Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We found a stable Firefox identifier linking all your private Tor identities

fingerprint.com

Post reply on HN
Print view View original

221–230 of 306 posts

Re: We found a stable Firefox identifier linking all your private Tor identities

#221

Post by angry_octet »

anthk wrote: post #172
angry_octet wrote: post #117

Earlier quoted context omitted.

The best is probably tor in a VM, chromium in a separate VM, javascript disabled, on a private virtual network, with a egress firewall (not just guest VM firewalls, but enable those too) that only allows traffic from a specific origin port on the tor machine. You would also want the VM to spoof the processor features and unique IDs. System time drift/offset remains a vector which is hard to deal with. Dump the render…

Links can force to pass all connections to a proxy, so a FW might be redundant. Forget almost mouse, Links can be render the page either to plain X11 or a terminal.

I'm assuming the browser is going to be compromised at some point, for example by getting it to retrieve something without using the socks proxy.

Re: We found a stable Firefox identifier linking all your private Tor identities

#222

Post by vorticalbox »

PoignardAzur wrote: post #198
vorticalbox wrote: post #192

Earlier quoted context omitted.

it allows you to track a browser forever because it is stable fingerprint point. This helps with long term tracking a great deal.

If I understand correctly, it was only stable until you restarted Firefox / your computer.

Ok that’s change it a bit but on the other hand I’ve had my browser open for weeks now and I only restart it when the “update” button turns red lol

Re: We found a stable Firefox identifier linking all your private Tor identities

#223

Post by angry_octet »

Phelinofist wrote: post #184
angry_octet wrote: post #113

Earlier quoted context omitted.

Because TBB has javascript on by default, turning it off increases your signature. It would be better if TBB defaulted to js off, with a front panel button to turn it on. JS also dramatically improves security. TBB is stuck in a 90s mindset about privacy, as if Firefox exploits were not dime a dozen. Especially with AI making FF exploits more available, we can expect many tor sites to be actively attacking their visi…

> JS also dramatically improves security How so?

Sorry I somehow left out the key word 'Disabling JS'.

Re: We found a stable Firefox identifier linking all your private Tor identities

#224

Post by wolvoleo »

keepamovin wrote: post #216
wolvoleo wrote: post #212

Earlier quoted context omitted.

Eh but that's a commercial tool. They don't even seem to have a free community version. I wouldn't pay for that. And prefer Firefox anyway. For remote browser tools I use neko https://github.com/m1k1o/neko But with Tor I like to have more safeguards. So I prefer to run tails in an isolated environment.

You're right that BrowserBox is a commercial product and there's no free tier. Honestly, the reality of running remote browser infra and development is that a free version just gets instantly hammered by botnets, scrapers, and abuse. Keeping it paid is the only way to be sustainable. I see Neko brought up a lot, but honestly when I tried it a couple years ago it felt pretty clunky. It seems designed more for anime wa…

> Honestly, the reality of running remote browser infra and development is that a free version just gets instantly hammered by botnets, scrapers, and abuse. Keeping it paid is the only way to be sustainable.

Ah but I'd want to run it myself anyway. I wouldn't want it hosted. Especially for browsing, I don't want someone else's systems looking over my shoulder.

I avoid cloud stuff as much as possible in my personal life. When you mentioned github actions I thought it was something you could self-host too, I didn't realise it was a service only. I was looking for a docker or something but as it's not free and (less importantly) foss it won't work for me.

And yes neko is not a polished corporate solution, but it works for me as a home user. It's very flexible to build other stuff with. I have several instances here in different environments (and I don't expose them to the clear internet)

But for work yeah I know there's different options, at work we have zscaler remote browser.

Re: We found a stable Firefox identifier linking all your private Tor identities

#225

Post by gosub100 »

firefax wrote: post #217
spelledwrong wrote: post #150

Earlier quoted context omitted.

>We are aware that EFF has a project that used to be named after a pedophile on this subject You bring this up like it's a well known incident, but my googling can find no evidence of it? The only reason not say the name of the project would be if it's common knowledge, but it's not? ChatGPT research reckons you're making it up, and I'd be curious if you have evidence to the contrary?

It used to be called Panoptoclik (sp?), a reference to Foucault's theory of the panopticon. Focault's extracurriculars are well documented and not everything is an "incident" -- it's a thread on fingerprinting. People who study that are aware what is now called "cover your tracks", and people who do post grads tend to be well rounded enough to have read a bit of philosophy, or at least, they did in my day. So what ha…

You invalidated your initial claim. Panopticon is not a pedo. Therefore the project was not named after one. Therefore the robot was right.

Re: We found a stable Firefox identifier linking all your private Tor identities

#227

Post by ZiiS »

danlitt wrote: post #189
lmz wrote: post #125

Earlier quoted context omitted.

The opt in checkbox is labeled "Enable Javascript"

Ridiculous comment. People should not have to choose between functionality and privacy.

You can't go out in public naked and just ask everyone to look away. If you want someone you don't trust to run unvetted general purpose code on your machine you have to accept that you are trading away some privacy. You can sandbox them (wear cloths) but that doesn't give you strict privacy.

Re: We found a stable Firefox identifier linking all your private Tor identities

#228

Post by IAmBroom »

bfivyvysj wrote: post #158

I learned enough about security years ago that there's basically zero chance you're secure and almost 100% chance someone is watch everything you do online. Whether they care is entirely separate.

"Watching" is doing heavy lifting. "Able to watch" or "being recorded, along with terabytes of parallel information from others", is more apt. Actually discriminating the signal (communications from a desired target, or about a desired topic) from noise is the problem with your "nothing you do will stop them" theory.

Re: We found a stable Firefox identifier linking all your private Tor identities

#229

Post by sdrm »

yencabulator wrote: post #66

> the identifier can also persist [...] as long as the Firefox process remains running Make sure to exit Tor Browser at the end of a session. Make sure not to mix two uses in one session.

better yet, disable javascript when using tor.

Re: We found a stable Firefox identifier linking all your private Tor identities

#230

Post by IAmBroom »

rendx wrote: post #165
autoexec wrote: post #161

Earlier quoted context omitted.

This is a bad idea though, because any newly discovered means to get even a single data point results in being able to ID every tor user. I'd be better to have every tor browser always generate a random fingerprint so that even if the unexpected happens people will never get anything but random results.

> to have every tor browser always generate a random fingerprint Browsers do not "generate" fingerprints. They expose data that can be used to fingerprint users. You cannot "randomize" this; even if you were to return random values for, say, user screen size, with various visual side effects, it would just be another signal to fingerprint: "Oh, your browser is returning random values? Must be a Tor browser user".

> it would just be another signal to fingerprint: "Oh, your browser is returning random values? Must be a Tor browser user".

You'd have to fingerprint the browser first to determine that the "random values" were indeed coming from it.

Post reply on HN