Browser Fingerprinting Without JavaScript • Hacker News Board

Re: Browser Fingerprinting Without JavaScript

#121

Post by SahAssar » Sat, Oct 30, 2021, 10:11 PM UTC

_8j50 wrote: post #120

SahAssar wrote: post #116

Earlier quoted context omitted.

If you don't want to say what you imply then perhaps don't imply it at all. You actually explaining what you're implying will not distract unless the original implication was also distracting. This just makes it look like you want to state opinions as facts without even stating the opinion fully.

As far as I know and intended this is common knowledge. Plenty of ways to find out which countries treat foreigners and minorities badly. Either I list all EU countries or you are asking me to build a case against specific ones. Either way, I am not interested, if you wish to believe otherwise then consider my statement an opinion.

If it is common knowledge then it should be easy for you to link me a source for what what you are referring to.

Re: Browser Fingerprinting Without JavaScript

#122

Post by kevingadd » Sun, Oct 31, 2021, 3:41 AM UTC

onion2k wrote: post #63

kevingadd wrote: post #47

Earlier quoted context omitted.

Different languages often require you to use different fonts, there are very few fonts that contain characters for all languages. Ranges using specific languages are tagged with the 'lang' attribute so the browser can use the appropriate font. If you aren't allowed to include any font face rules you lose the ability to handle multiple languages (unless all the languages you care about use codepoints below 255). Itali…

Internationalization and localization don't require more fonts, just different fonts. When a user is viewing a site in English they'd see a different font to a user viewing a page in Japanese. That's fine. Just serve one a stylesheet with the English font first, and the other a site with the Japanese font first. They would still work fine. Bold and italic were different fonts in the past, but variable fonts have solv…

"Viewing a site in English" misunderstands the problem. Mixed-language content is a reality. Not all websites are a single language, because they can host user-generated content or snippets of content in other languages (commentary on translated material, live translations, instructional material, etc.)

Re: Browser Fingerprinting Without JavaScript

#123

Post by benmmurphy » Tue, Nov 02, 2021, 1:41 AM UTC

southerntofu wrote: post #102

benmmurphy wrote: post #33

Earlier quoted context omitted.

TCP fingerprinting TOR would fingerprint the exit node

That's a fair interpretation! I'm not familiar with tor internals, but i assumed after removing the last encryption layer, the exit node would "expose" raw TCP trafic from the original requester. Otherwise, how does it work?

TCP is a bidirectional stream so ignoring some of the edge cases you can just proxy it across any stream transport. in the case of TOR it sets up a bidirectional stream across its network and then bytes come into the exit node over the TOR stream and then the exit node just writes them out using the normal operating system write() method. bytes then come from the normal operating system read() method on the exit node and the TOR exit node just sends them back over the TOR stream. on the client node setting up the stream over the TOR network and receiving/sending is exposed as a SOCKS proxy but i guess you could also have something fancy which intercepted traffic transparently (https://gitlab.torproject.org/legacy/trac/-/wikis/doc/Transp...). i haven't looked at the TOR project for a while but it looks like they are heavily pushing the TOR browser which I guess means the user is not exposed to any proxy setup and can't accidentally misconfigure things in a way that would break their anonymity.

Re: Browser Fingerprinting Without JavaScript

#124

Post by ranger_danger » Wed, Nov 03, 2021, 6:47 PM UTC

southerntofu wrote: post #101

ranger_danger wrote: post #64

Earlier quoted context omitted.

not OP but rooting is incompatible with security.

What's your threat model? Is it more secure that you as a user can execute root code? Or that your phone manufacturer can without asking for your permission? Modern smartphones are basically spyware distros. I would argue it's far more secure to run a decent distro (Lineage/Replicant) with root, than it is to run any SamWeiMi crapware without root. Oh yes, the manufacturer's crapware has system privileges whether you…

Even with a custom ROM that includes no google anything whatsoever, you still should not have root... that's what I mean. Just like how you should always use Secure Boot (but LineageOS requires you leave it off).