Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We found a stable Firefox identifier linking all your private Tor identities

fingerprint.com

Post reply on HN
Print view View original

281–290 of 306 posts

Re: We found a stable Firefox identifier linking all your private Tor identities

#281

Post by fc417fc802 »

Izkata wrote: post #278
fc417fc802 wrote: post #134

Earlier quoted context omitted.

Most of the things you've listed here don't actually seem all that reasonable to me. User agents as a concept are rather poorly thought out across the board and not all that useful but persist because that's just how technical cruft is. Fonts should be provided by the website; if not provided the choice should take the form of a spec sent by the website including line height, sarifs or not, monospace or not, etc. The…

> if not provided the choice should take the form of a spec sent by the website including line height, sarifs or not, monospace or not, etc. Width of individual characters would still reveal the browser's choice to some extent. Stick them in an inline-block element and check its width. > Video formats should be provided by the website as a list of offerings and the browser should respond with a choice The server stil…

> character width

That is a fair point but it would presumably still be a step in the right direction.

> video formats

True, a malicious streaming site could still work to fingerprint your client if you watched multiple different videos. However that would require active work on the part of the server and could be mitigated by the client which is already miles better than the status quo.

I suppose my proposed solution would also introduce a new constraint that a stream couldn't switch codecs from one chunk to the next but I doubt that would be much of an issue in practice.

I don't believe that's how it works now. At present the server would typically send code that queries for codec support prior to sending video chunks. These days there's the low level WebCodecs API; [0] previously you would have used MediaSource.isTypeSupported( ... ). [1] The issue is that at present the code sent by the server handles any queries and makes the selection. That leaves the door open to run arbitrary queries for the purpose of characterizing the underlying platform.

[0] https://developer.mozilla.org/en-US/docs/Web/API/WebCodecs_A...

[1] https://developer.mozilla.org/en-US/docs/Web/API/Media_Sourc...

Re: We found a stable Firefox identifier linking all your private Tor identities

#282

Post by Izkata »

fc417fc802 wrote: post #281
Izkata wrote: post #278

Earlier quoted context omitted.

> if not provided the choice should take the form of a spec sent by the website including line height, sarifs or not, monospace or not, etc. Width of individual characters would still reveal the browser's choice to some extent. Stick them in an inline-block element and check its width. > Video formats should be provided by the website as a list of offerings and the browser should respond with a choice The server stil…

> character width That is a fair point but it would presumably still be a step in the right direction. > video formats True, a malicious streaming site could still work to fingerprint your client if you watched multiple different videos. However that would require active work on the part of the server and could be mitigated by the client which is already miles better than the status quo. I suppose my proposed solutio…

..I'm thinking of the elements: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/...

> If the type attribute is specified, the browser immediately compares it with the media types it can display. If the type is not supported, the browser skips querying the server and directly checks the next element.

Re: We found a stable Firefox identifier linking all your private Tor identities

#283

Post by litigator »

goodpoint wrote: post #234
Cider9986 wrote: post #163

Being fingerprinted across Tor is different from being deanonymized—it basically just "psuedonomizes" you. You now have an identifier. It is a significant threat, but it is not hard to "psuedonomize" someone based on stylometry and some of the people with the highest threat model—operating an illegal site, will be pseudonymous anyway. Don't get your opsec advice from HN. Check whonix, qubes, grapheneos, kicksecure fo…

No, fingerprinting is a synonym of deanonymization.

No. If everyone (or browser installs) had identical fingerprints... Good luck deanonymising them.

Re: We found a stable Firefox identifier linking all your private Tor identities

#284

Post by theamk »

godelski wrote: post #111
zamadatix wrote: post #65

Earlier quoted context omitted.

Most users seem to not care about ad tech/tracking as much as technical users. Even further, most seem to want to enable more tracking to [protect the children or whatever the reason is] pretty regularly (at least in opinion polls about various legislation). ToR users are not at all like that + could be harmed in a very different way... so I think it's fair to frame them differently even if I'd personally say people…

> Most users seem to not care about ad tech/tracking I don't think this is true. Most people don't understand that they're being tracked. The ones that do generally don't understand to what extent. You tend to get one of two responses: surprise or apathy. When people say "what are you going to do?" They don't mean "I don't care" they mean "I feel powerless to do anything about it, so I'll convince myself to not care…

> As soon as you change it from "Meta" to "some guy named Mark".

