Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor • Hacker News Board

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#41

Post by wnevets » Thu, May 13, 2021, 9:04 PM UTC

valve1 wrote: post #39

wnevets wrote: post #37

It though I had Skype, Spotify and Slack installed. I only have Slack installed.

Windows can sometimes say you have Skype, because it comes bundled even if you didn't install it yourself.

I've explicitly uninstalled it on Windows 10, maybe Windows is still reporting it?

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#42

Post by sneak » Thu, May 13, 2021, 9:08 PM UTC

burk96 wrote: post #40

Worked perfectly on Firefox 88.0.1 on Windows. Great to know despite my efforts to balance privacy and anonymity, there is another metric that I'm unique in. Fingerprinting is just insidious.

Browsing in a VM is really one of the only safe ways to go on the modern web for privacy. So many sites break without JS, and having it enabled is an accident waiting to happen.

When you need privacy, always browse in a VM or a Tails boot.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#43

Post by butz » Thu, May 13, 2021, 9:08 PM UTC

At least 9 of those programs could be "installed to desktop" on supported Chromium based browsers. That not only lowers your fingerprint in this particular vulnerability, but also saves quite a bit of disk space.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#44

Post by butz » Thu, May 13, 2021, 9:15 PM UTC

Test doesn't work when localStorage is disabled in browser.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#45

Post by [deleted] » Thu, May 13, 2021, 9:15 PM UTC

rozab wrote: post #16

Does this actually work correctly for anyone? Got wrong results for Firefox and Chrome on Linux (it warns that Chrome probably won't work). I glanced through the source[0] and my about:config and I noticed I have the dom.block_external_protocol_in_iframes setting enabled. Looks like this could be the mechanism they use? I don't remember enabling it manually. Otherwise, it could be my tiling window manager messing wit…

[deleted]

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#46

Post by difosfor » Thu, May 13, 2021, 9:18 PM UTC

How unique are these ids really? I imagine certain apps will be very commonly installed as well as certain groups of apps? So it's not 32bits of information. Still more information to add to the finger printing pile..

I wish we could find a way to deal with this risk that's not simply disabling all kinds of functionality. Browser APIs seem to be suffering more and more by limitations to prevent finger printing.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#47

Post by taf2 » Thu, May 13, 2021, 9:19 PM UTC

Interesting but only works on desktop

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#48

Post by seumars » Thu, May 13, 2021, 9:19 PM UTC

Fingerprinting and profiling in general just makes me not want to use the internet sometimes. I stopped using gmail at the very least. Maybe I should start using a VPN.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#49

Post by eulers_secret » Thu, May 13, 2021, 9:21 PM UTC

rozab wrote: post #16

Does this actually work correctly for anyone? Got wrong results for Firefox and Chrome on Linux (it warns that Chrome probably won't work). I glanced through the source[0] and my about:config and I noticed I have the dom.block_external_protocol_in_iframes setting enabled. Looks like this could be the mechanism they use? I don't remember enabling it manually. Otherwise, it could be my tiling window manager messing wit…

Worked for me on FF 88.0/Kubuntu 21.04. Detected the 2 apps I have installed correctly. I was also unique.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#50

Post by Forbo » Thu, May 13, 2021, 9:21 PM UTC

I appear to be getting false positives with a different identifier each time I run it. It says I have 3-4 different applications installed, none of which actually are on my system. Each subsequent run comes back with a different set of applications, and a different unique identifier. Looks like I may have beaten this method of fingerprinting, although I'm not quite sure how.