
So it's the criminal that convinced themselves they are the good guys, I didn't expect that one. You are a malware company get a grip.
Re: We found a stable Firefox identifier linking all your private Tor identities
#19Very cool research and wonderfully written. I was expecting an ad for their product somewhere towards the end, but it wasn't there! I do wonder though: why would this company report this vulnerability to Mozilla if their product is fingeprinting? Isn't it better for the business (albeit unethical) to keep the vulnerability private, to differentiate from the competitors? For example, I don't see many threat actors bur…
We don't use vulnerabilities in our products.
I don't understand what you mean. What separates this from other fingerprinting techniques your company monetizes?
No software wants to be fingerprinted. If it did, it would offer an API with a stable identifier. All fingerprinting is exploiting unintended behavior of the target software or hardware.
Re: We found a stable Firefox identifier linking all your private Tor identities
#20Earlier quoted context omitted.
We don't use vulnerabilities in our products.
I don't understand what you mean. What separates this from other fingerprinting techniques your company monetizes? No software wants to be fingerprinted. If it did, it would offer an API with a stable identifier. All fingerprinting is exploiting unintended behavior of the target software or hardware.
It makes sense to me, they're likely not trying to actually fingerprint Tor users. Those users will likely ignore ads, have JS disabled, etc. the real audience is people on the web using normal tooling.