There is a huge difference between those.

If someone hires a PI to follow me, they are spending like $10000/week on that. Which means that their expected value is more than that, or that PI will never pay for itself. Where will this value come from? Likely from me, after all it's me they are tracking. So I am really worried, as I am about to lose a huge amount of money (or something else valuable).

On the other hand, if a store installs a whole bunch of cameras so I am tracked anytime I am in there, then it probably costs them only a few cents to track me. So I really don't care much about how losing anything valuable.

Re: We found a stable Firefox identifier linking all your private Tor identities

#285

Post by keepamovin »

wolvoleo wrote: post #240
keepamovin wrote: post #236

Earlier quoted context omitted.

Totally, I get that. That's why BrowserBox is also self-hosted, and yes, has a Docker image, too! Not free nor foss, tho. But I do try to be flexible. As to cloud - indeed, why would you want to trust a cloud provider with sensitive internal browsing? Also, providing a SaaS is a hassle, but I feel I must do it serve that side and enable those uses, some of which are cool.

Ohh I didn't realise that it's your product, sorry. It sounds interesting but I'm only a home user (in Europe with not much budget). I just use remote browsers now for navigating the complex patchwork of blocks in the EU. Some sites are blocked in holland, others in spain, etc.

Hehe no worries. It’s good to chat anyway.

Re: We found a stable Firefox identifier linking all your private Tor identities

#286

Post by aboardRat4 »

crazysim wrote: post #254
aboardRat4 wrote: post #253

Earlier quoted context omitted.

Not sure about "most". I use tor without a tor browser, because I don't care about being identified. I only used it to go around geoblocking and visit onion sites.

Are you really not sure? I'm pretty darn sure a lot of "normal" people don't know how to configure their systems to use a SOCKS proxy to use Tor.

But a lot of "normal" people don't use tor at all.

Re: We found a stable Firefox identifier linking all your private Tor identities

#287

Post by crazysim »

aboardRat4 wrote: post #286
crazysim wrote: post #254

Earlier quoted context omitted.

Are you really not sure? I'm pretty darn sure a lot of "normal" people don't know how to configure their systems to use a SOCKS proxy to use Tor.

But a lot of "normal" people don't use tor at all.

Ah I should have been more specific and saying normal Tor users.

Re: We found a stable Firefox identifier linking all your private Tor identities

#288

Post by fc417fc802 »

Izkata wrote: post #282
fc417fc802 wrote: post #281

Earlier quoted context omitted.

> character width That is a fair point but it would presumably still be a step in the right direction. > video formats True, a malicious streaming site could still work to fingerprint your client if you watched multiple different videos. However that would require active work on the part of the server and could be mitigated by the client which is already miles better than the status quo. I suppose my proposed solutio…

..I'm thinking of the elements: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/... > If the type attribute is specified, the browser immediately compares it with the media types it can display. If the type is not supported, the browser skips querying the server and directly checks the next element.

Huh. That's interesting but in practice it doesn't quite work. The major streaming platforms want to handle things programmatically in chunks and they need a way to establish what codec (among various other parameters) to use before they get started. So the requirement is a browser mechanism to make that information available to server provided code running on the client. And I'm further stipulating that this mechanism should facilitate optional intervention by the user.

Re: We found a stable Firefox identifier linking all your private Tor identities

#289

Post by baobabKoodaa »

adastra22 wrote: post #60
baobabKoodaa wrote: post #36

Earlier quoted context omitted.

Uhh okay, so they do exploit vulnerabilities, they just try to target victims who can be served ads? What a weird distinction.

Painting fingerprinting as vulnerability exploit is your own very biased and very out-of-norm framing.

No, it is not. I'm talking in the context of OP, which refers to a fingerprinting "vulnerability", specifically using the word "vulnerability" to describe it.

Re: We found a stable Firefox identifier linking all your private Tor identities

#290

Post by danlitt »

zelphirkalt wrote: post #202
danlitt wrote: post #189

Earlier quoted context omitted.

Ridiculous comment. People should not have to choose between functionality and privacy.

Should not, true, but in the case of many websites the reality is that allowing JS means you lost your privacy. Just like one cannot allow webgl and canvas by default any longer. Thanks to all the web devs who helped creating this web dystopia.

Yes, my point is that this does not mean it is an "opt in checkbox". I appreciate that it allows people to be nasty, it just isn't a "please be nasty" toggle.
Post reply on HN