271–280 of 306 posts
Earlier quoted context omitted.
Links can force to pass all connections to a proxy, so a FW might be redundant. Forget almost mouse, Links can be render the page either to plain X11 or a terminal.
I'm assuming the browser is going to be compromised at some point, for example by getting it to retrieve something without using the socks proxy.
And hope that the sorting time cannot be used as a side channel.
I learned enough about security years ago that there's basically zero chance you're secure and almost 100% chance someone is watch everything you do online. Whether they care is entirely separate.
Earlier quoted context omitted.
> Unfortunately you've now made an incredibly niche browser, and the lack of those metrics is a good fingerprint by itself. If 100 people are using that browser, how will they know which one is me? > How browsers render SVGs can be used for fingerprinting (even the underlying OS affects this, and I assume you'll want to see those) Can you provide details on this? And how will they know which OS I'm using (through SVG…
You're the only one out of 100 that visits HN, or who's use matches a particular timezone, or who has the use pattern that [anti-]correlates with your work pattern, or ...
> You're the only one out of 100 that visits HN
So the HN operator sees someone using this browser, with this timezone. Then I go to some other site. Let's pretend that site's operator and HN's are identical. How will they know that I'm the same guy who went to HN? How does he know there aren't two people who use the browser in the same timezone (and the other one doesn't go to HN)?
> The cleanest mitigation is to return results in a canonical order, such as lexicographic sorting. And hope that the sorting time cannot be used as a side channel.
Because most post-quantum cryptosystems need this primitive.
Earlier quoted context omitted.
The most popular browser is made by an ad company. They also provide the majority of funding for their biggest competitor. Why would you expect anything different?
most people would expect something different from tor, surely.
Earlier quoted context omitted.
You can't go out in public naked and just ask everyone to look away. If you want someone you don't trust to run unvetted general purpose code on your machine you have to accept that you are trading away some privacy. You can sandbox them (wear cloths) but that doesn't give you strict privacy.
It's not a binary situation. Lots of fingerprinting is based on e.g. audio or canvas rendering quirks. Browsers should be obfuscating that shit.
Earlier quoted context omitted.
Browser fingerprinting is an unintended side-effect of things it's sorta-kinda reasonable for browsers to provide. A user agent that says the browser's version? Reasonable enough. Being able to ask for fonts, if the system has them? Difficult to have font support without that. Getting the user's timezone, language and keyboard layout? Reasonable. The size of the screen, and the size of the browser window? Difficult t…
Most of the things you've listed here don't actually seem all that reasonable to me. User agents as a concept are rather poorly thought out across the board and not all that useful but persist because that's just how technical cruft is. Fonts should be provided by the website; if not provided the choice should take the form of a spec sent by the website including line height, sarifs or not, monospace or not, etc. The…
Width of individual characters would still reveal the browser's choice to some extent. Stick them in an inline-block element and check its width.
> Video formats should be provided by the website as a list of offerings and the browser should respond with a choice
The server still controls what's offered and can see what's supported by offering different combinations. Besides, isn't this how it works now?
Earlier quoted context omitted.
Open enough tabs and you'd be lucky to keep firefox running for more than a couple weeks.
I have 488 tabs in the session with more than 50 loaded. The running session has 72 processes.
Earlier quoted context omitted.
Ah yes, the age old reply when people exhausted all arguments.
The person I have responded wrote the "should have" construction without giving any proofs why is it so. Maybe in the world of pink ponies everyone should have a free bread on the breakfast, but some things might be unintuitive in the our one.