Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Block Fingerprinting with Firefox

blog.mozilla.org

Post reply on HN
Print view View original

231–240 of 411 posts

Re: Block Fingerprinting with Firefox

#231

Post by neilv »

ziddoap wrote: post #34

I find it really interesting that when a company is making moves in a direction that benefits privacy of consumers, everyone takes the opportunity to shit on them for past mistakes or how it isn't good enough or why isn't it on by default or any other thing they can find to shit on. Yes, every single company has made mistakes. FireFox is no exception. Some of them were pretty egregious. Mistakes are - hopefully - an…

I applaud this move by Mozilla towards privacy and security, and I have hope that they'll be increasing their focus on this.

The criticisms like "why isn't this the default", "why didn't you do this when you had patches years ago", "why did you play along with standardization of these mechanisms in the first place", and "what about all these other things you're doing" might reflect a knowledge of technology and history. And frustration, since, now, with Firefox's diminished market share, and having already given up privacy&security ground, Mozilla probably has to tiptoe.

A possible alternative to tiptoeing... With Google handing Mozilla a huge freebie right now, with the anti-adblocking move, there might be a new opening for Mozilla to "go rogue", from the perspective of many dotcom abusers, reclaim some lost ground, and start actually making the abusers angry. For that to work, Mozilla needs users who, when an abusing site says "Firefox broke this; switch to Chrome", will yell at the abusing site, and leave the site. They'll also need to live up to the expectations of those dedicated users, not do data-grabbing/leaking dotcom behavior themselves, which will require some internal rethinking. If they piss off some funding sources, they'll need to find some minimal level of funding, to pay for the jobs that simply can't be done by volunteers, and for expenses for things actually essential to the core mission. (And to get all their hardware&connectivity infrastructure donated by companies that would like the goodwill, and who will sign legal commitments to not use incidental data, with severe penalty clauses.)

Re: Block Fingerprinting with Firefox

#232

Post by rjf72 »

codsane wrote: post #157
geekamongus wrote: post #154

It seems that almost weekly, I am reminded why I love Firefox because of some new thing Mozilla is doing. A lot of good decisions have been coming from them lately.

I finally made the switch from Brave today and I'm never going back. Firefox is just as privacy-conscious, supports built-in tracker blocking, fingerprinting, and has full sync that Brave hasn't implemented yet.

Just as privacy conscious is a misleading statement. Choosing to migrate their default search to Google was a money grab by Firefox and that money is, in turn, 100% dependent upon tracking. I think this is why what limited privacy options Firefox does offer are entirely opt-in, and often hidden behind menus that your average user will probably never visit.

By contrast Brave has had things such as blocking of fingerprinting for months (years?), and also natively supports OPT-OUT ad blocking, script blocking, third party cookie blocking (which FireFox does also but once again in a less direct fashion), single click native TOR access + ID swapping anywhere, and more. And I think the biggest difference is that this is all directly exposed to the user. If a user clicks the big iconic Lion icon in the top right they get a popup that shows nothing but:

- [x] Shields Up (adblocking/etc)

- [x] Third party trackers blocked

- [x] Connections forced to HTTPS

- [x] Scripts blocked

- [Third Party/All/None] Cookies blocked

- [Third Party/All/None] Device recognition blocked

So even users that know absolutely nothing and don't bother to navigate through menu options will almost definitely immediately be exposed to all of these privacy options, though again given the opt-out nature of much of it - even if they weren't, it would be less of an issue.

Re: Block Fingerprinting with Firefox

#233

Post by fencepost »

simias wrote: post #102
ademup wrote: post #91

Earlier quoted context omitted.

Firefox has ~250M users as of about 9 months ago and $562M revenue for 2017. I'd honestly pay $2 per month (12 times "my share") for a Firefox that completely disavows the ad model and produces a truly user-centric experience sans ads, fingerprinting, etc. However, given that over 95% of their revenue comes from Royalties, I don't see that turning around any time soon.

I would too, but clearly most people wouldn't, otherwise advertisement wouldn't be such a popular way to monetize apps and websites (and Google wouldn't be the behemoth that it is today). Actually I would also gladly pay for a decent search engine but even DuckDuckGo decided to monetize using ads, which IMO means that sooner or later if they're successful enough they'll become just as bad as the rest. Besides paying…

A possibly relevant distinction for DDG ads is that (I believe) they're anonymized and tied only to the search, not to your identity.

Re: Block Fingerprinting with Firefox

#234

Post by godelski »

ggreer wrote: post #72
Wowfunhappy wrote: post #49

Earlier quoted context omitted.

Can anyone explain why canvas fingerprinting is so difficult to eradicate without breaking canvas?

You can draw with different fonts and background colors, then grab the raw pixel values and hash them. The hash will be different depending on the versions of fonts installed, the OS, the GPU, the browser's text rendering algorithms, and the subpixel order/orientation of the display. See https://en.wikipedia.org/wiki/Canvas_fingerprinting for more info.

tldr: drawings aren't pixel perfect.

Longer: this is actually a viable way to do many types of fingerprinting, not just canvas. I'll give an example. In a graphics class I took our professor gave us output images to compare to. Two people with the same model computer, same specs, would frequently have a pixel or two different from one another. Change the specs and you're easily a dozen off. Worse than that, the pixels that are off from the original image can be different pixels. This comes down to the silicon lottery. So if you can think of anything that you can access where you can get the user's computer to do some sort of floating point calculation, you can probably get a fingerprint out of that.

