We found a stable Firefox identifier linking all your private Tor identities • Hacker News Board

Re: We found a stable Firefox identifier linking all your private Tor identities

#151

Post by NotPractical » Thu, Apr 23, 2026, 3:24 AM UTC

fc417fc802 wrote: post #129

strbean wrote: post #80

Earlier quoted context omitted.

There's a pretty big difference between: 1) wanting functionality that isn't provided and working around that and 2) restoring such functionality in the face of countermeasures The absence of functionality isn't a clear signal of intent, while countermeasures against said functionality is. And then there is the distinction between the intent of the software publisher and the intent of the user. There is a big ethical…

Even if the intent is clear I don't think the act of reading an available field qualifies as exploiting a vulnerability. IMO you need to actually work around a technical measure intended to stop you for it to qualify as an exploit.

Here's the technical measures that are being worked around: https://blog.mozilla.org/en/firefox/fingerprinting-protectio...

> IMO you need to actually work around a technical measure intended to stop you for it to qualify as an exploit.

Even well-known vulnerabilities like SQL injection don't qualify under this definition?

Re: We found a stable Firefox identifier linking all your private Tor identities

#152

Post by nurettin » Thu, Apr 23, 2026, 3:27 AM UTC

mtlynch wrote: post #19

valve1 wrote: post #15

Earlier quoted context omitted.

We don't use vulnerabilities in our products.

I don't understand what you mean. What separates this from other fingerprinting techniques your company monetizes? No software wants to be fingerprinted. If it did, it would offer an API with a stable identifier. All fingerprinting is exploiting unintended behavior of the target software or hardware.

Logically, they are doing correlation via publically available information - maybe better than others can - and an identifier would hurt their business since competition can use it as well.

Re: We found a stable Firefox identifier linking all your private Tor identities

#153

Post by zzo38computer » Thu, Apr 23, 2026, 3:39 AM UTC

ranger_danger wrote: post #114

You can also fingerprint browsers profile-wide across sessions without any JS, CSS or even HTML, using the favicon: https://github.com/jonasstrehle/supercookie

Some users disable favicons; I am one of them (although that is main because I do not use them, rather than due to that).

Re: We found a stable Firefox identifier linking all your private Tor identities

#154

Post by autoexec » Thu, Apr 23, 2026, 3:48 AM UTC

zamadatix wrote: post #65

baobabKoodaa wrote: post #36

Earlier quoted context omitted.

Uhh okay, so they do exploit vulnerabilities, they just try to target victims who can be served ads? What a weird distinction.

Most users seem to not care about ad tech/tracking as much as technical users. Even further, most seem to want to enable more tracking to [protect the children or whatever the reason is] pretty regularly (at least in opinion polls about various legislation). ToR users are not at all like that + could be harmed in a very different way... so I think it's fair to frame them differently even if I'd personally say people…

> Most users seem to not care about ad tech/tracking as much as technical users.

Part of the problem is the misconception that the data being collected is only being used to determine which ads to show them. Companies love to frame it that way because ultimately people don't actually care that much about which ads they get shown. The more people get educated on the real world/offline uses of the data they're handing over the more they'll start to care about the tracking being done.

Re: We found a stable Firefox identifier linking all your private Tor identities

#155

Post by autoexec » Thu, Apr 23, 2026, 3:54 AM UTC

OneDeuxTriSeiGo wrote: post #64

mtlynch wrote: post #19

Earlier quoted context omitted.

I don't understand what you mean. What separates this from other fingerprinting techniques your company monetizes? No software wants to be fingerprinted. If it did, it would offer an API with a stable identifier. All fingerprinting is exploiting unintended behavior of the target software or hardware.

A vulnerability is distinct from unintended behavior. Unintended identification is less than ideal but frankly is just the nature of doing business and any number of niceties are lost by aggressively avoiding fingerprinting. In software intentionally optimized to avoid any fingerprinting however it is a vulnerability. The distinction being that fingerprinting in general is a less than ideal side effect that gives you…

> fingerprinting in general is a less than ideal side effect that gives you a minor loss in privacy

In what way is collecting a record of a person's browsing history a "minor loss" of privacy. For many people, tracking everywhere they go online would easily expose the most sensitive personal information they have.

