Live data from Hacker News

Block Fingerprinting with Firefox

blog.mozilla.org

361–370 of 411 posts

Re: Block Fingerprinting with Firefox

#361

Earlier quoted context omitted.

And? I used to work for a defense contractor, using the military complex money to instead pay for civil projects that actually benefit normal people. You can take money that comes from "I don't like this thing", and then spend it on "this benefits everyone".

If that's truly your rationale then you're deluding yourself: you can take money, for sure, but as soon as you act to aid the source of the money then you're complicit in whatever that source is doing. You might consider the positive aspects of your use of the money out with the negative aspects of your aiding murder, say, but that's not quite what you outlined.

And that's why everyone who works for Google or Facebook should quit, too, but in the real world there are an insane amount of jobs that ultimately do really bad things, and we need work. So find somewhere that your particular skillset makes a net positive contribution instead of going homeless because almost every single big company is responsible for suffering in the world. The defense contract I worked for also has a strong civil presence and makes things like turn stiles, card readers, and emergency alert systems, and those directly benefit people rather than help murder folks. The idea that "my work directly benefits the part of the company that murders people", given how budgets actually work in large companies, is arguably far more delusional here.

Re: Block Fingerprinting with Firefox

#362

Earlier quoted context omitted.

And? I used to work for a defense contractor, using the military complex money to instead pay for civil projects that actually benefit normal people. You can take money that comes from "I don't like this thing", and then spend it on "this benefits everyone".

Does the defense contractor rag on the military afterwards? You can take money from something, use it for good, but it's kinda funny when you start to claim the hands that feeds you is evil and bad.

Given that they were a 60k employee company: yeah, some parts of them probably were.

Re: Block Fingerprinting with Firefox

#363

It seems that almost weekly, I am reminded why I love Firefox because of some new thing Mozilla is doing. A lot of good decisions have been coming from them lately.

FF is my primary browser, yet people I know that work in security laugh at me as they claim FF is always the first browser to fail in the hacker games. I don't know enough about why, but I'd love for that to not be a thing. Taking into account my threat profile (types of sites I visit, JS blocking, etc), I feel the hacking risk is still a worth while trade off for the lack of tracking.

There are more vulnerabilities in FF, or so I've heard. But most people I know in security love firefox, especially because of how easy it is to setup with tools like Burp Suite.

Re: Block Fingerprinting with Firefox

#364

Earlier quoted context omitted.

Seems like spammers wouldn't hire humans if they could fully automate it? That's about the best you could do as a defense.

Why do you assume they aren't automating it. The obvious thing if I'm a spammer is to hire humans to solve the problem, collect their output and feed it into my ML training. I now have the same dataset that google is using, for my ML. Actually I'm not sure I need to go to full ML: after a few rounds I can probably just use image compare (not ML) and just feed humans images that I haven't seen before. Of course round…

This is why Google will have to keep changing how the captchas work. Maybe using adversarial examples?

Re: Block Fingerprinting with Firefox

#365
post #102

Earlier quoted context omitted.

I would too, but clearly most people wouldn't, otherwise advertisement wouldn't be such a popular way to monetize apps and websites (and Google wouldn't be the behemoth that it is today). Actually I would also gladly pay for a decent search engine but even DuckDuckGo decided to monetize using ads, which IMO means that sooner or later if they're successful enough they'll become just as bad as the rest. Besides paying…

I’ve recently switched to startpage.com - they use Google for high quality search results, but anonymize all search requests and show non-personalized, non-tracking ads solely based on my current search term. Also, they’re based in Europe/Netherlands. I’m not affiliated with them. Just a happy user.

In my experience, when Google searches are better than DDG (which is not always), it's because the results are customized to your Google account and search history. StartPage generally gives me worse results than DDG, despite using Google as a backend.

Re: Block Fingerprinting with Firefox

#366
post #252

Earlier quoted context omitted.

Modern captchas are designed to be anti-human and use as for free training of their AI algorithms. We're slaves for free while Google benefits from this, both technologically and financially. Next captcha from google will be even more aggressive, you're not logged to Google = you're a bot, you can't access that content.

