21–30 of 34 posts
Earlier quoted context omitted.
I'm sure at least one developer of the Tor project reads hacker news. EDIT: Far more interesting is the author's most recent article.... wtf http://jcarlosnorte.com/security/2016/03/06/hacking-tachogra...
Still, what with responsible disclosure etc.?
Unless JavaScript is disabled, this arms race is going to continue forever.
Did the author of the article submit his findings to the Tor Project?
Unless JavaScript is disabled, this arms race is going to continue forever.
Unless JavaScript is disabled, this arms race is going to continue forever.
Is there a way to take another approach of preventing dynamic data from getting back without an explicit opt-in from the user? This will never happen of course on the regular internet, but for hidden services or some other static-page-only-unless-opt-in surely even if fingerprinting information can be obtained, can we block it from getting back to the host?
...and eventually you'd have some chap like the OP here who will come up with a clever way to exfiltrate information somehow anyway.
Unless JavaScript is disabled, this arms race is going to continue forever.
Is there a way to take another approach of preventing dynamic data from getting back without an explicit opt-in from the user? This will never happen of course on the regular internet, but for hidden services or some other static-page-only-unless-opt-in surely even if fingerprinting information can be obtained, can we block it from getting back to the host?
Lots of ideas, many of which I've had as well, but I am missing conclusions. On the demo page it tells me my CPU benchmark and some scrolling measurements. Great, but how unique was that now? And how are you going to make the data points into a fingerprint? Because next time I scroll, I will totally scroll a millisecond differently.
He needs to collect data first in order to be able to say something about that. Panoptoclick [1] can report on uniqueness because they have test data from thousands of clients. Perhaps these fingerprints can be added there for the exposure (and because they will work to identify non-tor browsers as well).
> And how are you going to make the data points into a fingerprint?
The two "scrolling deltas" arrays are very different in nature, you could easily drop all the zeros and boil it down to "all 3" or "not all 3". That would give a nonzero contribution to the number of bits of that form an overall fingerprint. Similarly for the CPU benchmark, a phone is not as powerful as a desktop, so a result of "500" on one and "2800" on another are very likely different machines. So bin it to the nearest 500 and you'll have another non-zero contribution. Repeat for client rectangles and so on.
Lots of ideas, many of which I've had as well, but I am missing conclusions. On the demo page it tells me my CPU benchmark and some scrolling measurements. Great, but how unique was that now? And how are you going to make the data points into a fingerprint? Because next time I scroll, I will totally scroll a millisecond differently.
Yeah this seems very amateur. Lots of ideas of how to gather information from a user, but no thread about how to connect any of it back together. The "Uber Cookie" is basically a readout of totally random metadata. The CPU benchmark is substantially different each time I run it.
Lots of ideas, many of which I've had as well, but I am missing conclusions. On the demo page it tells me my CPU benchmark and some scrolling measurements. Great, but how unique was that now? And how are you going to make the data points into a fingerprint? Because next time I scroll, I will totally scroll a millisecond differently.
> Great, but how unique was that now? He needs to collect data first in order to be able to say something about that. Panoptoclick [1] can report on uniqueness because they have test data from thousands of clients. Perhaps these fingerprints can be added there for the exposure (and because they will work to identify non-tor browsers as well). > And how are you going to make the data points into a fingerprint? The two…
Unless JavaScript is disabled, this arms race is going to continue forever.
Tor users do disable JS. A friend who makes Tor sites told me that it makes web development interesting.
- form/input server-side validation (you would specify a URL as an attribute of the input / form to which what-if data would be posted)
- input auto-complete (same thing, URL in attribute of the input)
- adaptive design (they should rethink CSS with various formats in mind)
With these 3 things alone I think you can pretty much create a fully working JS-free website. You would only need JS if you really need to build a SPA (which should be the exception: online trading platforms, etc).
The fact that now even a blog article is not viewable without JS is a joke.