Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox expands fingerprint protections

blog.mozilla.org

Post reply on HN
Print view View original

161–170 of 177 posts

Re: Firefox expands fingerprint protections

#161

Post by pixelmelt »

nalekberov wrote: post #31

Fingerprinting is nearly impossible to resist these days anyways, no matter which technics Firefox uses to reduce it, and sometimes it actually makes the browser appear more unique. Last time I tried everything I could to prevent Firefox from calling home, it was still requesting Mozilla servers. Though I haven’t given up, my plan is disabling it at source code level and build my own release.

I'm working on building a bot detection platform to defend websites right now and yeah, without immense effort on the part of the browsers, you are correct. Any of the apis they injected noise into here will be updated in the competant fingerprinting programs as well. The only real solution is to not enable JavaScript at all.

Re: Firefox expands fingerprint protections

#162

Post by kalaksi »

drnick1 wrote: post #150
kalaksi wrote: post #130

Earlier quoted context omitted.

> I would love to see this taken one step further and have states/countries prevent companies from tracking me altogether if I reject their cookies You're in luck since EU's GDPR is about informing users of PII harvesting and consent in general (among other things). So the banner is not only about cookies. And I think nowadays there are similar regulations elsewhere.

The last thing I want to see is more banners that don't actually do anything for your privacy. Let's be real, websites/companies will do whatever they want with your data, the banner is just for show.

I was just pointing out to parent that it already happens...

Re: Firefox expands fingerprint protections

#164

Post by charcircuit »

godelski wrote: post #158
charcircuit wrote: post #153

Earlier quoted context omitted.

The real power is in who owns the product. Since chromium is open source. A fork can be made at anytime. For the web there is a lot of common code that is useful to share between browsers.

Your take is quite naïve. The problem is that Google is controlling all the protocols. We're already in a situation where chrome, and consequently chromium, is "the most up to date browser" because Google has a heavy influence in dictating what those standards are. This is, of course, why people fork chromium in the first place, because it gives them a leg up not needing to build everything from scratch and allows th…

>if they get to dictate how all the roads get used and how all the maps are made?

That power comes from the market share of Chrome, the product. It doesn't come from the market share of blink, the browser engine. If you want to challenge the power of Google you need an alternate product, and not an alternate browser engine. Maintaining an opinionated fork is cheaper than maintaining an alternate browser engine. This allows you to invest more resources into the product itself instead of the browser engine engine.

Re: Firefox expands fingerprint protections

#165

Post by philipallstar »

wtallis wrote: post #77
philipallstar wrote: post #65

Earlier quoted context omitted.

The quote I gave was the context, not GDPR.

"not gating information behind said sign-ups" was in the context of regulations like GDPR. You twisted that into "People should do work for free" which is not at all the meaning of what you replied to.

GDPR is nothing to do with stopping locking info behind a signup. Not at all.

People lock info behind a signup if they want to to monetise. Something stopping that is forcing advertising as the monetisation strategy, or else saying people should work for free.

Re: Firefox expands fingerprint protections

#166

Post by kube-system »

unethical_ban wrote: post #154
kube-system wrote: post #82

Earlier quoted context omitted.

The actual industry standard for Do Not Track is to ignore it. It is deprecated. The browser we are talking about in this post, Firefox, removed support for Do Not Track in February of this year. https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...

To my credit, WaPo should have said that instead of saying there isn't a standard. The standard is gone.

I was a bit glib with my answer, but I don’t think what they said is wrong. Just because something is a written standard doesn’t mean it is an observed standard. WaPo was clearly referring to the lack of an observed standard. I don’t think they were denying the existence of API specifications, nor do I think that’s a reasonable interpretation. They’re saying that nobody treated it the same way, which is true, and it’s also the reason why it was deprecated in the first place.

Re: Firefox expands fingerprint protections

#167

Post by tomrittervg »

Dwedit wrote: post #10
zuhsetaqi wrote: post #6

Earlier quoted context omitted.

Like the articel says those features can be disabled on a per site basis.

You are able to toggle these specific named categories: * Cookies * Tracking Content * Cryptominers * Known Fingerprinters * Suspected Fingerprinters But there is no separate toggle for the feature that adds noise to the image, or indication of which toggle would affect that.

It's 'Suspected Fingerprinters' that controls the Fingerpritning Protection feature described in the blog post. But yes, naming and descriptions is hard and never seems to work.

But to disable it on a per-site basis, I would just disable ETP for the entire site. If it's a service or site you use frequently you probably trust them or otherwise have a login to them that makes trying to avoid fingerprinting illogical.

Re: Firefox expands fingerprint protections

#168

Post by tomrittervg »

charcircuit wrote: post #30

>Having a unique fingerprint means fingerprinters can continuously identify you invisibly This is not right. If you have a unique fingerprint every time someone tries to fingerprint you, then they have to do extra work to try and figure out which are the same. If you make it always be the same you've made the fingerprinter's job much easier.

In this context "a unique fingerprint" means that your fingerprint does not match any other user's. When you visit Site A and B you give a fingerprint X that is the same on A and B but no one else on the internet has ever sent.

In contrast a randomized fingerprint mean when you visit A you have a fingerprint X' and on B you have a fingerprint Y' and no one else on the internet has X' or Y' but A and B can't correlate you.

The protections we've put in place first try to do API normalization to make it so more people have a fingerprint X, and it isn't unique. And then they do API randomization so you use X' and Y'.

If a fingerprint goes to extra effort of detecting a randomized fingerprint, and ignore (or remove) the randomization, they will get the X fingerprint which - hopefully - matches many more users.

Re: Firefox expands fingerprint protections

#169

Post by firefax »

lone-cloud wrote: post #152
firefax wrote: post #146

Earlier quoted context omitted.

>You're more trackable by using NoScipt and there's no good reason to use it if you know how to properly use uBlock What data do you have to support this assertion? uBlock doesn't seem to have the ability to selectively enable only JS nessecary for functionality, and if it does, the UI makes it much more difficult to enable. I just ran a test -- merely uBlock use renders me unique, whereas one in 5742.77 had the same…

I cannot judge the validity of your test and I have done any tests myself. I encourage you to read the link from post to the top firefox hardening resource (arkenfox) that labels NoScript redundant. This is further backed up by another top privacy resource: https://www.privacyguides.org/en/browser-extensions/ This also links to the uBlock docs which outline different modes. Medium/hard modes make NoScript redundant.

>I cannot judge the validity of your test and I have done any tests myself.

I'm going to assume you meant to say "I have not".

If you can't judge the validity, maybe you shouldn't give out advice that might be read by vulnerable populations, given the sources you list do not address my points.

Re: Firefox expands fingerprint protections

#170

Post by firefax »

dorgo wrote: post #122
firefax wrote: post #45

Earlier quoted context omitted.

>This is a good use of Firefox resources. Unfortunately Firefox is at a natural disadvantage for fingerprinting by virtue of being used by such a small number of users. I'd rather be trackable but secure -- the big draw for me is NoScript. Paired with uBlock, I'm safe from malvertising[1] [1] https://en.wikipedia.org/wiki/Malvertising#Examples_of_malic...

I was wondering why uBlock is not enough since you can block Javascript globally and re-enable per site. AI's answer: Only things uBlock doesn’t replicate: NoScript’s anti-XSS and anti-clickjacking heuristics (uBlock just blocks the sources, not sanitize payloads). NoScript’s control over other active content types (e.g., WebGL, media codecs, etc).

It's also a lot better UI -- it doesn't look like it's nearly as easy to see a drop down list of JS and selectively enable as NS allows.
Post reply on HN