Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We found a stable Firefox identifier linking all your private Tor identities

fingerprint.com

Post reply on HN
Print view View original

141–150 of 306 posts

Re: We found a stable Firefox identifier linking all your private Tor identities

#141

Post by BeetleB »

0x62 wrote: post #110
BeetleB wrote: post #101

Earlier quoted context omitted.

I fantasize having a browser that I can use only for viewing content. No applications. No mail. No need for cookies. I can use a "regular" browser for more enhanced stuff. But for simple content consumption, we can just have a "dumb" browser that can't do much. > A user agent that says the browser's version? Reasonable enough. No user agent. I'm guessing it will need it for JavaScript or HTML features, and dynamicall…

Unfortunately you've now made an incredibly niche browser, and the lack of those metrics is a good fingerprint by itself. How browsers render SVGs can be used for fingerprinting (even the underlying OS affects this, and I assume you'll want to see those), combine with ISP from IP address, and unless theres hundreds users in every city you're now pretty easily trackable.

> Unfortunately you've now made an incredibly niche browser, and the lack of those metrics is a good fingerprint by itself.

If 100 people are using that browser, how will they know which one is me?

> How browsers render SVGs can be used for fingerprinting (even the underlying OS affects this, and I assume you'll want to see those)

Can you provide details on this? And how will they know which OS I'm using (through SVG rendering...)? The UserAgent definitely should not send the OS.

> combine with ISP from IP address

That's already provided whether I use Private mode or not, correct? I can always use a VPN.

Re: We found a stable Firefox identifier linking all your private Tor identities

#142

Post by trinsic2 »

celsoazevedo wrote: post #77
trinsic2 wrote: post #62

Earlier quoted context omitted.

It means they are suspect. I think its right to be wary of motives if they are involved in the very thing they aim to bring awareness too. Questions arise in my mind as to why they would do something like this in the first place. Its been my experience that the general public doesn't seem to follow patterns and instead focus on which switch is toggled at any given moment for a company's ethical practices. This is the…

I don't trust them more because of this and maybe they've disclosed it for the wrong reasons, like not allowing a competitor to use it when they don't, but at the end of the day they did disclose a serious issue, and that's good for users. I understand where you're coming from, by the way, but sometimes the worst person you know does the right thing and it's not fair to criticize them for doing it (you could say noth…

> I understand where you're coming from, by the way, but sometimes the worst person you know does the right thing and it's not fair to criticize them for doing it (you could say nothing, don't have to change your opinion about them, etc). We also don't want someone to go "if I'm bad no matter what I do, then might as well make some money with this" and sell the exploit.

I hear you. I guess I just want to promote more vigilance. Looking at patterns and motives helps us stay balanced about these things IMHO.

Re: We found a stable Firefox identifier linking all your private Tor identities

#143

Post by BeetleB »

bryan_w wrote: post #122
BeetleB wrote: post #101

Earlier quoted context omitted.

I fantasize having a browser that I can use only for viewing content. No applications. No mail. No need for cookies. I can use a "regular" browser for more enhanced stuff. But for simple content consumption, we can just have a "dumb" browser that can't do much. > A user agent that says the browser's version? Reasonable enough. No user agent. I'm guessing it will need it for JavaScript or HTML features, and dynamicall…

Just use Tor browser? You can turn the tor part off if you need the speed. What you want exists, have at it

As the submission shows, Tor browser isn't enough. My hypothetical browser would never have an IndexedDB API. Why should it?

"Web applications use it for offline support, caching, session state, and other local storage needs"

This use case is completely orthogonal to what my browser is meant to do. My browser would not have a concept of local storage.

The premise of starting with a modern browser and stripping away features to get privacy is flawed - it's always vulnerable to these types of things. I'm going the opposite route: Only add features if they cannot be exploited for monitoring.

Re: We found a stable Firefox identifier linking all your private Tor identities

#144

Post by angry_octet »

ux266478 wrote: post #123
angry_octet wrote: post #113

Earlier quoted context omitted.

Because TBB has javascript on by default, turning it off increases your signature. It would be better if TBB defaulted to js off, with a front panel button to turn it on. JS also dramatically improves security. TBB is stuck in a 90s mindset about privacy, as if Firefox exploits were not dime a dozen. Especially with AI making FF exploits more available, we can expect many tor sites to be actively attacking their visi…

> turning it off increases your signature. Tor endpoints are pretty easy to identify, there are plenty of handy databases for that, using it to begin with increases your uniqueness. If noscript was set to strictly disallow javascript by default, that decreases the degree to which it increases your signature relative to the baseline of using tor. Then we have to account for the simple fact that many, many fingerprinti…

Every server knows that you're using tor, we're only talking about whether they can match your traffic to you repeatably, and particularly across sessions, which then enables traffic analysis that can lead to complete deanonymisation.

