Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

zdnet.com

Post reply on HN
Print view View original

41–50 of 216 posts

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#41

Post by function_seven »

trumped wrote: post #32
burtonator wrote: post #24

Earlier quoted context omitted.

Apps need it to determine where to place elements. If it wasn't you would still be able to reverse engineer it by sticking elements outside the viewport and seeing if they're hidden or not. Turns out anonymity is super freaking hard. :-/

apps? do we consider websites apps now? but either way if you have the JS, CSS and HTML, you should know where to put elements. Are nyc (news yc com) people part of the problem?

What CSS file did the browser fetch? The one for screens less than 500px wide? Or the one for screens that are 504px wide?

There are a million ways to exfiltrate UI parameters through JS and CSS. It’s hard to both prevent that and still allow JS and responsive pages.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#42

Post by meruru »

ehsankia wrote: post #28
burtonator wrote: post #24

Earlier quoted context omitted.

Apps need it to determine where to place elements. If it wasn't you would still be able to reverse engineer it by sticking elements outside the viewport and seeing if they're hidden or not. Turns out anonymity is super freaking hard. :-/

I don't get it. Don't the majority of people browse at full screen, on common devices which all have the same fullscreen dimensions? Who out there browses to a size, resizes there window, then browses to another website, then resizes again and so on? That makes no sense.

The OS chrome between users varies a ton. Each taskbar, dock and titlebar can have their own size. In my case I'm using a window manager without decorations, so I don't even have a titlebar!

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#43

Post by mrmekon »

Swenrekcah wrote: post #31
ehsankia wrote: post #28

Earlier quoted context omitted.

I don't get it. Don't the majority of people browse at full screen, on common devices which all have the same fullscreen dimensions? Who out there browses to a size, resizes there window, then browses to another website, then resizes again and so on? That makes no sense.

I would actually really like an answer to this question, I’ve often thought about it!

Huh, I thought the original was a sarcastic question. In that case, let me explain:

I keep a browser window open at all times. It is never full screen, because if it were full screen I wouldn't be able to see multiple windows at the same time.

I keep my browsing window as close to 1024x768 as possible. In 2019, a lot of websites can't handle a browser window using a mere 75% of the laptop screen, so they either render incorrectly or, worse, switch to a mobile view. When that happens, I either blacklist the website forever in a contemptuous fervor, or just resize the window. Apparently, this resizing action is trackable.

When I say "as close to 1024x768" as possible, I mean exactly 1024x768 unless I have resized it and forgotten. I use a little AppleScript thing to resize it to 1024x768, precisely for browser fingerprinting reasons. When you resize the window by hand, you typically end up with a VERY unique window dimension.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#44

Post by meruru »

MagicPropmaker wrote: post #30
meruru wrote: post #19

Earlier quoted context omitted.

reCAPTCHA is a Google thing so it gets blocked in my browser already anyway (by uMatrix). If I need to load it to see a website, I close the tab immediately and go somewhere else.

You need reCAPTCHA to log into HN (or at least I do when I'm working from some parts of the middle east)

I log into HN almost everyday, each time from a different location (Tor) and I've never seen a reCAPTCHA on HN.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#45

Post by manigandham »

ehsankia wrote: post #28
burtonator wrote: post #24

Earlier quoted context omitted.

Apps need it to determine where to place elements. If it wasn't you would still be able to reverse engineer it by sticking elements outside the viewport and seeing if they're hidden or not. Turns out anonymity is super freaking hard. :-/

I don't get it. Don't the majority of people browse at full screen, on common devices which all have the same fullscreen dimensions? Who out there browses to a size, resizes there window, then browses to another website, then resizes again and so on? That makes no sense.

Yes. I'm in adtech. 60% of browsers are mobile/tablet which are already fixed. The rest are almost always fullscreen. Maybe 2% have non-standard sizes.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#47

Post by trumped »

function_seven wrote: post #41
trumped wrote: post #32

Earlier quoted context omitted.

apps? do we consider websites apps now? but either way if you have the JS, CSS and HTML, you should know where to put elements. Are nyc (news yc com) people part of the problem?

What CSS file did the browser fetch? The one for screens less than 500px wide? Or the one for screens that are 504px wide? There are a million ways to exfiltrate UI parameters through JS and CSS. It’s hard to both prevent that and still allow JS and responsive pages.

just grab them all... not a huge deal, they are so small.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#48

Post by EGreg »

Swenrekcah wrote: post #40
joshred wrote: post #33

Earlier quoted context omitted.

Does that matter? Don't devs cater to the outliers?

It matters because if 99% of people have the same 5 configurations and only the outliers are identifiable, then this method would not be as valuable for spying as it is reported to be.

This! So what’s the answer??

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#49

Post by meruru »

manigandham wrote: post #45
ehsankia wrote: post #28

Earlier quoted context omitted.

I don't get it. Don't the majority of people browse at full screen, on common devices which all have the same fullscreen dimensions? Who out there browses to a size, resizes there window, then browses to another website, then resizes again and so on? That makes no sense.

Yes. I'm in adtech. 60% of browsers are mobile/tablet which are already fixed. The rest are almost always fullscreen. Maybe 2% have non-standard sizes.

When you two say fullscreen, surely you mean maximized? I imagine a sizeable fraction of users don't even know how to fullscreen a window.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#50

Post by godelski »

newscracker wrote: post #37

Every time there's something about online privacy with browsers, it's mostly Firefox or Safari. I wondered if Chrome had resisting fingerprinting on its radar (guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online), and I found this [1] confirming my guess (emphasis mine): > Since we don't believe it's feasible to provide some mode of Chrome that can truly prev…

> guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online

I would actually think the opposite. Wouldn't it be better because then only Google would have that information? Only Google would be able to fingerprint. This is of course under the assumption (which is currently accurate) that Google has the majority share of browsers. But maybe it wouldn't be, because it would teach others how to thwart their fingerprinting.

Post reply on HN