Firefox to add Tor Browser anti-fingerprinting technique called letterboxing • Hacker News Board

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#181

Post by Liquid_Fire » Thu, Mar 07, 2019, 1:35 PM UTC

gpvos wrote: post #152

burtonator wrote: post #24

Earlier quoted context omitted.

Apps need it to determine where to place elements. If it wasn't you would still be able to reverse engineer it by sticking elements outside the viewport and seeing if they're hidden or not. Turns out anonymity is super freaking hard. :-/

Would something like Perl's taint functionality work? I.e., all values derived from size, position, colour, pixel data, user agent, etc. are marked as tainted, and are stripped (or randomized or replaced with default values) from data that is sent over XMLHttpRequest and other communication methods. It's probably extremely hard to make that watertight though.

Even if it was implemented perfectly, you could work around that using timing side channels.

For example, multiply the value (e.g. window width) by some huge number, perform a slow operation in a loop that many times, and finally clear a flag. Meanwhile another thread is filling an array one by one until the flag gets cleared. The last non-tainted index in the array indicates your approximate window width.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#182

Post by Xelbair » Thu, Mar 07, 2019, 1:52 PM UTC

nindalf wrote: post #129

tyingq wrote: post #69

Earlier quoted context omitted.

I suspect that's the biggest reason Google was so interested in "https everywhere". That removed detailed browsing visibility from a lot of entities, but not Google.

I've seen this tendency on HN - if this person/entity does something, I suspect it must be bad or selfish. On the subject of HTTPS - do you think the interests of ordinary consumers are in any way served by continuing on HTTP? Countless websites, even those accepting login credentials used to think that it was acceptable to not take the trouble to set up HTTPS. The only thing the operators of these websites cared abo…

Google is a corporation, the only goal of corporation is to make money.

So yes, that is the biggest reason - their business objective. It just happened that it also did something good for everyone.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#183

Post by NeedMoreTea » Thu, Mar 07, 2019, 1:55 PM UTC

Xelbair wrote: post #182

nindalf wrote: post #129

Earlier quoted context omitted.

I've seen this tendency on HN - if this person/entity does something, I suspect it must be bad or selfish. On the subject of HTTPS - do you think the interests of ordinary consumers are in any way served by continuing on HTTP? Countless websites, even those accepting login credentials used to think that it was acceptable to not take the trouble to set up HTTPS. The only thing the operators of these websites cared abo…

Google is a corporation, the only goal of corporation is to make money. So yes, that is the biggest reason - their business objective. It just happened that it also did something good for everyone.

> only goal of corporation is to make money

A corporation can set any goal the founders please. Making money need not be the dominant one. Obviously making enough to stay solvent helps with longevity.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#184

Post by [deleted] » Thu, Mar 07, 2019, 2:05 PM UTC

Jonnax wrote: post #120

newscracker wrote: post #37

Every time there's something about online privacy with browsers, it's mostly Firefox or Safari. I wondered if Chrome had resisting fingerprinting on its radar (guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online), and I found this [1] confirming my guess (emphasis mine): > Since we don't believe it's feasible to provide some mode of Chrome that can truly prev…

Here's a good comparison: Android Chrome's user agent: Mozilla/5.0 (Linux; Android 6.0.1; SM-G928F Build/MMB29K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36 Versus Android Firefox's user agent: Mozilla/5.0 (Android 9; Mobile; rv:66.0) Gecko/66.0 Firefox/66.0 Note how the Chrome browser announces your phone model and software build version to the world. With regional models with car…

[deleted]

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#185

Post by Kuraj » Thu, Mar 07, 2019, 2:17 PM UTC

antpls wrote: post #113

osrec wrote: post #98

If Firefox could make their Dev tools as good as Chrome's, I would switch immediately.

Firefox is already valuable for browsing on mobile phone, where there is not much space on screen to have Dev console anyway. I recommend trying Firefox Mobile

Firefox on Android won my heart with extension support, which means I can have an ad blocker (uBlock Origin, no less) without root

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#186

Post by leesalminen » Thu, Mar 07, 2019, 2:24 PM UTC

NeedMoreTea wrote: post #183

Xelbair wrote: post #182

Earlier quoted context omitted.

