We found a stable Firefox identifier linking all your private Tor identities • Hacker News Board

Re: We found a stable Firefox identifier linking all your private Tor identities

#301

Post by Izkata » Sat, Apr 25, 2026, 9:18 PM UTC

fc417fc802 wrote: post #288

Izkata wrote: post #282

Earlier quoted context omitted.

..I'm thinking of the elements: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/... > If the type attribute is specified, the browser immediately compares it with the media types it can display. If the type is not supported, the browser skips querying the server and directly checks the next element.

Huh. That's interesting but in practice it doesn't quite work. The major streaming platforms want to handle things programmatically in chunks and they need a way to establish what codec (among various other parameters) to use before they get started. So the requirement is a browser mechanism to make that information available to server provided code running on the client. And I'm further stipulating that this mechani…

We're talking about fingerprinting, not serving up content. They could leave the content being served up unchanged, then add those tags elsewhere on the page where the user wouldn't notice, pointing at a tiny 1-second empty video.

Re: We found a stable Firefox identifier linking all your private Tor identities

#302

Post by theamk » Sun, Apr 26, 2026, 5:29 PM UTC

godelski wrote: post #300

theamk wrote: post #284

Earlier quoted context omitted.

> As soon as you change it from "Meta" to "some guy named Mark". There is a huge difference between those. If someone hires a PI to follow me, they are spending like $10000/week on that. Which means that their expected value is more than that, or that PI will never pay for itself. Where will this value come from? Likely from me, after all it's me they are tracking. So I am really worried, as I am about to lose a huge…

> they are spending like $10000/week on that. Maybe. A quick Google suggests it's cheaper[0] > Which means that their expected value is more than that But this definitely doesn't follow. Your assumption about "value" is misplaced here. You're strictly thinking monetary value. But if we want to think about monetary value, well Google currently has a market cap of 4.1T, Meta is 1.7T, and even companies like OpenAI are…

> The issue is that you were /being followed/.

The issue is someone paying attention to me specifically. Imagine instead of hiring guy to follow you, someone hires a guy to go through your trash. Or someone hires a guy to talk to all your friends. Or even someone hires a guy to go to the grocery store next to your house and buy every box of your favorite ice cream.

Most people would find it creepy. So the issue is not "you are being followed", the issue is "a stranger is paying attention to me".

Re: We found a stable Firefox identifier linking all your private Tor identities

#303

Post by ZiiS » Tue, Apr 28, 2026, 10:42 AM UTC

danlitt wrote: post #292

ZiiS wrote: post #227

Earlier quoted context omitted.

You can't go out in public naked and just ask everyone to look away. If you want someone you don't trust to run unvetted general purpose code on your machine you have to accept that you are trading away some privacy. You can sandbox them (wear cloths) but that doesn't give you strict privacy.

I do wear clothes (all JS code runs in a sandbox). This is a bit like saying "you should lock the door to your house" and therefore refusing to prosecute someone who steals from a house with a broken window frame. I did lock my door, and it's still a crime regardless!

I did not mean to excuse Firefox leaking this identifier or suggest we shouldn't strive to be as secure as possible. I just took issue with the blanket statement "should not have to choose". As well as making the Browser as secure as possible we also have to chose to limit functionality.

Re: We found a stable Firefox identifier linking all your private Tor identities

#304

Post by handedness » Tue, Apr 28, 2026, 10:57 PM UTC

fsflover wrote: post #265

handedness wrote: post #245

Earlier quoted context omitted.

This is some kind of technological No True Scotsman you keep doing. Also, please stop grossly misreading the comments of others. You consistently do it to numerous people here.

This has nothing to do with "No True Scotman", because my definitions and assumptions are not flexible. They are defined by the Qubes developers and documented. You misunderstanding me does not equal me being wrong. When I say "this tool protects you" and you reply "it doesn't protect you if you misuse it; you give dangerous advice", you are the one misleading everyone. (Same with the kill switches on Librem 5.) Othe…

> ...unless you think every advice must have a full documentation for tools attached to it.

Those aren't our only two choices, and this is pretty manipulative and fallacious rhetoric on multiple levels. It's difficult to take much of what you say in good faith, given how you persist despite it being pointed out to you repeatedly, and by many people.

Somewhere between your original comment and requiring all advice to have full documentation attached to it is a reasonable course of action. Another quality frequently exhibited by your comments is dealing in absolutes, which tends to undermine your points and make your positions technically fraught.

I think if you're evangelizing an OS people may be unfamiliar with, and for an audience discussing a particular vulnerability, the responsible thing to do is add even the bare minimum of context to your comment rather than continuing your habit of posting fairly bare links sometimes accompanied by terse absolutes as if they constitute substantive commentary. All that serves to do is turn people away from your beloved projects, and frequently backs you into technical corners requiring you to accept even the slightest responsibility for your comments.

Here's a way of doing it: "The bug described in the article still exists within a given VM, but Qubes OS is the most practical solution I've found to split Tor Browser identities across disposable virtual machines, which fully addresses this vulnerability."

I get that you aren't precise with your language, which is usually where people seek to correct you and you double down, but when discussing technical subjects we ought to be precise, lest we inadvertently cause problems for others. And you might, one holds out hope, actually learn that some of your technical assessments are founded on incomplete or incorrect assumptions.

It's easy to be a zealot, and anyone can do that, but it's not actually that much more work to make genuine contributions.

Re: We found a stable Firefox identifier linking all your private Tor identities

#305

Post by firefax » Tue, Apr 28, 2026, 11:06 PM UTC

spelledwrong wrote: post #298

firefax wrote: post #295

Earlier quoted context omitted.

Foucault was, but if we misunderstand on purpose, the sky is the limit.

You said “named after” when you meant “named after an idea popularized by”. If you type one thing and expect people to understand that you meant something else then I will have to assume that by this: >>people who do post grads tend to be well rounded enough to have read a bit of philosophy, or at least, they did in my day. you meant you once visited a university but never enrolled in any classes? You can complain th…

[dead]

Re: We found a stable Firefox identifier linking all your private Tor identities

#306

Post by fsflover » Wed, Apr 29, 2026, 4:04 PM UTC

handedness wrote: post #304

fsflover wrote: post #265

Earlier quoted context omitted.

This has nothing to do with "No True Scotman", because my definitions and assumptions are not flexible. They are defined by the Qubes developers and documented. You misunderstanding me does not equal me being wrong. When I say "this tool protects you" and you reply "it doesn't protect you if you misuse it; you give dangerous advice", you are the one misleading everyone. (Same with the kill switches on Librem 5.) Othe…

> ...unless you think every advice must have a full documentation for tools attached to it. Those aren't our only two choices, and this is pretty manipulative and fallacious rhetoric on multiple levels. It's difficult to take much of what you say in good faith, given how you persist despite it being pointed out to you repeatedly, and by many people. Somewhere between your original comment and requiring all advice to…

I will consider your advice, thanks.