So to fix this problem, you'd have to figure out how not just to make pixel perfect images, but for two CPUs of different types (which even same type doesn't currently) to always calculate the save answer to the same precision, every time. There's tricks that can be done like rounding, but it gets hairy really fast and becomes unpractical. But if you do know how to solve the problem, I'm sure people would really appreciate the answer.

Re: Block Fingerprinting with Firefox

#235

Post by godelski »

Wowfunhappy wrote: post #73
ggreer wrote: post #72

Earlier quoted context omitted.

You can draw with different fonts and background colors, then grab the raw pixel values and hash them. The hash will be different depending on the versions of fonts installed, the OS, the GPU, the browser's text rendering algorithms, and the subpixel order/orientation of the display. See https://en.wikipedia.org/wiki/Canvas_fingerprinting for more info.

Thanks. I'd read the Wikipedia page, I'm just not clear why this process is allowed (or more importantly, why it can't be removed). Is there a legitimate use case for being able to read back pixels?

> I'm just not clear why this process is allowed (or more importantly, why it can't be removed).

Because we don't know how to make CPUs do pixel perfect images every single time. (I wrote a little more above)

Re: Block Fingerprinting with Firefox

#236

Post by godelski »

messe wrote: post #63
samirm wrote: post #56

Earlier quoted context omitted.

> 9.93 bits of identifying information. with this new setting turned on + uBlock Origin + NoScript

If you haven't already, change your user agent to get it down further.

I switched to Windows Chrome, from FF Linux and it actually increased my score by 0.02 bits.

Re: Block Fingerprinting with Firefox

#237

Post by rjf72 »

kevin_thibedeau wrote: post #92
abdullahkhalids wrote: post #46

Earlier quoted context omitted.

17.62 bits on firefox, 11.0 on Tor, 17.63 on chrome. On firefox, the big contributors are HTTP headers (my native language is announced), hash of WebGl fingerprint and time zone. On Tor big contributors are hash of webGL fingerprint, screen size. On chrome, they are system fonts, hash of canvas fingerprint, user agent, and time zone. I am not too concerned about the fingerprinting in firefox since I have strict block…

The numbers don't make much sense to me. On FF I get 14.05 with NoScript active. Curiously the headers increase from 1.68 bits to 3.47 when NoScript is running.

I'm curious about the difference between things like NoScript and native Brave script blocking.

In particular I was going to make a snarky comment that the site seems to, appropriately, not work when script blocking is enabled on Brave. I do get the site to do the refresh business a couple of times, but no results are ever displayed.

Re: Block Fingerprinting with Firefox

#238

Post by bad_user »

fencepost wrote: post #233
simias wrote: post #102

Earlier quoted context omitted.

I would too, but clearly most people wouldn't, otherwise advertisement wouldn't be such a popular way to monetize apps and websites (and Google wouldn't be the behemoth that it is today). Actually I would also gladly pay for a decent search engine but even DuckDuckGo decided to monetize using ads, which IMO means that sooner or later if they're successful enough they'll become just as bad as the rest. Besides paying…

A possibly relevant distinction for DDG ads is that (I believe) they're anonymized and tied only to the search, not to your identity.

A lot of people here equate advertising with tracking.

A lot of people here also have huge double standards regarding Mozilla.

Re: Block Fingerprinting with Firefox

#239

Post by godelski »

numakerg wrote: post #29
xvector wrote: post #15

Can someone paste their results (or at least bits of fingerprinting entropy) from https://panopticlick.eff.org with the latest Firefox? With the fancy new anti-fingerprinting Safari on macOS Mojave I get just over 14.5 bits of entropy with the most entropic source being my canvas fingerprint (1 in 600). With Safari on iOS I get 11.71 bits of entropy, with the most entropic value being my screen size and color depth.

Panopticlick says I have "strong protection against Web tracking" but amiunique.org says I'm unique. Though amiunique also claims my TOR is fingerprint is one of six.

I get very different results from each. Some don't quite make sense to me. For example, amiunique says Timezone 3.37%. Panopticlick says 1 in 16, so half as bad. But how the hell is that timezone so identifying? I live on the west coast, how is that timezone so identifying?

Re: Block Fingerprinting with Firefox

#240

Post by asenna »

rjf72 wrote: post #232
codsane wrote: post #157

Earlier quoted context omitted.

I finally made the switch from Brave today and I'm never going back. Firefox is just as privacy-conscious, supports built-in tracker blocking, fingerprinting, and has full sync that Brave hasn't implemented yet.

Just as privacy conscious is a misleading statement. Choosing to migrate their default search to Google was a money grab by Firefox and that money is, in turn, 100% dependent upon tracking. I think this is why what limited privacy options Firefox does offer are entirely opt-in, and often hidden behind menus that your average user will probably never visit. By contrast Brave has had things such as blocking of fingerpr…

> Choosing to migrate their default search to Google was a money grab by Firefox and that money is, in turn, 100% dependent upon tracking

Well it was not a bad decision to make since most of their users would set Google as their default anyway (no matter how privacy concerned you are, you still can't do without Google search unless you really really try hard, which most people don't).

In my opinion it was a sensible decision.

Post reply on HN