Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We found a stable Firefox identifier linking all your private Tor identities

fingerprint.com

Post reply on HN
Print view View original

111–120 of 306 posts

Re: We found a stable Firefox identifier linking all your private Tor identities

#111

Post by godelski »

zamadatix wrote: post #65
baobabKoodaa wrote: post #36

Earlier quoted context omitted.

Uhh okay, so they do exploit vulnerabilities, they just try to target victims who can be served ads? What a weird distinction.

Most users seem to not care about ad tech/tracking as much as technical users. Even further, most seem to want to enable more tracking to [protect the children or whatever the reason is] pretty regularly (at least in opinion polls about various legislation). ToR users are not at all like that + could be harmed in a very different way... so I think it's fair to frame them differently even if I'd personally say people…

  > Most users seem to not care about ad tech/tracking
I don't think this is true.

Most people don't understand that they're being tracked. The ones that do generally don't understand to what extent.

You tend to get one of two responses: surprise or apathy. When people say "what are you going to do?" They don't mean "I don't care" they mean "I feel powerless to do anything about it, so I'll convince myself to not care or think about it". Honestly, the interpretation is fairly similar for when people say "but my data isn't useful" or "so what, they sell me ads (I use an ad blocker)". Those responses are mental defenses to reduce cognitive overload.

If you don't buy my belief then reframe the question to make things more apparent. Instead asking people how they feel about Google or Meta tracking them, ask how they feel about the government or some random person. "Would you be okay if I hired a PI to follow you around all day? They'll record who you talk to, when, how long, where you go, what you do, what you say, when you sleep, and everything down to what you ate for breakfast." The number of people that are going to be okay with that will plummet. As soon as you change it from "Meta" to "some guy named Mark". You'll still get nervous jokes of "you're wasting money, I'm boring" but you think they wouldn't get upset if you actually hired a PI to do that?

The problem is people don't actually understand what's being recorded and what can be done with that information. If they did they'd be outraged because we're well beyond what 1984 proposed. In 1984 the government wasn't always watching. The premise was more about a country wide Panopticon. The government could be watching at any time. We're well past that. Not only can the government and corporations do that but they can look up historical records and some data is always being recorded.

So the reason I don't buy the argument is because 1984 is so well known. If people didn't care, no one would know about that book. The problem is people still think we're headed towards 1984 and don't realize we're 20 years into that world

Re: We found a stable Firefox identifier linking all your private Tor identities

#112

Post by 93po »

BeetleB wrote: post #101
michaelt wrote: post #87

Earlier quoted context omitted.

Browser fingerprinting is an unintended side-effect of things it's sorta-kinda reasonable for browsers to provide. A user agent that says the browser's version? Reasonable enough. Being able to ask for fonts, if the system has them? Difficult to have font support without that. Getting the user's timezone, language and keyboard layout? Reasonable. The size of the screen, and the size of the browser window? Difficult t…

I fantasize having a browser that I can use only for viewing content. No applications. No mail. No need for cookies. I can use a "regular" browser for more enhanced stuff. But for simple content consumption, we can just have a "dumb" browser that can't do much. > A user agent that says the browser's version? Reasonable enough. No user agent. I'm guessing it will need it for JavaScript or HTML features, and dynamicall…

i've had the same thought for 20 years and unfortunately it's less likely than ever to happen now, given how many sites require javascript and have cloudflare pages before even loading a site (I get several a day).

thankfully i think traditional web surfing is probably going to die out in the next 10 years, and progressively decline a lot much sooner than that as people start to interact with AI rather than browsers (or any software for that matter).

my feed of hackernews is going to be my AI agent giving it to me in plain text very soon, and soon after that i will probably never visit the internet again because it will be impossible to know what's real and fake

as a millennial it will be interesting to experience the full cycle of being born when nothing was online, to everything being online, to then again being entirely offline by the time i'm older

Re: We found a stable Firefox identifier linking all your private Tor identities

#113

Post by angry_octet »

sva_ wrote: post #5

Does Tor Browser still allow JavaScript by default? Because if you block execution of JavaScript, you won't be affected from what I understand.

Because TBB has javascript on by default, turning it off increases your signature. It would be better if TBB defaulted to js off, with a front panel button to turn it on.

JS also dramatically improves security. TBB is stuck in a 90s mindset about privacy, as if Firefox exploits were not dime a dozen. Especially with AI making FF exploits more available, we can expect many tor sites to be actively attacking their visitors.

Re: We found a stable Firefox identifier linking all your private Tor identities

#115

Post by rockskon »

subscribed wrote: post #51
mtlynch wrote: post #19

Earlier quoted context omitted.