Next captcha from google will be even more aggressive, you're not logged to Google = you're a bot, you can't access that content. You may be right. But you know what: If I encounter captchas nowadays and unless I really need to get to that site it's "Fuck you very much!" time. I'm just not that interested in most of the web to make it woth my while and provide free work for Google.

I cancelled my subscription and deleted Spotify because of that. I can do with streaming of local radio and my own music.

I really hope the EU hits them hard with a GDPR investigation, the amount of identifiable data they collect with reCaptcha is unacceptable.

Re: Block Fingerprinting with Firefox

#367

I worked in the ad industry. Every web-browser including brave, tor,safari is uniquely identifiable even on same hardware. All the public computer researchers and browser vendors are years behind the techniques to fingerprint devices (probably 5+). Canvas, WebGl etc are techniques of the past. There are much more advanced ones, than can identify devices with completely uniquely (on both desktop and mobile) Also we kn…

In order to believe what you're claiming here, we have to believe that

1. There is magic css/js that can not only tell different browsers and devices apart, but can tell two phones from the same manufacturing run with the same software apart.

2. Despite the fact that this magic code would have to run in the client browser where its content, execution, and the data it sends back are all plainly visible to anyone who can hit ctrl-shift-j, no "public researcher or browser vendor" knows anything about it.

3. This technology is not used to combat ad fraud because of some weird conspiracy at Google.

It could be true, I suppose, but I don't see why anyone would believe this based on the evidence so far.

Re: Block Fingerprinting with Firefox

#368

Earlier quoted context omitted.

17.62 bits on firefox, 11.0 on Tor, 17.63 on chrome. On firefox, the big contributors are HTTP headers (my native language is announced), hash of WebGl fingerprint and time zone. On Tor big contributors are hash of webGL fingerprint, screen size. On chrome, they are system fonts, hash of canvas fingerprint, user agent, and time zone. I am not too concerned about the fingerprinting in firefox since I have strict block…

Panopticlick's numbers are extremely confusing and borderline useless. On my initial run, I got an overall entropy of 17.63. My two biggest identifiers were screen resolution (1000x595x24 which was approx 1/22000 browsers) and webgl hash (approx 1/3800 browsers). I fixed screen resolution to 1000x600x24 (approx 1/85 browsers) and disabled webgl hashing (approx 1/6 browsers) and the overall entropy did not change one…

An update on last night's experiment, if anyone cares. The next largest identifier was system fonts (approx 1/1300 browsers). I set `browser.display.use_document_fonts=0` which hid the system fonts (now the same as approx 1/10 browsers) and my overall entropy dropped to just below 11 bits. At this point, none of the metrics were less common than 1/10 browsers, so I figured I wouldn't be able to do better than that.

As a side note, I ended up re-enabling system fonts because disabling them broke a large percentage of web sites' CSS.

Re: Block Fingerprinting with Firefox

#369

I worked in the ad industry. Every web-browser including brave, tor,safari is uniquely identifiable even on same hardware. All the public computer researchers and browser vendors are years behind the techniques to fingerprint devices (probably 5+). Canvas, WebGl etc are techniques of the past. There are much more advanced ones, than can identify devices with completely uniquely (on both desktop and mobile) Also we kn…

Just today I decided to switch to FF and try noscript experience. Works good enough so far. Funny that crippled experience is even better in some weird ways. I used to scroll reddit forums, now I can read just few first posts and that is good. I used to expand a lot of comments, now I can't expand them, but it saves time. Sure, self-control would be better, but that is good too :) It's good to know that without JavaScript I'll send less data to that anti-human industry.

Re: Block Fingerprinting with Firefox

#370

Earlier quoted context omitted.

Thanks. I'd read the Wikipedia page, I'm just not clear why this process is allowed (or more importantly, why it can't be removed). Is there a legitimate use case for being able to read back pixels?

Literally any kind of image or photo manipulation, from an MS Paint-like webapp to Instagram-like photo filters.

[deleted]
Post reply on HN