Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We found a stable Firefox identifier linking all your private Tor identities

fingerprint.com

Post reply on HN
Print view View original

81–90 of 306 posts

Re: We found a stable Firefox identifier linking all your private Tor identities

#81

Post by kelvinjps10 »

Joe_Cool wrote: post #72
Barbing wrote: post #54

Earlier quoted context omitted.

>Why don't browsers make it like phones where the server (app) has to be granted permission to access stuff? Like Android phones perhaps? Unfortunate Apple gives very little granular control.

Most stock android phones don't either. You usually get to control precise location, notifications, some background activity, SMS, Calls, Mic, Camera, SD Card, etc. But most ROMs don't allow controls for WiFi, Cell data, Phone ID, Phone number, User ID, local storage, etc...

all these permission you have to accept?

Re: We found a stable Firefox identifier linking all your private Tor identities

#82

Post by pmontra »

zamadatix wrote: post #65
baobabKoodaa wrote: post #36

Earlier quoted context omitted.

Uhh okay, so they do exploit vulnerabilities, they just try to target victims who can be served ads? What a weird distinction.

Most users seem to not care about ad tech/tracking as much as technical users. Even further, most seem to want to enable more tracking to [protect the children or whatever the reason is] pretty regularly (at least in opinion polls about various legislation). ToR users are not at all like that + could be harmed in a very different way... so I think it's fair to frame them differently even if I'd personally say people…

In my experience those users express a mix of surprise and irritation when they get ads about something they did minutes or hours before, but they accept that's the way things are.

I joke that I'm a no-app person, because I install very few apps and I use anti tracking tech on my phone that's even hard to explain or recommend to non technical friends. I use Firefox with uMatrix and uBlock Origin and Blockada. uMatrix is effective but breaks so many sites unless one invests time in playing with the matrix. Blockada breaks many important apps (banking) less one understands whitelisting.

Re: We found a stable Firefox identifier linking all your private Tor identities

#83

Post by celsoazevedo »

lyu07282 wrote: post #79
celsoazevedo wrote: post #39

Earlier quoted context omitted.

Would you prefer that they kept this for themselves instead of disclosing it? I get criticizing their business and what they do wrong, but doesn't seem right to criticizing them for doing the right thing.

What are you even saying? It's like getting upset at somebody who criticizes a criminal because they once helped some grandma across the street. I'm not upset at the criminal because they helped a grandma across the street obviously that's not the fucking point.

I'm not upset, I just don't think we should criticize someone for doing something good. Maybe they're a terrible org, maybe they deserve criticism most of the time, but not in this instance.

It's not like you can't point out that they did a good deed, but that they're still in the shitty business of fingerprinting users.

Also, if people only get the stick no matter what they do, then eventually some will embrace the dark side and at least make money out of it. And that's not good for you.

Re: We found a stable Firefox identifier linking all your private Tor identities

#84

Post by flufluflufluffy »

lyu07282 wrote: post #76
somerset wrote: post #70

Earlier quoted context omitted.

Responsible disclosure and commercial fingerprinting aren't contradictory.

[flagged]

If you take their claim that they don’t use vulnerabilities in their products as true, then I don’t see a contradiction. If it isn’t true, then obviously there is a contradiction.

But your considering of all methods that enable fingerprinting as vulnerabilities is your own opinion. There are definitely measurable signals that are based on a user’s behavior, rather than data exposed by the browser itself.

Re: We found a stable Firefox identifier linking all your private Tor identities

#85

Post by Vinnl »

lyu07282 wrote: post #79
celsoazevedo wrote: post #39

Earlier quoted context omitted.

Would you prefer that they kept this for themselves instead of disclosing it? I get criticizing their business and what they do wrong, but doesn't seem right to criticizing them for doing the right thing.

What are you even saying? It's like getting upset at somebody who criticizes a criminal because they once helped some grandma across the street. I'm not upset at the criminal because they helped a grandma across the street obviously that's not the fucking point.

It's more like criticising a criminal when they are helping some grandma across the street, thereby treating them more harshly than the criminals that don't do that.