I don't understand what you mean. What separates this from other fingerprinting techniques your company monetizes? No software wants to be fingerprinted. If it did, it would offer an API with a stable identifier. All fingerprinting is exploiting unintended behavior of the target software or hardware.

Iffy vs grossly unethical.

Someone discovering and making this public it doesn't mean others haven't independently discovered it.

Re: We found a stable Firefox identifier linking all your private Tor identities

#116

Post by snailmailman »

francoi8 wrote: post #108
michaelt wrote: post #87

Earlier quoted context omitted.

Browser fingerprinting is an unintended side-effect of things it's sorta-kinda reasonable for browsers to provide. A user agent that says the browser's version? Reasonable enough. Being able to ask for fonts, if the system has them? Difficult to have font support without that. Getting the user's timezone, language and keyboard layout? Reasonable. The size of the screen, and the size of the browser window? Difficult t…

All of these could have a set of standard non identifiable answers (eg. firefox reports the same 20 fonts, couple video formats, one among a few standard window sizes etc.) and for anything more extensive/precise, it would require the user's authorization and the user should have the option of feeding fake info (eg. fake timezone)

Firefox's "Resist fingerprinting" does this. It sets timezone to UTC, standardizes the fonts, standardizes a whole bunch of other fingerprinting data, etc. It also has a "letterboxing" option to round screensize down to the nearest 100px and stuff too. Tor uses all of those settings by default, though they are also in standard firefox in about:config.

When i use Resist Fingerprinting my main issue is the timezone being set to UTC. most of the other stuff it does never causes issues. I guess sometimes sites need to read the canvas, but theres a permission box that allows that when needed. I wish there was a similar permission box for timezone.

The only other drawback to the "resist fingerprinting" option is you will encounter cloudflares' captcha checkbox everywhere and all of the time :(

Re: We found a stable Firefox identifier linking all your private Tor identities

#117

Post by angry_octet »

anthk wrote: post #26

The best for Tor would just be Links2/Links+ with the socks4a proxy set to 127.0.0.1:9050, enforcing all connection thru a proxy in the settings (mark the checkbox) and disabling cookies altogether.

The best is probably tor in a VM, chromium in a separate VM, javascript disabled, on a private virtual network, with a egress firewall (not just guest VM firewalls, but enable those too) that only allows traffic from a specific origin port on the tor machine. You would also want the VM to spoof the processor features and unique IDs. System time drift/offset remains a vector which is hard to deal with.

Dump the rendered window pixels out to a simple viewer. Mouse movement is still a pain to deal with, but I would default to spoofing it as moving between clicks, with some image parsing logic to identify menu traversal.

Then it should reboot the browser process regularly.

I've been waiting for someone to make a packaged 'VPC in a box' incorporating networking and linked VMs.

Re: We found a stable Firefox identifier linking all your private Tor identities

#118

Post by diydsp »

celsoazevedo wrote: post #83
lyu07282 wrote: post #79

Earlier quoted context omitted.

What are you even saying? It's like getting upset at somebody who criticizes a criminal because they once helped some grandma across the street. I'm not upset at the criminal because they helped a grandma across the street obviously that's not the fucking point.

I'm not upset, I just don't think we should criticize someone for doing something good. Maybe they're a terrible org, maybe they deserve criticism most of the time, but not in this instance. It's not like you can't point out that they did a good deed, but that they're still in the shitty business of fingerprinting users. Also, if people only get the stick no matter what they do, then eventually some will embrace the…

This isn't a someone. It's a corporation, a legal fiction explicitly designed to dissolve responsibility.

Re: We found a stable Firefox identifier linking all your private Tor identities

#119

Post by snailmailman »

ranger_danger wrote: post #114

You can also fingerprint browsers profile-wide across sessions without any JS, CSS or even HTML, using the favicon: https://github.com/jonasstrehle/supercookie

I think most browsers have patched this out? i didnt do super concrete tests, but at least on my machine their demo is failing to fingerprint me across private browsing/incognito sessions as they claim. Tested in firefox and edge.

Re: We found a stable Firefox identifier linking all your private Tor identities

#120

Post by prophesi »

mtlynch wrote: post #19
valve1 wrote: post #15

Earlier quoted context omitted.

We don't use vulnerabilities in our products.

I don't understand what you mean. What separates this from other fingerprinting techniques your company monetizes? No software wants to be fingerprinted. If it did, it would offer an API with a stable identifier. All fingerprinting is exploiting unintended behavior of the target software or hardware.

I think HN needs a refresher on responsible disclosure, and that even vulnerability scanners engage in this practice for obvious reasons in that it benefits both parties. One party gains exposure, and the other gets exposure and their bug squashed without the bug wrecking havoc while they try to squash it.
Post reply on HN