Browser Fingerprinting Without JavaScript • Hacker News Board

Re: Browser Fingerprinting Without JavaScript

#111

Post by _8j50 » Sat, Oct 30, 2021, 1:36 PM UTC

po1nt wrote: post #86

_8j50 wrote: post #9

Earlier quoted context omitted.

No, it's a legal problem. There are countries where groping women is not a big deal for example. Even in the most "ideal" EU countries, casual racism is an afterthought. Reaction is a problem because there is no adverse consequence to the perpetrator. I don't need a browser extension, I need CEOs in prison. Then reactions will catch up.

How did you bring up groping and racism into CSS fingerprinting topic?

Except I was replying to a comment about systemic acceptance of privacy deprivation. Groping and racism are considered unacceptable in most places, good case studies to correlatr and then find cause of systemic acceptances.

Interesting how you are trying to change the conversation and make it about the analogy used to analyze the root cause of the issue described in the post.

Re: Browser Fingerprinting Without JavaScript

#112

Post by _8j50 » Sat, Oct 30, 2021, 1:37 PM UTC

SahAssar wrote: post #108

_8j50 wrote: post #9

Earlier quoted context omitted.

No, it's a legal problem. There are countries where groping women is not a big deal for example. Even in the most "ideal" EU countries, casual racism is an afterthought. Reaction is a problem because there is no adverse consequence to the perpetrator. I don't need a browser extension, I need CEOs in prison. Then reactions will catch up.

> Even in the most "ideal" EU countries, casual racism is an afterthought Could you clarify what you mean and what countries?

I would rather not distract from the discussion at hand. If you don't already know the answer to that, I would rather not discuss the subject here.

Re: Browser Fingerprinting Without JavaScript

#113

Post by _8j50 » Sat, Oct 30, 2021, 1:57 PM UTC

thrashh wrote: post #14

_8j50 wrote: post #9

Earlier quoted context omitted.

No, it's a legal problem. There are countries where groping women is not a big deal for example. Even in the most "ideal" EU countries, casual racism is an afterthought. Reaction is a problem because there is no adverse consequence to the perpetrator. I don't need a browser extension, I need CEOs in prison. Then reactions will catch up.

I think it’s a cultural problem. Things are or are not a problem in certain places because that’s just how things have been done. You pick it up when you grow up in that culture. Which leads to the problem of determining what is actually right or wrong. For example, I naturally believe that racism is wrong because of the culture I grew up in (multicultural California) tells me that it’s wrong. But I also believe it i…

You bring up an interesting point. But even at the peak of slavery in the US, there were "white" people who believed all people are created equal and deserve equal rights, some even helped free slaves.

I think it is more of a worldview thing which is influenced by local culture. You beliefs about answers to fundamental questions like why do people exist? What are valid authority systems and structures? What is the origin of humans? And more questions like this, makes the difference.

I believe racism is wrong because I don't believe race is a thing beyond a social classification system. I believe in ethnicities and diffrences between them, but humans share a common origin. Even if some humans have less or more capability to do certain things than others, in order to be just, one must evaluate others as individuals not groups. Even if some statistic about a group can predict behavior of all but one members of a group, prejudice against that one member is still unjust and unfair, We should treat others the way we want to be treated ourselves.

But back to the topic, I think I agree with you that why we believe privacy is important is critical to make any improvements or changes. Simply put, privacy is power. When someone deprives you of privacy against your consent (where expectation of it is readonable), they are excercising power over you. They are excecising a claim that for whatever reason, information about you now belongs to them. If all or most information about you belongs to someone, you are now their subject.

It could be as simple as a lack of understanding of the implications of privacy deprivation.

Re: Browser Fingerprinting Without JavaScript

#114

Post by dylan604 » Sat, Oct 30, 2021, 2:35 PM UTC

onion2k wrote: post #62

dylan604 wrote: post #32

Earlier quoted context omitted.

Yes, let's limit creativity because some asshats have made looking at a list of fonts a negative. Let's just limit fonts altogether and only use emojis or braille like dot patterns.

let's limit creativity because some asshats have made looking at a list of fonts a negative Yes. Security and privacy come at the expense of other things. It's not totally unreasonable to prioritize them though. It would limit creativity, but not by very much.

Or another way to look at it, you go to the doctor because your head hurts so they give you aspirin to treat the symptom rather than treating cause from the gaping wound.

