Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We found a stable Firefox identifier linking all your private Tor identities

fingerprint.com

Post reply on HN
Print view View original

21–30 of 306 posts

Re: We found a stable Firefox identifier linking all your private Tor identities

#21

Post by throwawayqqq11 »

ranger_danger wrote: post #6
sva_ wrote: post #5

Does Tor Browser still allow JavaScript by default? Because if you block execution of JavaScript, you won't be affected from what I understand.

Disabling JavaScript actually greatly increases your fingerprint as not many users turn it off, so that instantly puts you in a much smaller bucket that you need to be unique in. Yes, not having JS means it limits your options for gathering other details, but it also requires much less effort to be unique now without JS. Tor Browser also doesn't spoof navigator.platform at all for some reason, so sites can still see…

I have my problems with that argument. Yes, less identifying bits means a smaller bucket but for the trackers, it also means more uncertainty, doesnt it? So when just a few others without JS join your bucket eg. via a VPN, profiling should become harder.

Re: We found a stable Firefox identifier linking all your private Tor identities

#22

Post by giancarlostoro »

shevy-java wrote: post #11

Well that sucks. I guess in the long run we need a new engine and different approach. Someone should call the OpenBSD guys to come up with working ideas here.

> Mozilla has quickly released the fix in Firefox 150 and ESR 140.10.0, and the patch is tracked in Mozilla Bug 2024220.

Did you even read the article at all? Ah my children did bad in school, time to replace them with new children and a different spouse. This is what you're suggesting essentially. A browser is not just something you simply make out of thin air. There's decades of nuance to browser engines, and I'm only thinking of the HTML nuances, not the CSS or JS nuances.

Re: We found a stable Firefox identifier linking all your private Tor identities

#23

Post by Springtime »

ranger_danger wrote: post #6
sva_ wrote: post #5

Does Tor Browser still allow JavaScript by default? Because if you block execution of JavaScript, you won't be affected from what I understand.

Disabling JavaScript actually greatly increases your fingerprint as not many users turn it off, so that instantly puts you in a much smaller bucket that you need to be unique in. Yes, not having JS means it limits your options for gathering other details, but it also requires much less effort to be unique now without JS. Tor Browser also doesn't spoof navigator.platform at all for some reason, so sites can still see…

> Disabling JavaScript actually greatly increases your fingerprint as not many users turn it off, so that instantly puts you in a much smaller bucket that you need to be unique in.

I've heard a handful of people say this but are there examples of what I would imagine would have to be server-side fingerprinting and the granularity? Since most fingerprinting I'm aware of is client-side, running via JS. While I expect server-side checks to be limited to things like which resources haven't be loaded by a particular user and anything else normally available via server logs either way, which could limit the pool but I wonder how effective in terms of tracking uniqueness across sites.

Re: We found a stable Firefox identifier linking all your private Tor identities

#24

Post by 2ndorderthought »

fsflover wrote: post #4

It seems Qubes OS and Qubes-Whonix are not affected.

In the last ten years has qubes moved on to support more hardware? Every 4 years I would try to use it only to find it didn't support any of my hardware.

Re: We found a stable Firefox identifier linking all your private Tor identities

#27

Post by LoganDark »

> For developers, this is a useful reminder that privacy bugs do not always come from direct access to identifying data. Sometimes they come from deterministic exposure of internal implementation details.

> For security and product stakeholders, the key point is simple: even an API that appears harmless can become a cross-site tracking vector if it leaks stable process-level state.

This reads almost LLM-ish. The article on the whole does not appear so, but parts of it do.

Re: We found a stable Firefox identifier linking all your private Tor identities

#28

Post by Aachen »

2ndorderthought wrote: post #24
fsflover wrote: post #4

It seems Qubes OS and Qubes-Whonix are not affected.

In the last ten years has qubes moved on to support more hardware? Every 4 years I would try to use it only to find it didn't support any of my hardware.

We buy off the shelf laptops, not sure anyone ever checked that it can run Qubes specifically before trying to install it (I'm sure of at least one person: myself). Doesn't just about any x64 machine with hardware where drivers are available in standard kernels also work with Qubes? What have you bought that's not supported?

Re: We found a stable Firefox identifier linking all your private Tor identities

#29

Post by anthk »

giancarlostoro wrote: post #22
shevy-java wrote: post #11

Well that sucks. I guess in the long run we need a new engine and different approach. Someone should call the OpenBSD guys to come up with working ideas here.

> Mozilla has quickly released the fix in Firefox 150 and ESR 140.10.0, and the patch is tracked in Mozilla Bug 2024220. Did you even read the article at all? Ah my children did bad in school, time to replace them with new children and a different spouse. This is what you're suggesting essentially. A browser is not just something you simply make out of thin air. There's decades of nuance to browser engines, and I'm o…

Given the dangers of JS and WASM they could just fork Netsurf and enhance the CSS3 support. If you are a journalist, running Tor with JS and tons of modern web tech enable makes you a bright white spot in a sea of darkness.

Re: We found a stable Firefox identifier linking all your private Tor identities

#30

Post by fsflover »

2ndorderthought wrote: post #24
fsflover wrote: post #4

It seems Qubes OS and Qubes-Whonix are not affected.

In the last ten years has qubes moved on to support more hardware? Every 4 years I would try to use it only to find it didn't support any of my hardware.

Tested hardware can be found here https://qubes-os.org/hcl. New hardware is being constantly added. If you plan to switch to Qubes, consider buying something from that list or, better, certified, or community-recommended hardware linked there.
Post reply on HN