Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We found a stable Firefox identifier linking all your private Tor identities

fingerprint.com

Post reply on HN
Print view View original

61–70 of 306 posts

Re: We found a stable Firefox identifier linking all your private Tor identities

#61

Post by firefax »

The OP's link is timing out over Tor for me, but the Wayback[1] version loaded without issue.

Also, does anyone know of any researchers in the academic world focusing on this issue? We are aware that EFF has a project that used to be named after a pedophile on this subject, but we are more looking for professors at universities or pure research labs ala MSR or PARC than activists working for NGOs, however pure their praxis :-)

As privacy geeks, we have become fascinated with the topic -- it seems that while we can achieve security through extensions like noscript or ublock origin or firefox containers (our personal "holy trinity"), anonymity slips through our fingers due to fingerprinting issues. (Especially if we lump stylometry in the big bucket of "fingerprinting".)

[1] https://web.archive.org/web/20260422190706/https://fingerpri...

Re: We found a stable Firefox identifier linking all your private Tor identities

#62

Post by trinsic2 »

celsoazevedo wrote: post #39
lyu07282 wrote: post #18

Earlier quoted context omitted.

So it's the criminal that convinced themselves they are the good guys, I didn't expect that one. You are a malware company get a grip.

Would you prefer that they kept this for themselves instead of disclosing it? I get criticizing their business and what they do wrong, but doesn't seem right to criticizing them for doing the right thing.

It means they are suspect. I think its right to be wary of motives if they are involved in the very thing they aim to bring awareness too. Questions arise in my mind as to why they would do something like this in the first place.

Its been my experience that the general public doesn't seem to follow patterns and instead focus on which switch is toggled at any given moment for a company's ethical practices. This is the main reason why we are constantly gamed by orgs that have a big picture view of crowd psychology.

Re: We found a stable Firefox identifier linking all your private Tor identities

#63

Post by foltik »

adastra22 wrote: post #60
baobabKoodaa wrote: post #36

Earlier quoted context omitted.

Uhh okay, so they do exploit vulnerabilities, they just try to target victims who can be served ads? What a weird distinction.

Painting fingerprinting as vulnerability exploit is your own very biased and very out-of-norm framing.

How would you frame it?

Re: We found a stable Firefox identifier linking all your private Tor identities

#64

Post by OneDeuxTriSeiGo »

mtlynch wrote: post #19
valve1 wrote: post #15

Earlier quoted context omitted.

We don't use vulnerabilities in our products.

I don't understand what you mean. What separates this from other fingerprinting techniques your company monetizes? No software wants to be fingerprinted. If it did, it would offer an API with a stable identifier. All fingerprinting is exploiting unintended behavior of the target software or hardware.

A vulnerability is distinct from unintended behavior.

Unintended identification is less than ideal but frankly is just the nature of doing business and any number of niceties are lost by aggressively avoiding fingerprinting.

In software intentionally optimized to avoid any fingerprinting however it is a vulnerability.

The distinction being that fingerprinting in general is a less than ideal side effect that gives you a minor loss in privacy but in something like Tor Browser that fingerprinting can be life or death for a whistleblower, etc. It's the distinction between an annoyance and an execution.

Re: We found a stable Firefox identifier linking all your private Tor identities

#65

Post by zamadatix »

baobabKoodaa wrote: post #36
giancarlostoro wrote: post #20

Earlier quoted context omitted.

It makes sense to me, they're likely not trying to actually fingerprint Tor users. Those users will likely ignore ads, have JS disabled, etc. the real audience is people on the web using normal tooling.

Uhh okay, so they do exploit vulnerabilities, they just try to target victims who can be served ads? What a weird distinction.

Most users seem to not care about ad tech/tracking as much as technical users. Even further, most seem to want to enable more tracking to [protect the children or whatever the reason is] pretty regularly (at least in opinion polls about various legislation). ToR users are not at all like that + could be harmed in a very different way... so I think it's fair to frame them differently even if I'd personally say people should be wanting to treat both as similar offenses because neither should be seen as okay in my eyes.

Re: We found a stable Firefox identifier linking all your private Tor identities

#67

Post by troupo »

SirMaster wrote: post #44

I question why websites can even access all this info without asking or notifying the user. Why don't browsers make it like phones where the server (app) has to be granted permission to access stuff?

It's a fine line between making the web usable, fingerprinting, and peppering the user with dozens or hundreds of permissions.

And since browsers rival OSes for complexity (they are basically OSes in their own right already), any part of the system can be inadvertently exposed and exploited.

Re: We found a stable Firefox identifier linking all your private Tor identities

#68

Post by troupo »

Dwedit wrote: post #53
codedokode wrote: post #48

Honestly it seems that most of Web Standards are used mostly for fingerprinting - I think a small number of websites uses IndexedDB (who even needs it) for actually storing data rather than fingerprinting. That's why expansion of web standards is wrong. Browser should provide minimal APIs for interacting with device and features like IndexedDB can be implemented as WebAssembly library, leaking no valuable data. For e…

You can use a browser extension like "Local Storage Editor" to see the contents of the Local Storage of a website. So far, I've seen it used for caching long-life images (like on gmail), or used as another way to do logins instead of cookies.

> You can use a browser extension like "Local Storage Editor" to see the contents of the Local Storage of a website.

Or just open dev tools

Re: We found a stable Firefox identifier linking all your private Tor identities

#70

Post by somerset »

lyu07282 wrote: post #18
valve1 wrote: post #15

Earlier quoted context omitted.

We don't use vulnerabilities in our products.

So it's the criminal that convinced themselves they are the good guys, I didn't expect that one. You are a malware company get a grip.

Responsible disclosure and commercial fingerprinting aren't contradictory.
Post reply on HN