Google is a corporation, the only goal of corporation is to make money. So yes, that is the biggest reason - their business objective. It just happened that it also did something good for everyone.

> only goal of corporation is to make money A corporation can set any goal the founders please. Making money need not be the dominant one. Obviously making enough to stay solvent helps with longevity.

Alphabet is a publicly traded company and the officers have a fiduciary duty to do what’s best for their shareholders. This normally means maximizing profits. A corporate officer could make a case to shareholders that not maximizing profits in X area could have Y long term benefit, but that’s not very common these days.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#187

Post by Ajedi32 » Thu, Mar 07, 2019, 2:27 PM UTC

nindalf wrote: post #129

tyingq wrote: post #69

Earlier quoted context omitted.

I suspect that's the biggest reason Google was so interested in "https everywhere". That removed detailed browsing visibility from a lot of entities, but not Google.

I've seen this tendency on HN - if this person/entity does something, I suspect it must be bad or selfish. On the subject of HTTPS - do you think the interests of ordinary consumers are in any way served by continuing on HTTP? Countless websites, even those accepting login credentials used to think that it was acceptable to not take the trouble to set up HTTPS. The only thing the operators of these websites cared abo…

Google has long held the stance that anything that's good for the web is good for Google. Google is nearly ubiquitous online these days, so people spending more time online will almost certainly benefit their business.

That's why they don't need any ulterior motivation for efforts like HTTPS Everywhere, Google Fiber, or Chrome. The very fact that those technologies make the web safer, faster, or more powerful already benefits Google indirectly.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#188

Post by PaulHoule » Thu, Mar 07, 2019, 2:27 PM UTC

nkozyra wrote: post #176

PaulHoule wrote: post #174

Earlier quoted context omitted.

Actually browser compatibility is not getting better, it is getting worse. I was working for a firm last year that made a system with a browser front end that only supported Chrome and Safari, not Edge or Firefox -- this is happening everywhere, and it is why MS threw in the towel with Edge.

I don't think that anecdote fares well against the many ways in which browser compatibility has improved

Browser compatibility is better in early 2019 than I think it was in early 2011. I think it is worse than it was in early 2018.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#189

Post by NeedMoreTea » Thu, Mar 07, 2019, 2:38 PM UTC

leesalminen wrote: post #186

NeedMoreTea wrote: post #183

Earlier quoted context omitted.

> only goal of corporation is to make money A corporation can set any goal the founders please. Making money need not be the dominant one. Obviously making enough to stay solvent helps with longevity.

Alphabet is a publicly traded company and the officers have a fiduciary duty to do what’s best for their shareholders. This normally means maximizing profits. A corporate officer could make a case to shareholders that not maximizing profits in X area could have Y long term benefit, but that’s not very common these days.

Maximising shareholder value is very often not what's best for shareholders. The current popular myth that it is somehow mandatory has been coincident with a definite change for the worse.

Hasn't Amazon been notable for actively avoiding profit through much of its existence?

https://www.forbes.com/sites/stevedenning/2017/04/27/harvard...

https://skeptics.stackexchange.com/questions/8146/are-u-s-co...

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#190

Post by newscracker » Thu, Mar 07, 2019, 2:46 PM UTC

Ajedi32 wrote: post #187

nindalf wrote: post #129

Earlier quoted context omitted.

I've seen this tendency on HN - if this person/entity does something, I suspect it must be bad or selfish. On the subject of HTTPS - do you think the interests of ordinary consumers are in any way served by continuing on HTTP? Countless websites, even those accepting login credentials used to think that it was acceptable to not take the trouble to set up HTTPS. The only thing the operators of these websites cared abo…

Google has long held the stance that anything that's good for the web is good for Google. Google is nearly ubiquitous online these days, so people spending more time online will almost certainly benefit their business. That's why they don't need any ulterior motivation for efforts like HTTPS Everywhere, Google Fiber, or Chrome. The very fact that those technologies make the web safer, faster, or more powerful already…

> Google has long held the stance that anything that's good for the web is good for Google.

Not denying that, but this could be reversed and would still make sense: Google has long held the stance that anything that's good for Google is good for the web.