If TBB changed to js off by default that signal would be less evident, and also, fingerprinting would be harder.

Re: We found a stable Firefox identifier linking all your private Tor identities

#145

Post by BeetleB »

BeetleB wrote: post #101
michaelt wrote: post #87

Earlier quoted context omitted.

Browser fingerprinting is an unintended side-effect of things it's sorta-kinda reasonable for browsers to provide. A user agent that says the browser's version? Reasonable enough. Being able to ask for fonts, if the system has them? Difficult to have font support without that. Getting the user's timezone, language and keyboard layout? Reasonable. The size of the screen, and the size of the browser window? Difficult t…

I fantasize having a browser that I can use only for viewing content. No applications. No mail. No need for cookies. I can use a "regular" browser for more enhanced stuff. But for simple content consumption, we can just have a "dumb" browser that can't do much. > A user agent that says the browser's version? Reasonable enough. No user agent. I'm guessing it will need it for JavaScript or HTML features, and dynamicall…

I can't edit, but I forgot to add:

No support for forms. The browser is meant for content consumption. Not for interaction/creation.

One could argue that any JS capabilities to do network requests (including dynamically rendering content) would be disallowed.

Yes, I know, this is going pre-Web 2.0.

Yes, of course, most current sites won't work in that model. But I'll also say: Most current content sites don't need these capabilities. They have them because they know the browser supports them.

Again - a fantasy. I know only a few people will use it. I know that won't be enough to change web behavior. It would be nice, though, if sites carried a badge to indicate they conform to all of the above.

Re: We found a stable Firefox identifier linking all your private Tor identities

#147

Post by tomrittervg »

sodality2 wrote: post #31
mtlynch wrote: post #19

Earlier quoted context omitted.

I don't understand what you mean. What separates this from other fingerprinting techniques your company monetizes? No software wants to be fingerprinted. If it did, it would offer an API with a stable identifier. All fingerprinting is exploiting unintended behavior of the target software or hardware.

Side channels that enable intended behavior, versus a flat-out bug like the above, though the line can often be muddied by perspective. An example that comes to mind that I've seen is an anonymous app that allows for blocking users; you can programmatically block users, query all posts, and diff the sets to identify stable identities. However, the ability to block users is desired by the app developers; they just may…

> Ultimately most fingerprinting technologies use features that are intended behavior

Strong disagree.

> IP address/cookies/useragent obviously are useful

Cookies are an intended tracking behavior. IP Address, as a routing address, is debatable.

> Canvas/font rendering is useful for some web features

These two are actually wonderful examples of taking web features and using them as a _side channel_ in an unintended way to derive information that can be used to track people. A better argument would be things like Language and Timezone which you could argue "The browser clearly makes these available and intends to provide this information without restriction." Using side channels to determine what fonts a user has installed... well there's an API for doing just that[0] and we (Firefox) haven't implemented it for a reason.

n.b. I am Firefox's tech lead on anti-fingerprinting so I'm kind of biased =)

[0] https://developer.mozilla.org/en-US/docs/Web/API/Local_Font_...

Re: We found a stable Firefox identifier linking all your private Tor identities

#148

Post by tomrittervg »

firefax wrote: post #61

The OP's link is timing out over Tor for me, but the Wayback[1] version loaded without issue. Also, does anyone know of any researchers in the academic world focusing on this issue? We are aware that EFF has a project that used to be named after a pedophile on this subject, but we are more looking for professors at universities or pure research labs ala MSR or PARC than activists working for NGOs, however pure their…

Mozilla is working on it. (I know you said 'Academic', but we publish papers sometimes too.)

Re: We found a stable Firefox identifier linking all your private Tor identities

#149

Post by AgentME »

VladVladikoff wrote: post #146

What are these databases not scoped to origin of creation like cookies?

They are. The leak is that if a webpage you visit creates several databases with certain names, the order is random but stays the same within the same browser session.

Re: We found a stable Firefox identifier linking all your private Tor identities

#150

Post by spelledwrong »

firefax wrote: post #61

The OP's link is timing out over Tor for me, but the Wayback[1] version loaded without issue. Also, does anyone know of any researchers in the academic world focusing on this issue? We are aware that EFF has a project that used to be named after a pedophile on this subject, but we are more looking for professors at universities or pure research labs ala MSR or PARC than activists working for NGOs, however pure their…

>We are aware that EFF has a project that used to be named after a pedophile on this subject

You bring this up like it's a well known incident, but my googling can find no evidence of it? The only reason not say the name of the project would be if it's common knowledge, but it's not?

ChatGPT research reckons you're making it up, and I'd be curious if you have evidence to the contrary?

Post reply on HN