Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

Post by oftenwrong » Thu, Mar 07, 2019, 10:39 AM UTC

pmoriarty wrote: post #73

oftenwrong wrote: post #65

Earlier quoted context omitted.

The browser could pick a fake screen size, and behave in a way that is consistent with that fake screen size. This would probably break many sites, but it would mitigate fingerprinting if a common size was used.

This solution is just begging for side-channel attacks. Firefox had better make sure its timing is not affected by such shenanigans, for instance.

Post by oftenwrong » Thu, Mar 07, 2019, 10:41 AM UTC

dymk wrote: post #109

oftenwrong wrote: post #58

Earlier quoted context omitted.

Some would take enhanced privacy over properly-functioning sites. I wonder how broken sites would appear if the browser simply lied about such things.

There’s like a billion side channels to determine how big the screen is unless you just want to entirely break basic css. Which is a pretty unreasonable way to address this problem.

Post by dwd » Thu, Mar 07, 2019, 10:51 AM UTC

newscracker wrote: post #37

Every time there's something about online privacy with browsers, it's mostly Firefox or Safari. I wondered if Chrome had resisting fingerprinting on its radar (guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online), and I found this [1] confirming my guess (emphasis mine): > Since we don't believe it's feasible to provide some mode of Chrome that can truly prev…

Post by kowdermeister » Thu, Mar 07, 2019, 11:08 AM UTC

Post by thecatspaw » Thu, Mar 07, 2019, 11:14 AM UTC

gpvos wrote: post #152

burtonator wrote: post #24

Earlier quoted context omitted.

Apps need it to determine where to place elements. If it wasn't you would still be able to reverse engineer it by sticking elements outside the viewport and seeing if they're hidden or not. Turns out anonymity is super freaking hard. :-/

Would something like Perl's taint functionality work? I.e., all values derived from size, position, colour, pixel data, user agent, etc. are marked as tainted, and are stripped (or randomized or replaced with default values) from data that is sent over XMLHttpRequest and other communication methods. It's probably extremely hard to make that watertight though.