Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We found a stable Firefox identifier linking all your private Tor identities

fingerprint.com

Post reply on HN
Print view View original

161–170 of 306 posts

Re: We found a stable Firefox identifier linking all your private Tor identities

#161

Post by autoexec »

sandworm101 wrote: post #97
michaelt wrote: post #87

Earlier quoted context omitted.

Browser fingerprinting is an unintended side-effect of things it's sorta-kinda reasonable for browsers to provide. A user agent that says the browser's version? Reasonable enough. Being able to ask for fonts, if the system has them? Difficult to have font support without that. Getting the user's timezone, language and keyboard layout? Reasonable. The size of the screen, and the size of the browser window? Difficult t…

The tor project seeks this bypass this by keeping such things standardized across users, even down to reported screen size. And there is nothing stopping the browser from fibbing as most settings dong matter all that much (ie UK v Canadian v American English).

This is a bad idea though, because any newly discovered means to get even a single data point results in being able to ID every tor user. I'd be better to have every tor browser always generate a random fingerprint so that even if the unexpected happens people will never get anything but random results.

Re: We found a stable Firefox identifier linking all your private Tor identities

#162

Post by autoexec »

0x62 wrote: post #110
BeetleB wrote: post #101

Earlier quoted context omitted.

I fantasize having a browser that I can use only for viewing content. No applications. No mail. No need for cookies. I can use a "regular" browser for more enhanced stuff. But for simple content consumption, we can just have a "dumb" browser that can't do much. > A user agent that says the browser's version? Reasonable enough. No user agent. I'm guessing it will need it for JavaScript or HTML features, and dynamicall…

Unfortunately you've now made an incredibly niche browser, and the lack of those metrics is a good fingerprint by itself. How browsers render SVGs can be used for fingerprinting (even the underlying OS affects this, and I assume you'll want to see those), combine with ISP from IP address, and unless theres hundreds users in every city you're now pretty easily trackable.

There's no problem with having a unique fingerprint. The problem is having a consistent one. Randomize the fingerprint every time and you're fine. The IP address problem applies to everyone, including anyone using tor browser. The only solution to that is not using your own IP address (VPN/proxy). If I were going to make a secure privacy focused browser it either wouldn't allow things like rendering SVGs (which have introduced vulnerabilities beyond tracking) and wouldn't allow much (if any) JS and only a sane subset of CSS.

Re: We found a stable Firefox identifier linking all your private Tor identities

#163

Post by Cider9986 »

Being fingerprinted across Tor is different from being deanonymized—it basically just "psuedonomizes" you. You now have an identifier. It is a significant threat, but it is not hard to "psuedonomize" someone based on stylometry and some of the people with the highest threat model—operating an illegal site, will be pseudonymous anyway.

Don't get your opsec advice from HN. Check whonix, qubes, grapheneos, kicksecure forums/wikis. Nihilist opsec, Privacyguides.

Re: We found a stable Firefox identifier linking all your private Tor identities

#165

Post by rendx »

autoexec wrote: post #161
sandworm101 wrote: post #97

Earlier quoted context omitted.

The tor project seeks this bypass this by keeping such things standardized across users, even down to reported screen size. And there is nothing stopping the browser from fibbing as most settings dong matter all that much (ie UK v Canadian v American English).

This is a bad idea though, because any newly discovered means to get even a single data point results in being able to ID every tor user. I'd be better to have every tor browser always generate a random fingerprint so that even if the unexpected happens people will never get anything but random results.

> to have every tor browser always generate a random fingerprint

Browsers do not "generate" fingerprints. They expose data that can be used to fingerprint users. You cannot "randomize" this; even if you were to return random values for, say, user screen size, with various visual side effects, it would just be another signal to fingerprint: "Oh, your browser is returning random values? Must be a Tor browser user".

Re: We found a stable Firefox identifier linking all your private Tor identities

#166

Post by bblb »

michaelt wrote: post #87
SirMaster wrote: post #44

I question why websites can even access all this info without asking or notifying the user. Why don't browsers make it like phones where the server (app) has to be granted permission to access stuff?

Browser fingerprinting is an unintended side-effect of things it's sorta-kinda reasonable for browsers to provide. A user agent that says the browser's version? Reasonable enough. Being able to ask for fonts, if the system has them? Difficult to have font support without that. Getting the user's timezone, language and keyboard layout? Reasonable. The size of the screen, and the size of the browser window? Difficult t…

These are all relics from the innocent 90's Internet. We had our global village and everything was fine. A couple of bad actors spamming blue pills here and there and that was it.

Now we have actual criminal organizations and other real bad actors.

I'm sure we can come up with something better than advertise our whole local computing platform on every HTTP request.

Re: We found a stable Firefox identifier linking all your private Tor identities

#167

Post by ranger_danger »

autoexec wrote: post #156
ranger_danger wrote: post #128

Earlier quoted context omitted.

https://fingerprint.com/blog/disabling-javascript-wont-stop-... https://github.com/jonasstrehle/supercookie

When I go to https://noscriptfingerprint.com/ all I see is a blank page. My browser is pretty locked down in other ways which probably helps, but I'm still taking that as a good sign.

The site seems to have been taken offline, but the code is here: https://github.com/fingerprintjs/blog-nojs-fingerprint-demo/

Re: We found a stable Firefox identifier linking all your private Tor identities

#168

Post by SiempreViernes »

fc417fc802 wrote: post #127
SiempreViernes wrote: post #74

Earlier quoted context omitted.

Instead of trying convince-by-assertion, maybe you could try offering an actual objection to the argument raised up-thread? On what basis do you claim that software developers, who did not establish a means of for third parties to get a stable identifier, nevertheless intended that fingerprinting techniques should work?

> Instead of trying convince-by-assertion TBF the idea that any and all fingerprinting falls under the umbrella of exploiting a vulnerability was also presented as an assertion. At least personally I think it's a rather absurd notion. Certainly you can exploit what I would consider a vulnerability to obtain information useful for fingerprinting. But you can also assemble readily available information and I don't thin…

For the readers convenience I restated the argument also in my post, but if you look you can see it was also stated much earlier in the thread.

Re: We found a stable Firefox identifier linking all your private Tor identities

#169

Post by SeriousM »

yencabulator wrote: post #66

> the identifier can also persist [...] as long as the Firefox process remains running Make sure to exit Tor Browser at the end of a session. Make sure not to mix two uses in one session.

Or shut down and boot tails again. You need privacy? Take your time.

Re: We found a stable Firefox identifier linking all your private Tor identities

#170

Post by kqp »

valve1 wrote: post #15
lpapez wrote: post #3

Very cool research and wonderfully written. I was expecting an ad for their product somewhere towards the end, but it wasn't there! I do wonder though: why would this company report this vulnerability to Mozilla if their product is fingeprinting? Isn't it better for the business (albeit unethical) to keep the vulnerability private, to differentiate from the competitors? For example, I don't see many threat actors bur…

We don't use vulnerabilities in our products.

I’m going to go out on a limb and guess that you define “vulnerability” as something like “thing that will be fixed soon”. After all, Joe Random not liking a behavior doesn’t make it a vuln, there needs to be a litmus test. Am I close?
Post reply on HN