Live data from Hacker News

Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

zdnet.com

21–30 of 216 posts

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#21
post #13

I recommend the privacy.resistFingerpriting about:config mentioned. It's been available for a while and does other things too, like changing your user agent.

Changing your user agent will do terrible things to captchas. I actually change my user agent specifically to test the fail state of captchas. I'd suggest only turning that on if you know what you're doing.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#22
post #9

Earlier quoted context omitted.

Why not use the built-in mobile preview tool that allows you to set custom dimensions?

I also use that, but I find it faster and more straightforward to just drag the window edge, especially when devtools are not opened. One example is using browser and editor side-by-side on a single macOS split-full-screen.

I know you're not asking for advice, but in this case I would use LiveReload against multiple windows covering the breakpoints. Then you'll only need to wiggle edges to check breakpoint transitions.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#23
post #9

Earlier quoted context omitted.

I also use that, but I find it faster and more straightforward to just drag the window edge, especially when devtools are not opened. One example is using browser and editor side-by-side on a single macOS split-full-screen.

You can open responsive mode via a keyboard shortcut without needing the dev tools open; on Windows it’s Ctrl+Shift+M, no idea about macOS but it’s doubtless easy to look up.

It's the same shortcut on Linux and *BSD and probably everywhere.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#24
post #20
post #5

> The general idea is that "letterboxing" will mask the window's real dimensions by keeping the window width and height at multiples of 200px and 100px during the resize operation --generating the same window dimensions for all users-- and then adding a "gray space" at the top, bottom, left, or right of the current page. > The advertising code, which listens to window resize events, then reads the generic dimensions,…

Havent they thought about not broadcasting the window size... wtf. We are doomed apparently.

Apps need it to determine where to place elements.

If it wasn't you would still be able to reverse engineer it by sticking elements outside the viewport and seeing if they're hidden or not.

Turns out anonymity is super freaking hard. :-/

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#25
post #20

Earlier quoted context omitted.

Havent they thought about not broadcasting the window size... wtf. We are doomed apparently.

Apps need it to determine where to place elements. If it wasn't you would still be able to reverse engineer it by sticking elements outside the viewport and seeing if they're hidden or not. Turns out anonymity is super freaking hard. :-/

> Apps need it to determine where to place elements.

Could they hide the actual window dimensions from website javascript by only allowing a special kind of sandboxed function to access it? The website's code only really needs to do arithmetic on those values, so the browser could deny access to the actual values and force the code to manipulate them symbolically.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#26
This is awesome. Other things I'd like to see added directly to Firefox are things like Ad and script blocking, HTTPS everywhere, and maybe something like a Tor button so that I don't have to rely on third parties for these critical privacy features.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#27

Earlier quoted context omitted.

Apps need it to determine where to place elements. If it wasn't you would still be able to reverse engineer it by sticking elements outside the viewport and seeing if they're hidden or not. Turns out anonymity is super freaking hard. :-/

> Apps need it to determine where to place elements. Could they hide the actual window dimensions from website javascript by only allowing a special kind of sandboxed function to access it? The website's code only really needs to do arithmetic on those values, so the browser could deny access to the actual values and force the code to manipulate them symbolically.

Are you also going to download every resource listed in every @media section of the CSS regardless of screen size?

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#28
post #20

Earlier quoted context omitted.

Havent they thought about not broadcasting the window size... wtf. We are doomed apparently.

Apps need it to determine where to place elements. If it wasn't you would still be able to reverse engineer it by sticking elements outside the viewport and seeing if they're hidden or not. Turns out anonymity is super freaking hard. :-/

I don't get it. Don't the majority of people browse at full screen, on common devices which all have the same fullscreen dimensions?

Who out there browses to a size, resizes there window, then browses to another website, then resizes again and so on? That makes no sense.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#29
post #15

Earlier quoted context omitted.

I've been using privacy.resistFingerprinting for a while and also recommend it, but there is one major "side effect": your reCAPTCHA score will drop to 0.1 making many websites really tedious to use. It's a price I'm willing to pay though...

Making recaptcha worthless by making it so intrusive no one will use it. I love this idea. Recaptcha is god awful.

It could work if Firefox had as much marketshare as Chrome...

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#30
post #19
post #15

Earlier quoted context omitted.

I've been using privacy.resistFingerprinting for a while and also recommend it, but there is one major "side effect": your reCAPTCHA score will drop to 0.1 making many websites really tedious to use. It's a price I'm willing to pay though...

reCAPTCHA is a Google thing so it gets blocked in my browser already anyway (by uMatrix). If I need to load it to see a website, I close the tab immediately and go somewhere else.

You need reCAPTCHA to log into HN (or at least I do when I'm working from some parts of the middle east)
Post reply on HN