(Also known as the "Copenhagen Interpretation of Ethics": https://gwern.net/doc/philosophy/ethics/2015-06-24-jai-theco... )

Re: We found a stable Firefox identifier linking all your private Tor identities

#86

Post by Cynddl »

firefax wrote: post #61

The OP's link is timing out over Tor for me, but the Wayback[1] version loaded without issue. Also, does anyone know of any researchers in the academic world focusing on this issue? We are aware that EFF has a project that used to be named after a pedophile on this subject, but we are more looking for professors at universities or pure research labs ala MSR or PARC than activists working for NGOs, however pure their…

yes, there’s an active area of research on web fingerprint, both attacks and defences. Look at conferences like PETS for instance

Re: We found a stable Firefox identifier linking all your private Tor identities

#87

Post by michaelt »

SirMaster wrote: post #44

I question why websites can even access all this info without asking or notifying the user. Why don't browsers make it like phones where the server (app) has to be granted permission to access stuff?

Browser fingerprinting is an unintended side-effect of things it's sorta-kinda reasonable for browsers to provide.

A user agent that says the browser's version? Reasonable enough.

Being able to ask for fonts, if the system has them? Difficult to have font support without that.

Getting the user's timezone, language and keyboard layout? Reasonable.

The size of the screen, and the size of the browser window? Difficult to lay things out without that.

Of course a video or audio player needs to know which video formats your browser supports - how else to provide the right video?

Obviously javascript can get the time, and it's trivial to figure out the system's clock error by comparing that to the time on a server.

Before you know it, almost every browser is uniquely identifiable.

Re: We found a stable Firefox identifier linking all your private Tor identities

#88

Post by Gigachad »

giancarlostoro wrote: post #20
mtlynch wrote: post #19

Earlier quoted context omitted.

I don't understand what you mean. What separates this from other fingerprinting techniques your company monetizes? No software wants to be fingerprinted. If it did, it would offer an API with a stable identifier. All fingerprinting is exploiting unintended behavior of the target software or hardware.

It makes sense to me, they're likely not trying to actually fingerprint Tor users. Those users will likely ignore ads, have JS disabled, etc. the real audience is people on the web using normal tooling.

They can just flag all Tor users as high risk. They don't strictly need to fingerprint them when it's generally fine for websites to just block signups for Tor users or require further identification via phone number or something.

You want fingerprinting to identify low risk users to skip the inconvenient security checks.

Re: We found a stable Firefox identifier linking all your private Tor identities

#89

Post by handedness »

Barbing wrote: post #58
fsflover wrote: post #34

Earlier quoted context omitted.

Here you go: https://qubes-os.org .

>Why Qubes OS? >Physical isolation is a given safeguard that the digital world lacks … >In our digital lives, the situation is quite different: All of our activities typically happen on a single device. This causes us to worry about whether it’s safe to click on a link or install an app, since being hacked imperils our entire digital existence. >Qubes eliminates this concern by allowing us to divide a device into man…

Qubes OS is a great solution for this threat model. By my (admittedly cursory) understanding of this attack, one would have to chain the attack to escalate to dom0 to get around it.

Having said that, fsflover exhibits a poor grasp of how this stuff works and all should be aware that even in Qubes OS, one would need to spawn new disposable VMs for each identity; relying on the Tor Browser's new identity creation within the same disposable VM would be little different from running Tor Browser on a traditional OS.

Re: We found a stable Firefox identifier linking all your private Tor identities

#90

Post by handedness »

fsflover wrote: post #14
hrimfaxi wrote: post #13

Earlier quoted context omitted.

How so? If you kept a disposable VM open and just created new identities in tor browser, how does Qubes mitigate the threat here?

On Qubes, you do not create a new identity in the same VM. This would go against the Qubes approach to security/privacy. Using separate VMs for independent tasks is the whole point of using Qubes.

> On Qubes, you do not create a new identity in the same VM. This would go against the Qubes approach to security/privacy. Using separate VMs for independent tasks is the whole point of using Qubes.

This is technically incorrect information and could get people in trouble if followed literally.

On Qubes OS, if a user creates a new identity inside a Whonix workstation disposable VM via the browser's new identity functionality, the new identity spawns within the same disposable VM. I just tested this on Qubes OS 4.3.

That, I assume would expose one to OP's vulnerability, as its still running in the same VM. I would be glad to learn that I'm incorrect in my unverified assumption.

Even Qubes OS users still need to be mindful to launch new disposable VM when keeping identities separate to sidestep this attack.

Post reply on HN