Lots of ideas, many of which I've had as well, but I am missing conclusions. On the demo page it tells me my CPU benchmark and some scrolling measurements. Great, but how unique was that now? And how are you going to make the data points into a fingerprint? Because next time I scroll, I will totally scroll a millisecond differently.
Advanced Tor Browser Fingerprinting
11–20 of 34 posts
Re: Advanced Tor Browser Fingerprinting
#12Did the author of the article submit his findings to the Tor Project?
I'm sure at least one developer of the Tor project reads hacker news. EDIT: Far more interesting is the author's most recent article.... wtf http://jcarlosnorte.com/security/2016/03/06/hacking-tachogra...
[deleted]
Re: Advanced Tor Browser Fingerprinting
#13Did the author of the article submit his findings to the Tor Project?
I'm sure at least one developer of the Tor project reads hacker news. EDIT: Far more interesting is the author's most recent article.... wtf http://jcarlosnorte.com/security/2016/03/06/hacking-tachogra...
Still, what with responsible disclosure etc.?
Re: Advanced Tor Browser Fingerprinting
#14Demo does nothing for me. I'm dubious how repeatable or unique those results are.
Re: Advanced Tor Browser Fingerprinting
#15Lots of ideas, many of which I've had as well, but I am missing conclusions. On the demo page it tells me my CPU benchmark and some scrolling measurements. Great, but how unique was that now? And how are you going to make the data points into a fingerprint? Because next time I scroll, I will totally scroll a millisecond differently.
Yeah this seems very amateur. Lots of ideas of how to gather information from a user, but no thread about how to connect any of it back together.
The "Uber Cookie" is basically a readout of totally random metadata. The CPU benchmark is substantially different each time I run it.
Re: Advanced Tor Browser Fingerprinting
#16Earlier quoted context omitted.
I'm sure at least one developer of the Tor project reads hacker news. EDIT: Far more interesting is the author's most recent article.... wtf http://jcarlosnorte.com/security/2016/03/06/hacking-tachogra...
Still, what with responsible disclosure etc.?
It's just a survey without conclusion. The methods aren't unknown.
Re: Advanced Tor Browser Fingerprinting
#17Did the author of the article submit his findings to the Tor Project?
[deleted]
Re: Advanced Tor Browser Fingerprinting
#18>The most intersting fingerprinting vector I found on Tor Browser is getClientRects. Is strange that reading back from a canvas has been prevented but simply asking the browser javascript API how a specific DOM elements has been drawn on the screen has not been prevented or protected in any way.
This isn't as strange as he makes it sound, it is done to prevent the link color history attack [1]. Most of the other CSS properties aren't allowed on :active or :visited modifiers.
Re: Advanced Tor Browser Fingerprinting
#19Most of these are nullified by disabling JavaScript.
Re: Advanced Tor Browser Fingerprinting
#20I don't believe that any of these will link different Whonix instances on the same host machine. Using Tor browser in the same OS that you use for general work is not secure. Even sharing the same host machine is insecure, where anonymity really matters.