We keep suggesting things like limiting use of fonts as a polyfill for not being able to create legislation or what not. How about not exposing the available fonts to the browser through JS? If the font is not available, it should silently regress through options listed in CSS or browser defaults. JS can request a font, and it can be used if available. If it's not available, JS shouldn't need to know about it.

Re: Browser Fingerprinting Without JavaScript

#115

Post by 0xdeadb00f » Sat, Oct 30, 2021, 3:12 PM UTC

robbedpeter wrote: post #56

0xdeadb00f wrote: post #54

Earlier quoted context omitted.

Rooting your phone and it being secure are two completely different things my friend.

I can't tell if you're trying to say unrooted phones with stock carrier roms are somehow understood to be secure, or if rooting is mutually incompatible with security, or something else. Want to expound?

Someone already linked a thread by a GrapheneOS dev. This is useful too.

https://madaidans-insecurities.github.io/android.html#rootin...

Re: Browser Fingerprinting Without JavaScript

#116

Post by SahAssar » Sat, Oct 30, 2021, 3:15 PM UTC

_8j50 wrote: post #112

SahAssar wrote: post #108

Earlier quoted context omitted.

> Even in the most "ideal" EU countries, casual racism is an afterthought Could you clarify what you mean and what countries?

I would rather not distract from the discussion at hand. If you don't already know the answer to that, I would rather not discuss the subject here.

If you don't want to say what you imply then perhaps don't imply it at all. You actually explaining what you're implying will not distract unless the original implication was also distracting. This just makes it look like you want to state opinions as facts without even stating the opinion fully.

Re: Browser Fingerprinting Without JavaScript

#117

Post by 0xdeadb00f » Sat, Oct 30, 2021, 3:16 PM UTC

southerntofu wrote: post #98

0xdeadb00f wrote: post #55

Earlier quoted context omitted.

Did you see the spefific CSS hack they use to tell if you're using the Tor Browser as opposed to normal Firefox?

I did, but i personally don't care that everyone knows i'm using a tor browser. TBB is like a digital black block [0]: it is known i'm in there but nobody knows who i am in that crowd. [0] https://en.wikipedia.org/wiki/Black_block

Tor's techniques also make it a monoculture. The smallest fuck up that makes you just a little bit more identifiable normally, makes you stick out like a sore thumb among TBB users.

Re: Browser Fingerprinting Without JavaScript

#118

Post by getcrunk » Sat, Oct 30, 2021, 6:07 PM UTC

noduerme wrote: post #76

onion2k wrote: post #60

Earlier quoted context omitted.

The font-face attack in the article requires loading the font from a remote location. A JS font numeration attack works with local fonts. That would need a different mitigation in the browser, but browsers could, for example, have an array limited to three elements that JS gets when it asks for a font list, or just return the system default fonts, or just say no. A permission to get the full list would be necessary f…

Also, fingerprinting is not necessarily an attack at all. I use it frequently to see whether a user is logging in from an unknown box, in which case we'll require secondary authentication. It's actually not a bad thing if you're using it as one part of a verification process to secure user accounts. It only gets bad if you track people around with it or share those prints with other sites to aggregate behavioral data…

That's a great point! And all the more reason for why the user should be able to allow or disallow it.

Re: Browser Fingerprinting Without JavaScript

#119

Post by IshKebab » Sat, Oct 30, 2021, 6:13 PM UTC

chrischapman wrote: post #107

> And since most websites require JavaScript to function properly, using this method to preserve your online privacy will invariably lead to a suboptimal web experience. Great article and a good demo and insight into CSS capabilities in particular but I have to disagree with the above quote taken from the article. I surf the web with JavaScript disabled and the words 'most', 'properly' and 'suboptimal' in my view are…

"I disagree with this obviously true statement because I've decided to redefine all the terms so that it's wrong."

Re: Browser Fingerprinting Without JavaScript

#120

Post by _8j50 » Sat, Oct 30, 2021, 9:55 PM UTC

SahAssar wrote: post #116

_8j50 wrote: post #112

Earlier quoted context omitted.

I would rather not distract from the discussion at hand. If you don't already know the answer to that, I would rather not discuss the subject here.

If you don't want to say what you imply then perhaps don't imply it at all. You actually explaining what you're implying will not distract unless the original implication was also distracting. This just makes it look like you want to state opinions as facts without even stating the opinion fully.

As far as I know and intended this is common knowledge. Plenty of ways to find out which countries treat foreigners and minorities badly. Either I list all EU countries or you are asking me to build a case against specific ones. Either way, I am not interested, if you wish to believe otherwise then consider my statement an opinion.