Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: GlassBox – what the browser reveals, and how identifiable you are

glassbox.codecanary.org

Post reply on HN
Print view View original

31–40 of 71 posts

Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are

#31

Post by saaaaaam »

Retr0id wrote: post #28
saaaaaam wrote: post #22

Pretty sure someone else also promoted Claude to make something like this and posted it a few weeks back.

Recently discussed prompts: https://news.ycombinator.com/item?id=48727059 [flagged] What any website can see about you https://news.ycombinator.com/item?id=48062178 A web page that shows you everything the browser told it without asking https://news.ycombinator.com/item?id=49182352 Show HN: Modern Browsers Don't Need the Cookie Anymore https://news.ycombinator.com/item?id=46517654 [flagged] Show HN: DevicePrint – dev…

Haha! Well done for putting in the effort to find those. I was sure I’d seen it more than once but didn’t want to overrreach!

Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are

#32

Post by dylan604 »

fooqux wrote: post #11
dylan604 wrote: post #8

Earlier quoted context omitted.

How would you prevent that? If you want to use a feature, you need to know if that feature is available. So you add methods/functions to ensure that you can fail gracefully when something is not available. That availability is the fingerprint. I don't blame the browsers as much as asshats using the tool for malicious purposes. We're not going to ban hammers because someone uses them for things other than driving nail…

In the old days, we just sent the content and let the client figure out what to do with it. If you navigated to homestarrunner.com and you didn't have flash installed, you just got a message saying to install it, or worst case, a broken icon in a frame. We figured it out just fine.

Right, but the client side did a query to see what was available and gracefully displayed a message. People are now sending the truthy response of the feature's availability back. You could be doing that as a legit bit of logging, or you could be doing that to be an asshat and deanonymize the user. The browser doesn't know the intent of being asked about a feature. And yes, it has been figured out just fine as a way for making someone money by selling information about you

Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are

#34

Post by keito »

dylan604 wrote: post #6

If your ISP issues an IPv6 address, isn't that pretty much game over for anonymity/uniqueness?

Not usually, if you're comparing it to IPv4. Many ISPs give each customer a persistent IPv4 address that doesn't tend to change over time. Because most people use NAT (internal IP address != external IP address), a server you connect to can't identify the specific computer or device.

With IPv6, it's true that in many cases servers will see you as connecting from the specific IPv6 address of your computer/device. However, IPv6 addresses contain many parts, like:

  2001:db8:1234:5600 : abcd:1234:5678:9abc
where the left part is basically the equivalent of the unchanging IPv4 address you got from the ISP, and the right part identifies your specific device. But in most OSes the right part is randomly generated and changes on some cadence (e.g. daily).

So in many cases, the ability for a server to individually fingerprint your device solely based on the IP address is roughly equivalent between IPv4 and IPv6. (This isn't the case if the ISP does CGNAT on IPv4, where you're sharing your IPv4 address with many customers - this would be similar in magnitude to a VPN in terms of the ability for a server to fingerprint you based on IP.)

Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are

#35

Post by Retr0id »

saaaaaam wrote: post #31
Retr0id wrote: post #28

Earlier quoted context omitted.

Recently discussed prompts: https://news.ycombinator.com/item?id=48727059 [flagged] What any website can see about you https://news.ycombinator.com/item?id=48062178 A web page that shows you everything the browser told it without asking https://news.ycombinator.com/item?id=49182352 Show HN: Modern Browsers Don't Need the Cookie Anymore https://news.ycombinator.com/item?id=46517654 [flagged] Show HN: DevicePrint – dev…

Haha! Well done for putting in the effort to find those. I was sure I’d seen it more than once but didn’t want to overrreach!

The trick is that in most cases, someone links https://coveryourtracks.eff.org/

Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are

#36

Post by smohare »

dylan604 wrote: post #30
drsalt wrote: post #23

Earlier quoted context omitted.

need to license swe just like real engineers and make them have a responsibility to the public

And what about SWE from outside whatever jurisdiction that body issues those licenses? You cannot regulate your way out of tech problem if everyone is not subject to said regulations. Why people keep making comments like this is beyond me.

[dead]

Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are

#37

Post by latexr »

DavidD wrote: post #29
ZihengQin wrote: post #21

Interesting work! Would randomnize the least frequent used fonts, apis and settings be an way to anti-fingerprinting?

Fun fact: some malware won't execute if it sees a Russian/Ukrainian keyboard layout, because the authors avoid hitting victims in their own jurisdiction.

https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...

Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are

#38

Post by DavidD »

janfoeh wrote: post #13

The "Hardware & Environment" part which supposedly links me across different browsers doesn't work — it differs between Safari, Firefox and Chromium. In a private Safari window, it's not even stable across reloads.

[dead]

Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are

#39

Post by MeetingsBrowser »

strbean wrote: post #16

Cool tool, but the language is painfully characteristic of AI. Maybe we are collectively getting over caring about that, but if not, it's worth a pass of "make this sound a little less like AI." E.g., the guide page ends with > The honest bottom line. Perfect anonymity [...]

Not just the language. Its like all LLM front end design is working off one of three templates.

Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are

#40

Post by StilesCrisis »

dylan604 wrote: post #8
bravoetch wrote: post #5

It's horrifying to see that our browsers give up anything at all. I feel like we need a new model where we just get served the content, and we don't serve up anything to the content provider. I feel ill.

How would you prevent that? If you want to use a feature, you need to know if that feature is available. So you add methods/functions to ensure that you can fail gracefully when something is not available. That availability is the fingerprint. I don't blame the browsers as much as asshats using the tool for malicious purposes. We're not going to ban hammers because someone uses them for things other than driving nail…

Another one is "draw text, read back pixels" which is simultaneously a really effective fingerprint, and also cuts to the core of what we want a web browser to do. We can't refuse to draw text.
Post reply on HN