Re: We found a stable Firefox identifier linking all your private Tor identities

#156

Post by autoexec » Thu, Apr 23, 2026, 4:02 AM UTC

ranger_danger wrote: post #128

lmz wrote: post #125

Earlier quoted context omitted.

The opt in checkbox is labeled "Enable Javascript"

https://fingerprint.com/blog/disabling-javascript-wont-stop-... https://github.com/jonasstrehle/supercookie

When I go to https://noscriptfingerprint.com/ all I see is a blank page. My browser is pretty locked down in other ways which probably helps, but I'm still taking that as a good sign.

Re: We found a stable Firefox identifier linking all your private Tor identities

#157

Post by autoexec » Thu, Apr 23, 2026, 4:03 AM UTC

mmooss wrote: post #37

bawolff wrote: post #10

From the sounds of this it sounds like it doesn't persist past browser restart? I think that would significantly reduce the usefulness to attackers.

Many users leave their browsers open for months.

Open enough tabs and you'd be lucky to keep firefox running for more than a couple weeks.

Re: We found a stable Firefox identifier linking all your private Tor identities

#158

Post by bfivyvysj » Thu, Apr 23, 2026, 4:07 AM UTC

I learned enough about security years ago that there's basically zero chance you're secure and almost 100% chance someone is watch everything you do online.

Whether they care is entirely separate.

Re: We found a stable Firefox identifier linking all your private Tor identities

#159

Post by autoexec » Thu, Apr 23, 2026, 4:08 AM UTC

francoi8 wrote: post #108

michaelt wrote: post #87

Earlier quoted context omitted.

Browser fingerprinting is an unintended side-effect of things it's sorta-kinda reasonable for browsers to provide. A user agent that says the browser's version? Reasonable enough. Being able to ask for fonts, if the system has them? Difficult to have font support without that. Getting the user's timezone, language and keyboard layout? Reasonable. The size of the screen, and the size of the browser window? Difficult t…

All of these could have a set of standard non identifiable answers (eg. firefox reports the same 20 fonts, couple video formats, one among a few standard window sizes etc.) and for anything more extensive/precise, it would require the user's authorization and the user should have the option of feeding fake info (eg. fake timezone)

Ideally you'd have browsers randomizing what they send instead of reporting the same info every time. That way even a deviation from the "norm" can't be assumed to ID someone.

Re: We found a stable Firefox identifier linking all your private Tor identities

#160

Post by fc417fc802 » Thu, Apr 23, 2026, 4:12 AM UTC

NotPractical wrote: post #151

fc417fc802 wrote: post #129

Earlier quoted context omitted.

Even if the intent is clear I don't think the act of reading an available field qualifies as exploiting a vulnerability. IMO you need to actually work around a technical measure intended to stop you for it to qualify as an exploit.

Here's the technical measures that are being worked around: https://blog.mozilla.org/en/firefox/fingerprinting-protectio... > IMO you need to actually work around a technical measure intended to stop you for it to qualify as an exploit. Even well-known vulnerabilities like SQL injection don't qualify under this definition?

Sure, my wording isn't perfect. I don't have a watertight definition ready to go. To my mind the spirit of the thing is that (for example) if a site has an http endpoint that accepts arbitrary sql queries and blindly runs them then sending your own custom query doesn't qualify as an exploit any more than scraping publicly accessible pages does. Whereas if you have to cleverly craft an sql query in a way that exploits string escapes in order to work around the restrictions that the backend has in place then that's technically an exploit (although it's an incredibly minor one against a piece of software whose developer has put on a display of utter incompetence).

The point isn't my precise wording but the underlying concept that making use of freely provided information isn't exploiting anything even if both the user and the developer are unhappy about the end result. Security boundaries are not defined post hoc by regret.