Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: GlassBox – what the browser reveals, and how identifiable you are

glassbox.codecanary.org

Post reply on HN
Print view View original

11–20 of 73 posts

Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are

#11

Post by fooqux »

dylan604 wrote: post #8
bravoetch wrote: post #5

It's horrifying to see that our browsers give up anything at all. I feel like we need a new model where we just get served the content, and we don't serve up anything to the content provider. I feel ill.

How would you prevent that? If you want to use a feature, you need to know if that feature is available. So you add methods/functions to ensure that you can fail gracefully when something is not available. That availability is the fingerprint. I don't blame the browsers as much as asshats using the tool for malicious purposes. We're not going to ban hammers because someone uses them for things other than driving nail…

In the old days, we just sent the content and let the client figure out what to do with it. If you navigated to homestarrunner.com and you didn't have flash installed, you just got a message saying to install it, or worst case, a broken icon in a frame.

We figured it out just fine.

Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are

#14

Post by bobbiechen »

RandomBK wrote: post #12

It's worth noting that you need both uniqueness and some form of stability. If you consistently show up as a diffent fingerprint every time you visit or for every different site, then that is a form of privacy as well.

Shocking, this site assigned me a UUID and I found it listed here! https://everyuuid.com/

Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are

#15

Post by jszymborski »

RandomBK wrote: post #12

It's worth noting that you need both uniqueness and some form of stability. If you consistently show up as a diffent fingerprint every time you visit or for every different site, then that is a form of privacy as well.

I just downloaded a fresh install of LibreWolf to test this and it did indeed have a stable UUID for me at 1/62E6. Better than the 1/680E6 from regular Firefox, but still upsetting. Fonts and Audio fingerprinting seems to be where a lot of the entropy is coming from... Even after I enabled some of the flags to resist font enumeration it still is stable and high entropy. I'm not sure what to do to be honest about this, it is very discouraging.

Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are

#16

Post by strbean »

Cool tool, but the language is painfully characteristic of AI. Maybe we are collectively getting over caring about that, but if not, it's worth a pass of "make this sound a little less like AI."

E.g., the guide page ends with

> The honest bottom line. Perfect anonymity [...]

Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are

#17

Post by moonlighter »

strbean wrote: post #16

Cool tool, but the language is painfully characteristic of AI. Maybe we are collectively getting over caring about that, but if not, it's worth a pass of "make this sound a little less like AI." E.g., the guide page ends with > The honest bottom line. Perfect anonymity [...]

* You're absolutely right! ;-)

Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are

#18

Post by rafram »

DavidD wrote: post #2

I built this after a thread here about Alibaba using an audio-context trick to fingerprint visitors. I knew a fair number of fingerprinting methods but not that one, and I wanted to see all of them in one place, running against my own browser. GlassBox runs ~31 probes (canvas, WebGL/WebGPU, audio, fonts, the WASM feature set, math/engine quirks, WebRTC IP, timezone/locale, the permission and API matrices, an incognit…

[dead]

Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are

#19

Post by [deleted] »

fooqux wrote: post #11
dylan604 wrote: post #8

Earlier quoted context omitted.

How would you prevent that? If you want to use a feature, you need to know if that feature is available. So you add methods/functions to ensure that you can fail gracefully when something is not available. That availability is the fingerprint. I don't blame the browsers as much as asshats using the tool for malicious purposes. We're not going to ban hammers because someone uses them for things other than driving nail…

In the old days, we just sent the content and let the client figure out what to do with it. If you navigated to homestarrunner.com and you didn't have flash installed, you just got a message saying to install it, or worst case, a broken icon in a frame. We figured it out just fine.

[deleted]
Post reply on HN